IDP 3 Logout error

[José Ramalho]

I all,

 

I have configured Shibboleth  for SLO with SP 2.6 and IDP 3.3. Both SP+IDP
are installed on windows 2012 R2.

Each time a I invoke https://mysite.com/Shibboleth.sso/Logout i am correctly
redirected to my IDP but there I get the following error:

 

2017-03-30 17:13:42,902 - ERROR
[org.opensaml.xmlsec.encryption.support.Decrypter:717] - Error decrypting
encrypted key

org.apache.xml.security.encryption.XMLEncryptionException: Unwrapping failed

                at
org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1532)

Caused by: java.security.InvalidKeyException: Unwrapping failed

                at
com.sun.crypto.provider.RSACipher.engineUnwrap(RSACipher.java:445)

Caused by: javax.crypto.BadPaddingException: Decryption error

                at sun.security.rsa.RSAPadding.unpadOAEP(Unknown Source)

2017-03-30 17:13:42,902 - ERROR
[org.opensaml.xmlsec.encryption.support.Decrypter:654] - Failed to decrypt
EncryptedKey, valid decryption key could not be resolved

2017-03-30 17:13:42,902 - ERROR
[org.opensaml.xmlsec.encryption.support.Decrypter:547] - Failed to decrypt
EncryptedData using either EncryptedData KeyInfoCredentialResolver or
EncryptedKeyResolver + EncryptedKey KeyInfoCredentialResolver

2017-03-30 17:13:42,917 - ERROR
[org.opensaml.saml.saml2.encryption.Decrypter:178] - SAML Decrypter
encountered an error decrypting element content

org.opensaml.xmlsec.encryption.support.DecryptionException: Failed to
decrypt EncryptedData

                at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptDataToDOM(Decrypter.
java:550)

2017-03-30 17:13:42,917 - WARN
[org.opensaml.saml.saml2.profile.impl.DecryptNameIDs:99] - Profile Action
DecryptNameIDs: Failure performing decryption

org.opensaml.xmlsec.encryption.support.DecryptionException: Failed to
decrypt EncryptedData

                at
org.opensaml.xmlsec.encryption.support.Decrypter.decryptDataToDOM(Decrypter.
java:550)

2017-03-30 17:13:42,917 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: DecryptNameIDFailed

2017-03-30 17:13:42,917 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] -
Error event DecryptNameIDFailed will be handled with response

 

Searching the forum I found that it could be related to Java Unlimited JCE
Policy.

After installation of JCE Policy, the problem maintains.

I would appreciate some help to find the problem.

 

Thanks,

 

Jose Ramalho

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170330/9a3399b0/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4584 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170330/9a3399b0/attachment-0001.p7s>