Veoci Integration

[Andrew Morgan]

On Wed, 8 Feb 2017, Klingenstein, Nate wrote:

> I'm trying to integrate a Shibboleth 3.3 IdP with a Spring Security SAML 
> SP implementation.  There are signed requests and three certificates in 
> their metadata, which I can control locally.  Two are marked for 
> signature and one is marked for encryption.
>
> If I turn off signed authentication requests in their metadata and spoof 
> a request, it can't locate an encryption key.
>
> https://stage.veoci.com/veoci/saml/login?idp=https://idp-co.calstate.edu/idp/shibboleth
> https://idp-co.calstate.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https://stage.veoci.com/sp
>
> If I tell it that encryption is optional, doctor their metadata, and use 
> the unsolicited endpoint, a message is actually dispatched and parsed.
>
> This feels like signature validation is just failing, but if anyone has 
> experience, let me know.

>From your sentence above, I'm not sure whether you are referring to the 
your IDP or the SP when you say, "it can't locate an encryption key."

Is the problem that your IDP can't/won't use the encryption key you have 
in the local metadata or that the SP can't decrypt the SAML response?

Thanks,
 	Andy