Error encountered when implementing SP SAMLRequest signing="conditional"

[Pruvost, Christian (ELS-OXF)]

Hi Peter,


We do have the following in our shibconfig.
<RelyingParty Name="**IDP_ENTITY_ID_REPLACED**" keyName="verisigncreds"/>
...

And further down in the config a Path to the certificate to be used
<CredentialResolver type="Chaining">
<CredentialResolver type="File">
            <Key format="PEM">
               <Name>verisigncreds</Name>
               <Path>/l-n/app/scidir/etc/ssl/ssl.verisign.key</Path>
            </Key>
            <Certificate format="PEM">
               <Path>/l-n/app/scidir/etc/ssl/ssl.verisign.20220725.crt</Path>
               <CAPath>/l-n/app/scidir/etc/ssl/ssl.verisign.intermediate.crt</CAPath>
            </Certificate>
 </CredentialResolver>
...

But I don't think there is any kind of override here.

Cheers,
Christian.
________________________________________________________
Christian Pruvost                                             Eng, PhD, MBA
Technical Product Manager - Identity & Platform Strategy
Research Products - ELSEVIER Ltd
The Boulevard, Langford Lane, Kidlington, OXFORD OX5 1GB, UK
T: c.pruvost at elsevier.com
c: +44 (0) 1865 843292
ORCID ID: 0000-0002-8863-9153

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober
Sent: 08 October 2018 15:14
To: users at shibboleth.net
Subject: Re: Error encountered when implementing SP SAMLRequest signing="conditional"

*** External email: use caution ***



* Peter Schober <peter.schober at univie.ac.at> [2018-10-08 13:27]:
> * Pruvost, Christian (ELS-OXF) <c.pruvost at elsevier.com> [2018-10-08 12:27]:
> > We are running a Service Provider with Shibboleth 2.6.0
> [...]
> > 22:58:38.879(08/29) ERROR XMLTooling.ParserPool : error on line 25,
> > column 273, message: value 'conditional' not in enumeration
>
> Since the docs mention this in a "Version 2.6+" section:
>   "The newly-defined "conditional" setting"...
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSigningEn
> cryption are you sure the machine this error comes from is running
> Shib 2.6 or higher? Try "shibd -v" on that same system. Also, the
> version string should be logged somewhere, IIRC.

I think the other indicator would be that even if the signing setting was absent the SP should sign its requests to an IDP that declares WantAuthnRequestsSigned="true" in metadata (as you say is the case), at least with 2.6, per the above docs.
Always assuming there's no RelyingParty override in effect for the IDP in question.

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

________________________________

Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.