Error encountered when implementing SP SAMLRequest signing="conditional"

[Nate Klingenstein]

Christian,

 You might consider asking the IdP to add wantAuthnRequestsSigned to their metadata directly.  Their provider's metadata needs to reflect their provider's requirements, and it sounds like in this case it doesn't.  This is for 2.6.0:
 The caveat with SAML 2.0 authentication is that omitting the setting defaults to a softer false that really means "don't sign unless the IdP's metadata includes the WantAuthnRequestsSigned flag and the SP can do so". 
 https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSigningEncryption
 In case Peter's hunch is right, I believe the same default behavior existed in 2.5.x, but I may be recalling wrong.
 Take care,
Nate.
 -----Original message-----
From: Pruvost, Christian (ELS-OXF)
Sent: Monday, October 8 2018, 4:27 am
To: users at shibboleth.net
Subject: Error encountered when implementing SP SAMLRequest signing="conditional"

Dear User community,

 
We are running a Service Provider with Shibboleth 2.6.0 (I know that we should be upgrading to 3.x, but that is not the topic – we are not doing this right now)

 
We have a need to turn on Conditionally for a specific IDP the generation of a signature with the SAML Request (i.e. populating ‘SigAlg=…’ and ‘Signature=…’ together with the SAMLRequest sent to the IDP.

 
Our operations team is experiencing the following issue when:

1.	Changing signing=… value from signing="false” to signing="conditional"

<ApplicationDefaults attributePrefix="ELS_" connectTimeout="10" encryption="conditional" entityID="https://sdauth.sciencedirect.com/" homeURL="https://auth.elsevier.com/ShibAuth/deliverInstCredentials" id="default" policyId="default" signing="conditional" timeout="20">

 
1.	On restart to pick up the new configuration we get this error:

[root at ip-10-169-71-47 cloud]# /l-n/app/scidir/bin/start_shib_shar

Using

usage: /l-n/app/scidir/etc/scripts/rollLog.sh <days of logs> <logdir> <log1> [log2] ... [logN]

Executing /l-n/app/scidir/bin/shibd -c /l-n/app/scidir/etc/shib/shibboleth_cloud.xml -d /l-n/app/scidir/etc/shib

configuration is invalid, check console for specific problems

 
1.	Logs showing:

22:58:38.879(08/29) ERROR XMLTooling.ParserPool : error on line 25, column 273, message: value 'conditional' not in enumeration

22:58:38.879(08/29) ERROR XMLTooling.ParserPool : error on line 25, column 273, message: value 'conditional' not in enumeration

 
This is really odd. We are able to turn on the digital signature for all or noone, but not conditionally when the IDP Requests it ?!??

 
Has anyone encountered this issue, or who would be able to help with this?

 
Thank you,

Christian.
________________________________________________________
Christian Pruvost                                             
*: c.pruvost at elsevier.com
 
 
--------------------------------
Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.


-- 

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181008/5226cef1/attachment.html>