Multiple Logic SP's -- assertion decrypting failed

[joller lee]

Oops, I failed to hide my host name thoroughly..  :P

For consistence, the statement in the certificate should be:

X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:my.host.name, URI:https://my.host.name/shibboleth


On Thu, Mar 17, 2016 at 6:09 PM, joller lee <joller.lee at gmail.com> wrote:

> I've deployed an SP without any problem for quite a while.
> Now I am trying to configure a "logical SP's" on the same physical SP
> installation,
> with a new vhost that is only different on the port number.
> The metadata for the new logical SP is created by simply copying the
> original one
> and modifying the entityID and endpoints, which means the same key pair is
> used.
> Also in the ApplicationOverride setting, the same pair of key/cert files
> are used.
> (In fact, I believe CredentialResolver can be ignored here, thanks to
> inheritance)
>
> Their entityID's are as follow:
>
>     the original: https://my.host.name/shibboleth
>     the new one: https://my.host.name/shibboleth/app1
>
> The original SP still works well.
> But with the new one, I encounter a problem:
> After a valid authentication process, the IdP sends back the assertion,
> but the new logical SP fails to decrypt it, with the following error
> message:
>
>     failed to decrypt assertion: Unable to locate an encrypted key.
>
> Just in case, I've tried analyzing the certificate, and there is a
> statement:
>
> X509v3 extensions:
>             X509v3 Subject Alternative Name:
>                 DNS:zimbra.ntin.edu.tw, URI:
> https://my.host.name/shibboleth
>
> Has anyone encountered the same problem before?
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160317/15ec53ea/attachment.html>