Jostle and Shibboleth

[Ullfig, Roberto Alfredo]

I see what looks like their SAML assertion coming in - can't I just copy that information into the local metadata I have for them?

2019-01-14 14:22:51,872 - DEBUG [PROTOCOL_MESSAGE:127] - [46CB8FE52644547C1658008BDF1F61D2] - [128.248.17.200] -
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest
    AssertionConsumerServiceURL="https://login-prod.jostle.us/saml/SSO/alias/newjostle.us"
    Destination="https://shibboleth.uic.edu/idp/profile/SAML2/POST/SSO"
    ForceAuthn="false" ID="a50ed2ibhe9d1i482e9e1810e6i09b0"
    IsPassive="false" IssueInstant="2019-01-14T20:22:51.750Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://jostle.us</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <ds:Reference URI="#a50ed2ibhe9d1i482e9e1810e6i09b0">
                <ds:Transforms>
                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                </ds:Transforms>
                <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <ds:DigestValue>Y6oMfWLo6SBusa2bxLkXP8ERho0=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>TRdjF7RumfZN1OpQPcCv8lGEZT9LqCQYoOmNycUMbBrSqOsfXibbNJ2AAq25UDgcXm4STYaZiasitaqkPi7Cy5uXl86oGe5kg2IpOBU0H0TBey2gXQYSFjcq5hIrGiH7PP1P3NaFS9ReJdP86fVM44NQyhlvxeDcVYMbaECFpaUVfDWxTdRDr4SHL8mo3fzHJc7kjBZYXR4BgPSS897i5COxI6paCQw9/0v12GBdCkgU8XVG3Tb7YwKMfFma0avvtqMZH4zLwpDN+nlh1AWi/VGvNT1jUbxH2AZYpyzfPUMYei5n8Q5HjVC8zC+CIH20cQMeVdJCW7OiW+J2jGSN2g==</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIIDlzCCAn+gAwIBAgIECbNOhTANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJDQTELMAkGA1UE
CBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjEbMBkGA1UEChMSSm9zdGxlIENvcnBvcmF0aW9uMRsw
GQYDVQQLExJKb3N0bGUgQ29ycG9yYXRpb24xEjAQBgNVBAMTCWpvc3RsZS51czAeFw0xNTAzMTEx
NzA5MjRaFw0yNTAzMDgxNzA5MjRaMHwxCzAJBgNVBAYTAkNBMQswCQYDVQQIEwJCQzESMBAGA1UE
BxMJVmFuY291dmVyMRswGQYDVQQKExJKb3N0bGUgQ29ycG9yYXRpb24xGzAZBgNVBAsTEkpvc3Rs
ZSBDb3Jwb3JhdGlvbjESMBAGA1UEAxMJam9zdGxlLnVzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEArfy3La92VclqzMdMtNq4bhnz36cahnFIkgqm21dp0SICcHy6DiQR3XiGiT7jNRsm
dpS7eBUz6ZMK5aBFVgBLvNg61331WdlEw6Mx97ZDO3VizxjZLeQUQbkTxPCu6bKBBUVug1rq4Yfp
3o8vBufsGP0RhOonsY4mgxOUD/qhubhvwjbXmO09oz0VSTNN+S4irYhOcV2kmlJgLEzUR7Uopxyg
LlT3/Z3+sKjoGLTXTxqP3jQ5Qw2EY6FlaMrqSXD+f9hruymlj+Ga6vd986XKL3WT1BwuwMlqijPd
rO7xcnnQ5YnCqP10OHBQd43LSP066WsF52tbmMsepVuxnMthAwIDAQABoyEwHzAdBgNVHQ4EFgQU
JtXdhEelyPpugiOZ/pP6yLtNtkIwDQYJKoZIhvcNAQELBQADggEBAFrZtlpCuM9upH8efncXRCVz
+sv0dL4Vu48GhuwcUqy5FCDedChkmFvrBUpcu1BRel92eBifVWtALEM2J5XrnrJlvrkxZ9tU2V+t
R6NOlmFg7bO245I0g5y9Bu8cHT1tupwy25E/AZRu3wQGLdvDgJaXeWICEx1wfl+l5Dx1KQ7mjlsL
2lRZIMbPd547bQmcnkOC7MJuMQS0QwpodNNGauQcNfxrRkkBmbZ9sqaPCyXn87In2FeqBfOfEnzy
CwdMpTafxUa1GFZA5f8v+MyCJt4osvGdoMMQqeLmaPlX/1EvvWM4NiYU3E0ObmNc3IYKoPyrLOfm
o9rsl1Kfb1ublsA=</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
</saml2p:AuthnRequest>

I did that and still get the same error.
---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Architecture and Development | ACCC
University of Illinois - Chicago

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Monday, January 14, 2019 2:41 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Jostle and Shibboleth

> I do have a cert from them. Any help would be appreciated.

They must be signing their requests (for no reason) and you have the wrong cert, whatever they claim notwithstanding.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net