Our SP metadata uploaded but testshib.org IdP reports can't find it

[Kevin Foote]

Stephen,

See posts from earlier this month.
(Last week even)

Use samltest.id<http://samltest.id>

Testshib is largely unmaintained at this point.

- sent from mobile

On Oct 26, 2018, at 7:54 AM, Stephen Bayliss <stephen.bayliss at datum360.com<mailto:stephen.bayliss at datum360.com>> wrote:

Hi there

I’ve seen this issue reported by others and then resolved by some action at testshib.org<http://secure-web.cisco.com/1zFi549JPAynQdji-_suiV2Q0Q0nG83YEMIIon7L7UMZw-lQbioRDdz1dkvAJV_s7n69tSR1KZlv5I1aifqZQX1Xxm6zEwvxKE1MX-7CZKBUlxXLoto6NHl5xzubFQg20_bJ__iBKIRomWMET00ABTGungJWC_TiOozhJ0EWqaHa_V3q5SFIMdQi6eLjGxP30R4T-Xg2N_FOWzPpgNcuAWMi1OE2gha7yw2pQ3ti0_67RBh2vcPSgdFFTSWLGz9xmhlxlVhXIG_6YEJHGLoK_cFhrA1JZIwUYQBh_KYWDKBWHyJOJj_E2Jy2_dZ0uWswCdlfwJgWzO6a1z1xAERyAUSoYLRbyjrofQ9vheK1ZBDilAGEWPoyBdWNm_LcZKUHf_IhTdFA2CrCP-WuUhp0BjzRveElzBjFFIPGQfI9ZZfZ6h6IjbHYQHHr9DhaGYcMy9fjWv3MipM03CIVDBxojWg/http%3A%2F%2Ftestshib.org> so I’m hoping my issue is the same.

Some while ago I uploaded SP metadata, entityID https://www.datum360.com/shibtest<https://secure-web.cisco.com/1pULrggO8Wp5uelPd6yhyIzyvlm-IuddB6XFcJg01uTsokMW0DleKIRQ_l5CXJQ2NZwJrU-SfDFDQFrOxT38kPWDPZ4x1P24VzmYgYWi_kWy35tVK4jJWqwQ6Ufg4UA2XBgNgsJ-6TXK8aEtcGKfSwp_loGRETMW3F_OPNzbm7oK26WdTmCKR2aa7xIUpyV0txH1ohzkJV5u-Ofw5ByuIkIQTjVM1u_Bp7xDsbpIZI4rD806q8zA3oY2io-4IqnA8kLhhP76iiaXRAToi-ydQGjB9PTBtL87TrMmzSlJAYR5_G_tK-eaPm9-SNtNp6qWJq4Fj_glZnqmAFtuNZgTAWuFos_pAyZ6qp03rL-1gTBpi-2dKWeUu2kDyLekCYggYKy5Y49EigO9vCsKZ3tZmp-c7PE_XYV8e1z4Qiwi2MFO5OFQQOTsqX0pw7R5sFMrQt_7_Gg8A004vU488XekCPA/https%3A%2F%2Fwww.datum360.com%2Fshibtest> and I was happily able to use that – and can still use that today (though interestingly it isn’t listed at http://www.testshib.org/entities.html<http://secure-web.cisco.com/1ottcJhk57A3uy582aY7V62O4GRp6acvpcRsFF00tO7yHlDeUHe-Vyo7HgQ7uRbXEx0TDhSLM4S4pc7i31svX_ttJinkkhibiYd7HFda7cdATJDT5GwWbiU_RP_YxuZl7ep10xY6ieEWhWOvxHaWXiOUyTpV_Uyn8s78RDR5XxZ0z2h4oC7vgRFq9vTvQRsifjEA66dRUEyUmsySL3_bRhPf3VaGxEHI22UqqoZuP5Gy2kjwfVOjdzrkwBMYzxom0TEcCtsfB-5CpIdgKwHtOrGlhvYvkQyNbVQMdMC_0CqApEVPWs7yjA1ty6ekNpFhu6cGvUGTQy2c_y8FNwUE2ul0lIwiJ94jnRUxGPw4iuFSp-J6uMssNEePDx7xdJ79yg4G5RensSiLC9LWfGKKUrNdUvn4YUZlc9-CB05i01CmN1S2drz9rQm7WaW46sslZWOA1yHD4MQeKipTe09Uv3A/http%3A%2F%2Fwww.testshib.org%2Fentities.html> )

Today I uploaded a new SP metadata file, which is basically similar to the previous one but with a different entityID of https://dev-sb.acl360.io<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io> and a different callback URL – that is listed at http://www.testshib.org/entities.html<http://secure-web.cisco.com/1ottcJhk57A3uy582aY7V62O4GRp6acvpcRsFF00tO7yHlDeUHe-Vyo7HgQ7uRbXEx0TDhSLM4S4pc7i31svX_ttJinkkhibiYd7HFda7cdATJDT5GwWbiU_RP_YxuZl7ep10xY6ieEWhWOvxHaWXiOUyTpV_Uyn8s78RDR5XxZ0z2h4oC7vgRFq9vTvQRsifjEA66dRUEyUmsySL3_bRhPf3VaGxEHI22UqqoZuP5Gy2kjwfVOjdzrkwBMYzxom0TEcCtsfB-5CpIdgKwHtOrGlhvYvkQyNbVQMdMC_0CqApEVPWs7yjA1ty6ekNpFhu6cGvUGTQy2c_y8FNwUE2ul0lIwiJ94jnRUxGPw4iuFSp-J6uMssNEePDx7xdJ79yg4G5RensSiLC9LWfGKKUrNdUvn4YUZlc9-CB05i01CmN1S2drz9rQm7WaW46sslZWOA1yHD4MQeKipTe09Uv3A/http%3A%2F%2Fwww.testshib.org%2Fentities.html> but when I try and use it I am getting the error

09:42:30.706 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for https://dev-sb.acl360.io<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>
09:42:30.706 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for https://dev-sb.acl360.io<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>, looking up configuration based on metadata groups.
09:42:30.706 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for https://dev-sb.acl360.io<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>. Using default relying party configuration.
09:42:30.707 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID 'https://dev-sb.acl360.io<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>' could not be resolved
09:42:30.707 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195] - Simple signature validation (with no request-derived credentials) failed
09:42:30.707 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer: https://dev-sb.acl360.io<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>
09:42:30.708 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements

org.opensaml.ws.security.SecurityPolicyException: Validation of request simple signature failed for context issuer

        at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.doEvaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:139) ~[opensaml-2.6.0.jar:na]

        at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.evaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:103) ~[opensaml-2.6.0.jar:na]

        at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51) ~[openws-1.5.0.jar:na]

        at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132) ~[openws-1.5.0.jar:na]

        at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83) ~[openws-1.5.0.jar:na]

        at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) ~[opensaml-2.6.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]


A recent similar report http://shibboleth.1660669.n2.nabble.com/TestShib-metadata-issues-td7638474.html



Regards
Steve
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181026/5bf19d8a/attachment.html>