SLO Request Not Signed

[Brian Moon]

Interesting.  In looking at the Apache log I do indeed see a Signature
query param sent, complete with signature.  Since I assume that this is
using the signing cert, it makes me wonder why my SP is throwing an
exception with the following errors:

No certificate in message when validating against fingerprint.
Validation of received messages enabled, but no signature found on message.


Brian Moon
Senior System Administrator
Enterprise Systems
Santa Clara University
Office: 408.554.4830
bmoon at scu.edu

On Thu, Apr 13, 2017 at 4:34 PM, Brent Putman <putmanb at georgetown.edu>
wrote:

>
>
> On 4/13/17 5:30 PM, Brian Moon wrote:
>
> Hello all,
>
> I am trying to get the Single Logout to propagate to my SPs, but I am
> running into an issue where the request being sent to an SP is not signed
> (and thus being rejected by the SP).
>
>
> 2017-04-13 13:59:24,895 - DEBUG [net.shibboleth.idp.saml.profile.impl.
> PopulateBindingAndEndpointContexts:418] - Profile Action
> PopulateBindingAndEndpointContexts: Resolved endpoint at location
> https://mysp/sp/logoutURL using binding urn:oasis:names:tc:SAML:2.0:
> bindings:HTTP-Redirect
>
> 2017-04-13 13:59:24,947 - DEBUG [net.shibboleth.idp.saml.profile.impl.
> SpringAwareMessageEncoderFactory:100] - Looking up message encoder based
> on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
>
>
> 2017-04-13 13:59:24,974 - INFO [Shibboleth-Audit.LogoutPropagation:241] -
> 20170413T205924Z|||https://mysp/sp|http://shibboleth.net/
> ns/profiles/saml2/logout|https://myidp/idp/shibboleth|
> urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|Value Removed||||Value
> Removed||
>
>
>
> Based on the above log messages, the XML LogoutRequest would not be signed
> with an XML signature; indeed it can not be, that would violate the
> Redirect binding spec.  Instead this would be a binding-level signature,
> represented by a Signature query parameter on the redirect URL.
>
> To confirm, examine the actual redirect URL on the wire to see whether it
> carries a 'Signature' query param.
>
> If Signature is not present, then maybe we have a bug around
> resolving/populating the signing creds for the logout case.  I'm not that
> familiar with this code in the IdP, but Scott would probably know better.
>
> If Signature is present, then either SP has a bug or it simply doesn't
> support this binding for LogoutRequests, or something like that.
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170413/780e4552/attachment-0001.html>