SP unable to decrypt assertion

[Mohamed Lrhazi]

Hello,

An SP asked us to update their metadata and add new one for when they will
switch dns names...
I made the updates in the metadata files and correspoding entries in
metadata-providers.xml, then added a line in the attribute-filter as
follows:

<AttributeFilterPolicy id="cua.cascadeserver.com">
    <PolicyRequirementRule xsi:type="OR">
        <Rule xsi:type="Requester"
value="https://cua.cascadeserver.com/shibboleth" />
        <Rule xsi:type="Requester"
value="https://cua.cascadecms.com/shibboleth" />
        <Rule xsi:type="Requester"
value="https://cua-test.cascadeserver.com/shibboleth" />
    </PolicyRequirementRule>
    <AttributeRule attributeID="eduPersonPrincipalName">
<PermitValueRule xsi:type="ANY" /> </AttributeRule>
</AttributeFilterPolicy>


I added the line for the future DNS name: cascadecms.com

With this config, the SP is unable to decrypt the messages... but if I
remove the cascadecms.com line, they can!
It's as if when that line is present we use the cascadecms.com metadata
file and the corresponding certificate, even though the entity-id is for
cascadeserver.com ?

How can I debug this further?

Thanks a lot,
Mohamed.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180116/a08021cc/attachment.html>