questions about debugs on testshib and signed Assertions issue

[Kevin Foote]

> On Jun 29, 2016, at 13:35, Michael Weyandt <maw120 at zips.uakron.edu> wrote:
> 
> Hello,
> 
> I’ve been testing my upgrade of IdPv3 and noticed the following two debug messages on testshib occur
> 
> DEBUG XMLTooling.CredentialCriteria [1637]: key algorithm didn't match ('AES' != 'RSA')
> DEBUG XMLTooling.KeyInfoResolver.Inline [1637]: resolving ds:X509Certificate
> DEBUG XMLTooling.KeyInfoResolver.Inline [1637]: resolved 1 certificate(s)
> DEBUG XMLTooling.CredentialCriteria [1637]: credential name(s) didn't overlap
> DEBUG XMLTooling.CredentialCriteria [1637]: keys didn't match
> 
> and
> DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolving ds:X509Certificate
> DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolved 1 certificate(s)
> DEBUG XMLTooling.KeyInfoResolver.Inline [1634]: resolved 0 CRL(s)
> DEBUG XMLTooling.TrustEngine.ExplicitKey [1634]: attempting to match credentials from peer with end-entity certificate
> DEBUG XMLTooling.TrustEngine.ExplicitKey [1634]: no keys within this peer's key information matched the given end-entity certificate
> DEBUG XMLTooling.TrustEngine.PKIX [1634]: performing certificate path validation...
> DEBUG XMLTooling.TrustEngine.PKIX [1634]: failed to validate certificate chain using supplied PKIX information
> ERROR XMLTooling.SOAPTransport.CURL [1634]: supplied TrustEngine failed to validate SSL/TLS server certificate
> 
> any comments/suggestions on these would be great.
> 
> 
> I’m also dealing with a outside sp (not using shib, but the issue may be on my side although I have some doubts) that is insisting I’m sending signed assertions which I believe I’m not (default is false, and I’ve humored them and manually added it to no avail). I’m not sure how to move forward with them, they’re going off of the following

> ERROR saml.Consumer: Error processing IdP response
> org.opensaml.common.SAMLException: org.opensaml.xml.validation.ValidationException: Signature cannot be validated
> 
> so if anyone has any suggestions on what I could try on my end that’d be great. Otherwise I understand it’s not shibboleth so just ignore this last bit.

Hi Mike, 

What are the entityIDs you have uploaded to testshib?
That will give us a place to start.

--------
thanks
 kevin.foote