Multiple Logic SP's -- assertion decrypting failed

[joller lee]

>
>
> I don't have much else to suggest, if the certificate in the message is
> exactly what the SP has on hand. You can try turning up the log and see if
> it says anything while it's searching out a key to use.
>

After changing the root level to DEBUG, the log messages for the original
SP and the new one are as follow:

(the original)
DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [4]: validating signature
profile
DEBUG XMLTooling.CredentialCriteria [4]: keys didn't match
DEBUG XMLTooling.TrustEngine.ExplicitKey [4]: attempting to validate
signature with the peer's credentials
DEBUG XMLTooling.TrustEngine.ExplicitKey [4]: signature validated with
credential
DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [4]: signature verified
against message issuer
DEBUG Shibboleth.SSO.SAML2 [4]: processing message against SAML 2.0 SSO
profile
DEBUG XMLTooling.CredentialCriteria [4]: key algorithm didn't match ('AES'
!= 'RSA')
DEBUG Shibboleth.SSO.SAML2 [4]: decrypted Assertion: <saml2:Assertion ...

(the new one)
DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: validating signature
profile
DEBUG XMLTooling.CredentialCriteria [1]: keys didn't match
DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: attempting to validate
signature with the peer's credentials
DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: signature validated with
credential
DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: signature verified
against message issuer
DEBUG Shibboleth.SSO.SAML2 [1]: processing message against SAML 2.0 SSO
profile
DEBUG XMLTooling.CredentialCriteria [1]: key algorithm didn't match ('AES'
!= 'RSA')
ERROR Shibboleth.SSO.SAML2 [1]: failed to decrypt assertion: Unable to
locate an encrypted key.

As shown above, the messages are almost identical in both the successful
case the failed one,
except for the last sentence.

I don't think there's any way for it to fail based on what you described, I
> was just grasping at straws. I guess I would suggest not duplicating the
> CredentialResolver the way you said you did.
>
> I've tried this too, and nothing changes.

I'm going to try using different key pair for the new logical SP and see if
it works.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160318/99229957/attachment-0001.html>