Testshib config failing after successful authentication

[Steve Sirag]

I'm setting up a Shibboleth 2.6 win64 test config on a new Windows 2012 R2 server.  I've installed the Windows IIS6 compatibility components and all prerequisites stated in this document:

https://doit.missouri.edu/wp-content/uploads/2014/09/WindowsGuide.pdf

I'm getting a 500 error on the return page after successfully authenticating with the TestShib IdP, containing this error:

opensaml::FatalProfileException at (https://testshib.eresources.com/Shibboleth.sso/SAML2/POST)
A valid authentication statement was not found in the incoming message.

In the shibd.log file, I see this error:

ERROR Shibboleth.SSO.SAML2 [1]: failed to decrypt assertion: Unable to resolve any key decryption keys.

I've uninstalled/reinstalled Shibboleth, re-uploaded Metadata, and checked the sp-cert.pem to make sure the public key matches my Metadata file.

My key Shibboleth2.xml configs specific to the test site are as follows:

<InProcess logger="native.logger">
        <ISAPI normalizeRequest="true" safeHeaderNames="true">
                <Site id="3" name="testshib.eresources.com" scheme="https" port="443"/>
        </ISAPI>
</InProcess>

<RequestMapper type="Native">
        <RequestMap>
            <Host name="testshib.eresources.com" applicationId="testshib">
                <Path name="secure" authType="shibboleth" requireSession="true"/>
            </Host>
        </RequestMap>
</RequestMapper>

<ApplicationOverride id="testshib" entityID="http://testshib.eresources.com/shibboleth-sp">
<Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="false">
                                <SSO entityID="https://idp.testshib.org/idp/shibboleth">
                                SAML2 SAML1
                                </SSO>
                </Sessions>
<MetadataProvider type="XML" uri="http://www.testshib.org/metadata/testshib-providers.xml" backingFilePath="testshib-two-idp-metadata.xml" legacyOrgNames="true" reloadInterval="180000"/>
</ApplicationOverride>

This works on another identical server, but doesn't work on this one.
What am I missing?

Regards,

Steve Sirag

eResources
O: 800-297-8293 x7034
C: 703-608-8127
eresources.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160727/c2bb7681/attachment-0001.html>