Our SP metadata uploaded but testshib.org IdP reports can't find it

[Stephen Bayliss]

Hi there



I’ve seen this issue reported by others and then resolved by some action at
testshib.org so I’m hoping my issue is the same.



Some while ago I uploaded SP metadata, entityID
https://www.datum360.com/shibtest and I was happily able to use that – and
can still use that today (though interestingly it isn’t listed at
http://www.testshib.org/entities.html )



Today I uploaded a new SP metadata file, which is basically similar to the
previous one but with a different entityID of https://dev-sb.acl360.io and
a different callback URL – that is listed at
http://www.testshib.org/entities.html but when I try and use it I am
getting the error



09:42:30.706 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128]
- Looking up relying party configuration for https://dev-sb.acl360.io

09:42:30.706 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134]
- No custom relying party configuration found for https://dev-sb.acl360.io,
looking up configuration based on metadata groups.

09:42:30.706 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157]
- No custom or group-based relying party configuration found for
https://dev-sb.acl360.io. Using default relying party configuration.

09:42:30.707 - WARN
[org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] -
SPSSODescriptor role metadata for entityID 'https://dev-sb.acl360.io' could
not be resolved

09:42:30.707 - WARN
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195]
- Simple signature validation (with no request-derived credentials) failed

09:42:30.707 - WARN
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138]
- Validation of request simple signature failed for context issuer:
https://dev-sb.acl360.io

09:42:30.708 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406]
- Message did not meet security requirements

org.opensaml.ws.security.SecurityPolicyException: Validation of
request simple signature failed for context issuer

        at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.doEvaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:139)
~[opensaml-2.6.0.jar:na]

        at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.evaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:103)
~[opensaml-2.6.0.jar:na]

        at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
~[openws-1.5.0.jar:na]

        at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
~[openws-1.5.0.jar:na]

        at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
~[openws-1.5.0.jar:na]

        at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
~[opensaml-2.6.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386)
[shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211)
[shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189)
[shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90)
[shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
[shibboleth-common-1.4.0.jar:na]





A recent similar report
http://shibboleth.1660669.n2.nabble.com/TestShib-metadata-issues-td7638474.html







Regards

Steve
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181026/e954b103/attachment.html>