signature failing

[Jeff Mccullough]

Hi,

I’m using IDP 3.2.1. There is one SP that reports that the signature the IDP is sending in the SAML response is invalid. The cert in the response is correct. I checked the response with the validation tool at <https://www.samltool.com/validate_response.php <https://www.samltool.com/validate_response.php>>, and get the error:

THE SAML RESPONSE IS INVALID.

Reference validation failed

What else should I examine or change in my configuration?

Thanks,
Jeff



The response is included
———————————

<saml2p:Response
    Destination="https://sp-here/wfc/logonESS_SSO"
    ID="_05ba5ba9448be7de75cdebc878bbd97d"
    IssueInstant="2017-01-04T21:26:03.850Z" Version="2.0"
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion”>idp-here</saml2:Issuer>
    <ds:Signature
                xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
                Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod
                Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference
                        URI="#_05ba5ba9448be7de75cdebc878bbd97d">
<ds:Transforms>
<ds:Transform
                        Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                        <ec:InclusiveNamespaces PrefixList="xsd" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>JxUltIs20c/mhD6UZcpN2U4Df+BtQuNUqZl4p5cA5dA=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
WP8Iaf0xOFzj0Gk+QO+rrAeYPrjn1DFjzagl8rS15ykDUCUA4C0H5D1DVcj9BL43Z+KT+2WPZW5Y
scp0EZDg+rXpU/6h3qL6alvbUljCnOojDa2NtX5diShQHb8ClPhD0vDi5VBA8KeZ5JzgPqKSWL64
FJYeDhQLBWXDi4qSyCC4NdvZ6WvSUV7CtXOAXe791Uzp+hQ/pM9FKlfm01WIH9Cd/6TPwcjrtkXU
QhXoTMvPQVPMBnHVw1hLLVh2lxUcrHe5D3OvEVwY3tfoSBuz5QxXxxKTI7XJFCQ5VreM7BjLGD/f
6P3VakU4RrrbJTpwx6u3hS7v4IEOu+qI6HGu+Q==
</ds:SignatureValue>
<ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>
		[……..]
		</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
	    <saml2p:Status>
	        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
	    </saml2p:Status>
	    <saml2:Assertion ID="_02727147fca88cb6b03bc1fe34ef25f4"
	        IssueInstant="2017-01-04T21:26:03.850Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
	        <saml2:Issuer>idp-here</saml2:Issuer>
	        <saml2:Subject>
	            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
	                <saml2:SubjectConfirmationData Address="10.136.1.241"
	                    NotOnOrAfter="2017-01-04T21:31:03.862Z" Recipient=“sp-here"/>
	            </saml2:SubjectConfirmation>
	        </saml2:Subject>
	        <saml2:Conditions NotBefore="2017-01-04T21:26:03.850Z" NotOnOrAfter="2017-01-04T21:31:03.850Z">
	            <saml2:AudienceRestriction>
	                <saml2:Audience>entity-id-here</saml2:Audience>
	            </saml2:AudienceRestriction>
	        </saml2:Conditions>
	        <saml2:AuthnStatement AuthnInstant="2017-01-04T21:26:03.621Z" SessionIndex="_79ac04e21ca4c9ae04aca42e3629dc94">
	            <saml2:SubjectLocality Address="10.136.1.241"/>
	            <saml2:AuthnContext>
	                <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
	            </saml2:AuthnContext>
	        </saml2:AuthnStatement>
	        <saml2:AttributeStatement>
	            <saml2:Attribute
	                FriendlyName=“attribute-name"
	                Name="urn:oid:1.3.6.1.4.1.4995.2.200.10.1.5.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
	                <saml2:AttributeValue
	                    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string”>some-value</saml2:AttributeValue>
	            </saml2:Attribute>
	        </saml2:AttributeStatement>
	    </saml2:Assertion>
	</saml2p:Response>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170112/790c95ec/attachment-0001.html>