IDP 3 Logout error

[Brent Putman]

On 3/30/17 12:27 PM, José Ramalho wrote:
>
> 2017-03-30 17:13:42,917 - WARN
> [org.opensaml.saml.saml2.profile.impl.DecryptNameIDs:99] - Profile
> Action DecryptNameIDs: Failure performing decryption
>
> org.opensaml.xmlsec.encryption.support.DecryptionException: Failed to
> decrypt EncryptedData
>
>

Looks like your logout request is sending an encrypted NameID.  It
seems it can't resolve the proper decryption key.

Offhand my first suggestion is to check the config you have in your
conf/credentials.xml.  Specifically the beans
'shibboleth.EncryptionCredentials' and
'shibboleth.DefaultEncryptionCredentials'.  If you need a reference to
an unmodified copy, see:

https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/conf/credentials.xml;hb=refs/heads/master

Most importantly, make sure that whatever key(s) you are publishing in
metadata and used by SPs to encrypt to you are included in those beans
(lists of credentials).  For example, if you have added additional keys
to your published metadata that SPs have about your IdP, then those
additional keys need to be added there as well.

A bit more info here: 
https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170330/3da0231f/attachment.html>