IDP 3 Logout error

[José Ramalho]

Thank you Brent and Scott.

The problem was, like Scott said, the public part of my IDP encryption key
was no not correct on IDP Metadata.

As soon as I corrected, problem solved!

Many thanks to both!

 

Jose Ramalho

Universidade de Aveiro, Portugal

 

 

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: 30 de março de 2017 18:22
To: users at shibboleth.net
Subject: Re: IDP 3 Logout error

 

 

 

On 3/30/17 12:27 PM, José Ramalho wrote:

2017-03-30 17:13:42,917 - WARN
[org.opensaml.saml.saml2.profile.impl.DecryptNameIDs:99] - Profile Action
DecryptNameIDs: Failure performing decryption

org.opensaml.xmlsec.encryption.support.DecryptionException: Failed to
decrypt EncryptedData

 


Looks like your logout request is sending an encrypted NameID.  It seems it
can't resolve the proper decryption key.

Offhand my first suggestion is to check the config you have in your
conf/credentials.xml.  Specifically the beans
'shibboleth.EncryptionCredentials' and
'shibboleth.DefaultEncryptionCredentials'.  If you need a reference to an
unmodified copy, see:

https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-c
onf/src/main/resources/conf/credentials.xml;hb=refs/heads/master

Most importantly, make sure that whatever key(s) you are publishing in
metadata and used by SPs to encrypt to you are included in those beans
(lists of credentials).  For example, if you have added additional keys to
your published metadata that SPs have about your IdP, then those additional
keys need to be added there as well. 

A bit more info here:
https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170404/cf5e57ab/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4584 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170404/cf5e57ab/attachment-0001.p7s>