Unsolicited SSO with AuthnRequestsSigned="true" SP metadata

[Santu Ghosh]

Hi All,

I am facing a new problem when I am going to integrate another SP with my
IDP for Unsolicited SSO.

 2017-11-28 16:20:50,040 - ERROR
[org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler:75]
- SPSSODescriptor for entity ID '
https://shibboleth-sp.xxxxxx.com/shibboleth-sp' indicates AuthnRequests
must be signed, but inbound message was not signed
2017-11-28 16:20:50,041 - WARN
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:202] -
Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: Inbound
AuthnRequest was required to be signed but was not
at
org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler.doInvoke(SAML2AuthnRequestsSignedSecurityHandler.java:77)
2017-11-28 16:20:50,051 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: MessageAuthenticationError


When I check my SP metadata, I found that *AuthnRequestsSigned="true" *in
my SP metadata.

<ds:Signature>
     <ds:SignedInfo>
         <ds:CanonicalizationMethod Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#"/>
              <ds:SignatureMethod Algorithm="
http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
              <ds:Reference
URI="#https___shibboleth-sp-dev.betterknow.com_shibboleth-sp"><ds:Transforms><ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1
"/><ds:DigestValue>OreU/14CANZdlXlhfpOdBwvjv3E=</ds:DigestValue></ds:Reference></ds:SignedInfo>
<ds:SignatureValue>

</ds:SignatureValue>
     </ds:X509Certificate>
    </ds:X509Data>
  </ds:KeyInfo>
</ds:Signature>

<md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">


But in my IDP metadata, there is no AuthnRequestsSigned attribute and there
is no signature node.

Can anyone help me, what changes I have to do in my IDP side so that I can
proceeded with my SP metadata (with WantAssertionsSigned="true") for
Unsolicited SSO.


-- 
Snahasish
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171128/f91a7e27/attachment.html>