questions about debugs on testshib and signed Assertions issue

[Michael Weyandt]

Hello,

I’ve been testing my upgrade of IdPv3 and noticed the following two debug messages on testshib occur

DEBUG XMLTooling.CredentialCriteria [1637]: key algorithm didn't match ('AES' != 'RSA')
DEBUG XMLTooling.KeyInfoResolver.Inline [1637]: resolving ds:X509Certificate
DEBUG XMLTooling.KeyInfoResolver.Inline [1637]: resolved 1 certificate(s)
DEBUG XMLTooling.CredentialCriteria [1637]: credential name(s) didn't overlap
DEBUG XMLTooling.CredentialCriteria [1637]: keys didn't match
and
DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolving ds:X509Certificate
DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolved 1 certificate(s)
DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolved 0 CRL(s)
DEBUG XMLTooling.TrustEngine.ExplicitKey [1634]: attempting to match credentials from peer with end-entity certificate
DEBUG XMLTooling.TrustEngine.ExplicitKey [1634]: no keys within this peer's key information matched the given end-entity certificate
DEBUG XMLTooling.TrustEngine.PKIX [1634]: performing certificate path validation...
DEBUG XMLTooling.TrustEngine.PKIX [1634]: failed to validate certificate chain using supplied PKIX information
ERROR XMLTooling.SOAPTransport.CURL [1634]: supplied TrustEngine failed to validate SSL/TLS server certificate
any comments/suggestions on these would be great.



I’m also dealing with a outside sp (not using shib, but the issue may be on my side although I have some doubts) that is insisting I’m sending signed assertions which I believe I’m not (default is false, and I’ve humored them and manually added it to no avail). I’m not sure how to move forward with them, they’re going off of the following
ERROR saml.Consumer: Error processing IdP response
org.opensaml.common.SAMLException: org.opensaml.xml.validation.ValidationException: Signature cannot be validated
so if anyone has any suggestions on what I could try on my end that’d be great. Otherwise I understand it’s not shibboleth so just ignore this last bit.

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160629/26d75f84/attachment.html>