Our SP metadata uploaded but testshib.org IdP reports can't find it

Fri Oct 26 10:07:47 EDT 2018

Kevin – thanks for the swift response!  I’ll give that a go.

*From:* users <users-bounces at shibboleth.net> *On Behalf Of *Kevin Foote
*Sent:* 26 October 2018 14:58
*To:* Shib Users <users at shibboleth.net>
*Subject:* Re: Our SP metadata uploaded but testshib.org IdP reports can't
find it

Stephen,

See posts from earlier this month.

(Last week even)

Use samltest.id

Testshib is largely unmaintained at this point.

- sent from mobile

On Oct 26, 2018, at 7:54 AM, Stephen Bayliss <stephen.bayliss at datum360.com>
wrote:

Hi there

I’ve seen this issue reported by others and then resolved by some action at
testshib.org
<http://secure-web.cisco.com/1zFi549JPAynQdji-_suiV2Q0Q0nG83YEMIIon7L7UMZw-lQbioRDdz1dkvAJV_s7n69tSR1KZlv5I1aifqZQX1Xxm6zEwvxKE1MX-7CZKBUlxXLoto6NHl5xzubFQg20_bJ__iBKIRomWMET00ABTGungJWC_TiOozhJ0EWqaHa_V3q5SFIMdQi6eLjGxP30R4T-Xg2N_FOWzPpgNcuAWMi1OE2gha7yw2pQ3ti0_67RBh2vcPSgdFFTSWLGz9xmhlxlVhXIG_6YEJHGLoK_cFhrA1JZIwUYQBh_KYWDKBWHyJOJj_E2Jy2_dZ0uWswCdlfwJgWzO6a1z1xAERyAUSoYLRbyjrofQ9vheK1ZBDilAGEWPoyBdWNm_LcZKUHf_IhTdFA2CrCP-WuUhp0BjzRveElzBjFFIPGQfI9ZZfZ6h6IjbHYQHHr9DhaGYcMy9fjWv3MipM03CIVDBxojWg/http%3A%2F%2Ftestshib.org>
so I’m hoping my issue is the same.

Some while ago I uploaded SP metadata, entityID
https://www.datum360.com/shibtest
<https://secure-web.cisco.com/1pULrggO8Wp5uelPd6yhyIzyvlm-IuddB6XFcJg01uTsokMW0DleKIRQ_l5CXJQ2NZwJrU-SfDFDQFrOxT38kPWDPZ4x1P24VzmYgYWi_kWy35tVK4jJWqwQ6Ufg4UA2XBgNgsJ-6TXK8aEtcGKfSwp_loGRETMW3F_OPNzbm7oK26WdTmCKR2aa7xIUpyV0txH1ohzkJV5u-Ofw5ByuIkIQTjVM1u_Bp7xDsbpIZI4rD806q8zA3oY2io-4IqnA8kLhhP76iiaXRAToi-ydQGjB9PTBtL87TrMmzSlJAYR5_G_tK-eaPm9-SNtNp6qWJq4Fj_glZnqmAFtuNZgTAWuFos_pAyZ6qp03rL-1gTBpi-2dKWeUu2kDyLekCYggYKy5Y49EigO9vCsKZ3tZmp-c7PE_XYV8e1z4Qiwi2MFO5OFQQOTsqX0pw7R5sFMrQt_7_Gg8A004vU488XekCPA/https%3A%2F%2Fwww.datum360.com%2Fshibtest>
and I was happily able to use that – and can still use that today (though
interestingly it isn’t listed at http://www.testshib.org/entities.html
<http://secure-web.cisco.com/1ottcJhk57A3uy582aY7V62O4GRp6acvpcRsFF00tO7yHlDeUHe-Vyo7HgQ7uRbXEx0TDhSLM4S4pc7i31svX_ttJinkkhibiYd7HFda7cdATJDT5GwWbiU_RP_YxuZl7ep10xY6ieEWhWOvxHaWXiOUyTpV_Uyn8s78RDR5XxZ0z2h4oC7vgRFq9vTvQRsifjEA66dRUEyUmsySL3_bRhPf3VaGxEHI22UqqoZuP5Gy2kjwfVOjdzrkwBMYzxom0TEcCtsfB-5CpIdgKwHtOrGlhvYvkQyNbVQMdMC_0CqApEVPWs7yjA1ty6ekNpFhu6cGvUGTQy2c_y8FNwUE2ul0lIwiJ94jnRUxGPw4iuFSp-J6uMssNEePDx7xdJ79yg4G5RensSiLC9LWfGKKUrNdUvn4YUZlc9-CB05i01CmN1S2drz9rQm7WaW46sslZWOA1yHD4MQeKipTe09Uv3A/http%3A%2F%2Fwww.testshib.org%2Fentities.html>
)

