SP datasealer and XSECCRYPTOEXCEPTION

[Wessel, Keith]

Hi, all,

I looked around in the archives and Jira for this but couldn't find anything. We've split shibd and mod_shib into two different containers communicating over the network in a closed subnet. I don't think that's relevant, but I'm not sure, and I figured it's worth sharing.

Occasionally, our shibd container logs:

terminate called after throwing an instance of 'XSECCryptoException'

This seems to happen during key resolution. The following appears just before the error message in the log:

2018-10-10 14:45:35 DEBUG XMLTooling.DataSealer [4] [default]: decrypting data with key (2)

...and then the exception. The browser displays the Shib error page with the same exception.

I'm hoping for thoughts on further troubleshooting the source of this. Could it be that our data sealer key file doesn't contain the latest key from the other node that generated the encrypted cookie? I think they're in sync, but it's the only explanation I've come up with. Would failure to decrypt with any keys result in this exception?

If not, other thoughts on finding the cause of this?

I should note that it only happens occasionally.

Thanks,
Keith