SP is not accepting the certificate of the IDP

[Peter Schober]

* Yasser Afifi <yasser at 3dissue.com> [2016-01-29 12:53]:
> Thanks a lot for your reply, Why am I getting this error then?  " Unable to
> establish security of incoming assertion". I matched the certificates (in
> both idp metadata and the actual certificates in /credentials). I also made
> sure that the SP has the correct metadata with all this info. Why would I
> still get this error?

You didn't state that you did all this, otherwise I wouldn't have to
explain to you that you'd need to do this.

The explanation for that error message can be found via
Shibboleth wiki home page -> Troubleshoot -> SP: Common errors.
It's the third one listed there.

> My Second question is if we are not using the SOAP attribute query, should
> i comment it out in the metadata? I mean this one:
>         <AttributeService
> Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="
> https://3dissueyasser.com:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>

That's for SAML1, but the answer is the same: Unless you need to use
it, I would remove it from the Metadata you publish/give to SPs.
(That applies to any SAML1 endpoints as well as to any backchannel
endpoints, i.e., Artifacts and AttributeQueries.)

> do you think this might make problems if i leave it?

Depends. Unless you have the backchannel configured correctly (which I
think we have established earlier that you hadn't) publishing support
for it is not advised.

> My third question is, at production deployment, if i want to use my
> company's certificate inside the IDP, how can I do that? or should i
> keep the IDP-generated certificates?

What is your "company's certificate"? Anyway, the answer is no, you
should not. The write-up on this is here, not sure this helps:
https://wiki.shibboleth.net/confluence/display/CONCEPT/TrustManagement

See also https://wiki.oasis-open.org/security/SAML2MetadataIOP for a
formal specification.
-peter