Testshib problem: Please delete old idp registrations with outdated cert
Robert Kornmesser
robert.kornmesser at gfz-potsdam.de
Mon Nov 14 07:49:32 EST 2016
Hello,
i might need some help. I, or some co-worker, registered an IDP with an
old certificate, which might cause the following error:
2016-11-14 07:33:46 DEBUG OpenSAML.MessageDecoder.SAML2 [7903]:
extracting issuer from SAML 2.0 protocol message
2016-11-14 07:33:46 DEBUG OpenSAML.MessageDecoder.SAML2 [7903]: message
from (https://idp-dev.gfz-potsdam.de/cas/idp)
2016-11-14 07:33:46 DEBUG OpenSAML.MessageDecoder.SAML2 [7903]:
searching metadata for message issuer...
2016-11-14 07:33:46 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow
[7903]: evaluating message flow policy (replay checking on, expiration 60)
2016-11-14 07:33:46 DEBUG XMLTooling.StorageService [7903]: inserted
record (_3694091438223139691) in context (MessageFlow) with expiration
(1479127065)
2016-11-14 07:33:46 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [7903]:
validating signature profile
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolved 4 certificate(s)
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolved 0 CRL(s)
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolved 4 certificate(s)
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolved 0 CRL(s)
2016-11-14 07:33:46 DEBUG XMLTooling.CredentialCriteria [7903]: keys
didn't match
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.ExplicitKey [7903]:
unable to validate signature, no credentials available from peer
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: validating
signature using certificate from within the signature
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: signature
verified with key inside signature, attempting certificate validation...
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: checking
that the certificate name is acceptable
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: adding to
list of trusted names (https://idp-dev.gfz-potsdam.de/cas/idp)
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]:
certificate subject:
CN=idp-dev.gfz-potsdam.de,OU=Rechenzentrum,O=GeoForschungsZentrum
Potsdam,L=Potsdam,ST=Brandenburg,C=DE
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: unable to
match DN, trying TLS subjectAltName match
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: unable to
match subjectAltName, trying TLS CN match
2016-11-14 07:33:46 ERROR XMLTooling.TrustEngine.PKIX [7903]:
certificate name was not acceptable
2016-11-14 07:33:46 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [7903]:
unable to verify message signature with supplied trust engine
Could some one delete all IDP Registrations with an entity ID starting
with "https://idp-gfz-potsdam.de"
(https://idp-dev.gfz-potsdam.de/cas/idp, https://idp-dev.gfz-potsdam.de,
....).
Many thanks!
PS: Is it correct to have the cert chain inside multiple
<ds:X509Certificate> tags? My metdata looks like this:
<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xml="http://www.w3.org/XML/1998/namespace"
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
entityID="https://idp-dev.gfz-potsdam.de/cas/idp">
...
<IDPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
...
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<!--Signer cert:
CN=idp-dev.gfz-potsdam.de,OU=Rechenzentrum,O=GeoForschungsZentrum
Potsdam,L=Potsdam,ST=Brandenburg,C=DE -->
<ds:X509Certificate>
...
</ds:X509Certificate>
<!-- Intermediate CA subject=
/C=DE/O=GeoForschungsZentrum Potsdam/CN=GeoForschungsZentrum Potsdam CA
- G01/emailAddress=pki at gfz-potsdam.de -->
<ds:X509Certificate>
...
</ds:X509Certificate>
<!-- Intermediate CA subject=
/C=DE/O=GeoForschungsZentrum Potsdam/CN=GeoForschungsZentrum Potsdam CA
- G01/emailAddress=pki at gfz-potsdam.de -->
<ds:X509Certificate>
...
</ds:X509Certificate>
<!-- Root CA subject= /C=DE/O=Deutsche Telekom
AG/OU=T-TeleSec Trust Center/CN=Deutsche Telekom Root CA 2 -->
<ds:X509Certificate>
...
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
...
</IDPSSODescriptor>
...
</EntityDescriptor>
--
B.Sc. Robert Kornmesser
Rechenzentrum
Tel.: +49 (0)331/288-28763
Fax: +49 (0)331/288-1703
Email: robert.kornmesser at gfz-potsdam.de
___________________________________
Helmholtz-Zentrum Potsdam
Deutsches GeoForschungsZentrum GFZ
Stiftung des öff. Rechts Land Brandenburg
Telegrafenberg, 14473 Potsdam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161114/dfb44716/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5182 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20161114/dfb44716/attachment-0001.p7s>
More information about the users
mailing list