Today I uploaded a new SP metadata file, which is basically similar to the
previous one but with a different entityID of https://dev-sb.acl360.io
<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>
and a different callback URL – that is listed at
http://www.testshib.org/entities.html
<http://secure-web.cisco.com/1ottcJhk57A3uy582aY7V62O4GRp6acvpcRsFF00tO7yHlDeUHe-Vyo7HgQ7uRbXEx0TDhSLM4S4pc7i31svX_ttJinkkhibiYd7HFda7cdATJDT5GwWbiU_RP_YxuZl7ep10xY6ieEWhWOvxHaWXiOUyTpV_Uyn8s78RDR5XxZ0z2h4oC7vgRFq9vTvQRsifjEA66dRUEyUmsySL3_bRhPf3VaGxEHI22UqqoZuP5Gy2kjwfVOjdzrkwBMYzxom0TEcCtsfB-5CpIdgKwHtOrGlhvYvkQyNbVQMdMC_0CqApEVPWs7yjA1ty6ekNpFhu6cGvUGTQy2c_y8FNwUE2ul0lIwiJ94jnRUxGPw4iuFSp-J6uMssNEePDx7xdJ79yg4G5RensSiLC9LWfGKKUrNdUvn4YUZlc9-CB05i01CmN1S2drz9rQm7WaW46sslZWOA1yHD4MQeKipTe09Uv3A/http%3A%2F%2Fwww.testshib.org%2Fentities.html>
but when I try and use it I am getting the error

09:42:30.706 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128]
- Looking up relying party configuration for https://dev-sb.acl360.io
<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>

09:42:30.706 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134]
- No custom relying party configuration found for https://dev-sb.acl360.io
<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>,
looking up configuration based on metadata groups.

09:42:30.706 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157]
- No custom or group-based relying party configuration found for
https://dev-sb.acl360.io
<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>.
Using default relying party configuration.

09:42:30.707 - WARN
[org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] -
SPSSODescriptor role metadata for entityID 'https://dev-sb.acl360.io
<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>'
could not be resolved

09:42:30.707 - WARN
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195]
- Simple signature validation (with no request-derived credentials) failed

09:42:30.707 - WARN
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138]
- Validation of request simple signature failed for context issuer:
https://dev-sb.acl360.io
<https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io>

09:42:30.708 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406]
- Message did not meet security requirements

org.opensaml.ws.security.SecurityPolicyException: Validation of
request simple signature failed for context issuer

        at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.doEvaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:139)
~[opensaml-2.6.0.jar:na]

        at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.evaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:103)
~[opensaml-2.6.0.jar:na]

        at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
~[openws-1.5.0.jar:na]

        at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
~[openws-1.5.0.jar:na]

        at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
~[openws-1.5.0.jar:na]

        at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
~[opensaml-2.6.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386)
[shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211)
[shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189)
[shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90)
[shibboleth-identityprovider-2.4.0.jar:na]

        at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
[shibboleth-common-1.4.0.jar:na]

A recent similar report
http://shibboleth.1660669.n2.nabble.com/TestShib-metadata-issues-td7638474.html

Regards

Steve

-- 
For Consortium Member technical support, see
https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181026/aa035860/attachment.html>