ApplicationOverride results in "Unable to locate an encrypted key"

[Cameron Kerr]

Thanks for the quick reply Scott, your attention is much appreciated.

After a day of struggling, I found the error; it was in httpd. I had 'ShibRequestSetting applicationId siteA' constrained to <Location /secure>, and some PHP stuff, but that was not enough; it didn't cover /Shibboleth.sso, thus when it went to siteA's /Shibboleth.sso/... mod_shib was rightly expecting a response addressed to the default entityID.

It would be _super_ helpful if https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride had a note around 'Mapping via Apache Commands ...' that said you need to ensure that /Shibboleth.sso is required to be covered. My past experience with other similar products (Oracle SSO) leads me to minimize the amount of machinery that things like public assets get exposed to -- lest they do things like override your Cache-Control headers.

My comments in my previous system (I've apparently struck this problem before), suggest that perhaps it manifests itself differently than I previously encountered.

    # NOTE: This also covers /Shibboleth.sso, so if you narrow the focus to
    # some subset of the site, you'll need to replicate it for /Shibboleth.sso
    # If you don't, you'll get errors in the likes of /Shibboleth.sso/SSO/POST
    # saying something about an unacceptable audience because it would be
    # expecting default-entityID, but should
    # instead be configured to expect	
    # override-entityID.  Easiest is to have a <Location />, but we might not
    # want to invoke other potentially conflicting machinery which might impact
    # on performance or functionality (eg. cache optimization)
    #
    # See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride
    # and read it ALL... three, no FOUR times.
    #
    <Location />
        ShibRequestSetting applicationId siteA	
    </Location>

Cheers,
Cameron

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, 3 November 2016 2:28 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: ApplicationOverride results in "Unable to locate an encrypted key"

Basic advice:

Never use different keys with overrides, that doesn't really serve any purpose.

The error is because of the key name information the IdP is probably embedding in the message.

There are no "correct" names in an SP certificate used for authentication, signing, or encryption. Only the key matters. Screwing around with the names will create errors where none would have existed.

-- Scott
 
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net