New SP Setup

[Myers, Kevin R (Mutual Funds Technology Svcs)]

Thanks Tom. I'm playing a bit of man in the middle here, as our sp is managed by a third-party.

I think you may be right about the SP not consuming the correct metadata, as when I hit "/Status" I see two metadata files loaded. Trying to get to the bottom of this.

The idp metadata we should be using (the one I have), does have 2 signing certs under IDPSSODescriptor, and the SAMLResponse does match one of them.

Something else I just thought of....We had to alter the IDP metadata because it was failing validation upon loading. The ContactPerson element contained a null EmailAddress, so we removed it.  The IDP did not want to remove, or populate with a value. Could this at all be contributing to the problem?

Thanks a lot for your help.
Kevin..


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: Saturday, December 30, 2017 12:50 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: New SP Setup

On Thu, Dec 28, 2017 at 1:47 PM, Myers, Kevin R (Mutual Funds Technology Svcs) <kevin.myers at hartfordfunds.com> wrote:
>
> Now the response is failing signature validation.
>
> The second message states “keys didn’t match”. Is this just comparing 
> the public cert in the metadata to the one in the response.

The cert embedded in the signature is just a hint. The consumer may use it to cherry-pick one of multiple signing certs in IdP metadata.
Alternatively, the consumer may simply cycle through the signing certs in IdP metadata. Usually there is just one signing cert in IdP metadata, so the hint isn't a huge help.

> They look to be the same to us.

You don't have to guess. You can compare the cert content using a tool like openssl.

> Can someone help point us to something specific that may be wrong in 
> our config (or theirs)?

If the cert in the response matches the cert in IdP metadata, and verification fails, then the SP is not consuming the metadata you think it is.

Tom
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information.  If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited.  If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
************************************************************