New SP Setup

[Tom Scavo]

On Wed, Jan 3, 2018 at 2:47 PM, Myers, Kevin R (Mutual Funds
Technology Svcs) <kevin.myers at hartfordfunds.com> wrote:
>
> Something else I just thought of....We had to alter the IDP metadata because it was failing validation upon loading. The ContactPerson element contained a null EmailAddress, so we removed it.  The IDP did not want to remove, or populate with a value. Could this at all be contributing to the problem?

Those elements are non-operational so it is unlikely they are
involved. Besides, the error message you posted previously clearly
indicated a metadata problem, so I would focus on that.

Tom

> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
> Sent: Saturday, December 30, 2017 12:50 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: New SP Setup
>
> On Thu, Dec 28, 2017 at 1:47 PM, Myers, Kevin R (Mutual Funds Technology Svcs) <kevin.myers at hartfordfunds.com> wrote:
>>
>> Now the response is failing signature validation.
>>
>> The second message states “keys didn’t match”. Is this just comparing
>> the public cert in the metadata to the one in the response.
>
> The cert embedded in the signature is just a hint. The consumer may use it to cherry-pick one of multiple signing certs in IdP metadata.
> Alternatively, the consumer may simply cycle through the signing certs in IdP metadata. Usually there is just one signing cert in IdP metadata, so the hint isn't a huge help.
>
>> They look to be the same to us.
>
> You don't have to guess. You can compare the cert content using a tool like openssl.
>
>> Can someone help point us to something specific that may be wrong in
>> our config (or theirs)?
>
> If the cert in the response matches the cert in IdP metadata, and verification fails, then the SP is not consuming the metadata you think it is.
>
> Tom
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> ************************************************************
> This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information.  If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited.  If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
> ************************************************************
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net