Signature does not match in Artifact Resolution service.

Fri Jun 21 07:37:10 EDT 2019

I am trying to set up an IDP server using V3 and during Artifact Resolution
Service getting below error at SP side

I have added all the certificates provided and generated by IDP i.e.
idp-signing,idp-backchannel,idp-encryption in my cacerts of java.

How do I verify the signature received in SAML response or Is there any way
to prevent the signing of assertion in IDP?
:- 

java.security.SignatureException: Signature does not match.
        sun.security.x509.X509CertImpl.verify(X509CertImpl.java:449)
sun.security.provider.certpath.BasicChecker.verifySignature(BasicChecker.java:166)
sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:147)
sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)
sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:219)
sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140)
sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79)
java.security.cert.CertPathValidator.validate(CertPathValidator.java:292)
sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:347)
sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:260)
        sun.security.validator.Validator.validate(Validator.java:260)
sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
        sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026)
      sun.security.ssl.Handshaker.process_record(Handshaker.java:961)
   sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
net.shibboleth.utilities.java.support.httpclient.TLSSocketFactory.createLayeredSocket(TLSSocketFactory.java:324)
net.shibboleth.utilities.java.support.httpclient.TLSSocketFactory.connectSocket(TLSSocketFactory.java:279)
org.apache.http.impl.conn.HttpClientConnectionOperator.connect(HttpClientConnectionOperator.java:125)
org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:319)
org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:363)
org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:219)
org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:195)
  org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:86)
org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:108)
org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:57)
org.opensaml.soap.client.http.AbstractPipelineHttpSOAPClient.send(AbstractPipelineHttpSOAPClient.java:216)
com.ericsson.sme.security.SAML11AuthenticationFilter.sendAndReceiveArtifactResolve(SAML11AuthenticationFilter.java:258)
com.ericsson.sme.security.SAML11AuthenticationFilter.attemptAuthentication(SAML11AuthenticationFilter.java:138)
org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263

Here is the response sent by IDP to SP:- 

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response
    Destination="http://x.x.x.x:8080/app/saml2/login"
    ID="_fcc50c982fb9102c64e7af6c5dabfbe2"
    InResponseTo="_44553112b08ef875e89730a08fdb6470"
    IssueInstant="2019-06-21T07:16:20.528Z" Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://x.x.x.x/idp</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            <ds:SignatureMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
            <ds:Reference URI="#_fcc50c982fb9102c64e7af6c5dabfbe2">
                <ds:Transforms>
                    <ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                    <ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                </ds:Transforms>
                <ds:DigestMethod
Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>

<ds:DigestValue>xSnTMweaTUBmCR2CrhFl4qHpFaiRMqYV9RaSxISrAEdGvGo8yYLRvLUbAa4jNNJRyMQH5A9hrTofK74TCAOQ3A==</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>

<ds:SignatureValue>Y+melFDjevoddf07XmQ4E4PVaiO9vgx9tBc7SxHy/IzQsufXDBe40eP2Mkgx318yKXEwjFVPjWS/spkK+nbxU4SCweRhmIeTXDvNjmvFtCCETl5ic++OmfPZEvSbZMN7daMZ9Pu3LR5/6FsdUTVgzfU8G0bIUPnrMokgfSmpQwMwK4ibRA64D9m5Y96euP3fG49F1i1l088rhBPRzjx8ZnQVLZsc1Us9/mQkr4VfFqOV8sRKKWht57VrexgFdGWERcW+ZG78mg0ulVZaPhEUuBo2Dbc8Yt/R7JscjM5l7/qWyYUXo999jDUqqHlzQZLqc5dntyNKp54Ab2CnKA/temmS/Ms9uAJoZCZ9b+JHGQg+9GBPbWTbXKCdm/3JXK/NX3TJ0vz/lAlWj/T11u5Kb9bqe1N79P9BU5f1d/Yc804KAFWs38nh7L+CW6fmTsLCd3DqSbzWpbBIq0zX5nUA+/YkL4oaHrmgKP8ksOxPLwFY6d5ByCJtDU796V6PQxdi</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>

<ds:X509Certificate>MIIEIjCCAoqgAwIBAgIUVIR7iqXRPpuqxkAxtnHa+V3z564wDQYJKoZIhvcNAQELBQAwHjEcMBoG
A1UEAwwTaWRwc2VydmVyLmFwLmJtLm5ldDAeFw0xOTA2MjEwNDMzMTlaFw0zOTA2MjEwNDMzMTla
MB4xHDAaBgNVBAMME2lkcHNlcnZlci5hcC5ibS5uZXQwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAw
ggGKAoIBgQCI1tyro/CeP1n8nUda7I/wk/QHnQ4xKPeYsVmrgFhBIAMYOxKGunTKZ3qasEQUBz0c
6CldNBRTAR7aPfz9f7O+XC3YWP3MiIf/sWFTEL6cINr8ZsG5FxoHmyBOGI7p7Wm/Tq/gjfUEed8Z
R3yggceUt/G3gOMSdyJpuzRlCoAHaMC1UA/FZGPuGZ6rGHPRyZIMMEMKgL+PayrJTAv5UrCZOFml
bJcFaizs87XuxhXGid6ljpKw8pXtfPoStCn3QGE/obZl1suZvU1xA4UroeAyV4m44EI2PQQn2knU
dcq6BOz93lg8qUKpEuqfzkxrD+T2w6RI/6mW7nVmMYPRYH/F3i6rwioj69y0e1RjFQO4xekb9jSa
JjLKx89MlNOLREJ3Td366UIu1mv1ge2hDIur9oX1siHSi53coC0QvUrpLOk9fbex8kQq3wDMeKv6
6ELhaIh01jcfc5HCBaa0fw3l2YlA/UXyTN0rboC2jrOHdpLD2p66eLQGdlnv82KLivMCAwEAAaNY
MFYwHQYDVR0OBBYEFLORV5cw0xuuiXBYmMuUD2tr+k3WMDUGA1UdEQQuMCyCE2lkcHNlcnZlci5h
cC5ibS5uZXSGFWh0dHBzOi8vYXAuYm0ubmV0L2lkcDANBgkqhkiG9w0BAQsFAAOCAYEAB/pu0KYB
b078UEsNR50OGHdF6+XR2jszPF3Hno4KQLXfA8wOMh7g2yvCxQVOZBuUFFLfXynJCRAN3I4yQm8n
3pRBM1wpK2p4IcIzzs3HNP8rCTZkPpy1n7M/eBf//uI4CVklRUrDR4PVljVP3INeU1gKWdD8ycud
O2RyZPHZmGqqxdcy6gxKo08q1CmEYTmMk5gw1EER+poyGKJDaQdb7G3C/pjJw1V10gsXsAWqrUBZ
6A29YEUTi6joYs6kADCaeCcYgrg1Ui8L419z039dA4WCsiLlR8j7LF+QKBO0AswYxMNYE+PZanQ5
kYfNuNdpq8d+1lo8wxZT8zEVgvkzqdlFWZDNctCw1z+v8KYnb7Y7HhL8sGJX+enWJvdtQNId8JlU
atrto2H5IvUcY0TmkpJEgK+jg+5hBc/MB6pzmHYIBq9gnsieJarlHVvS/zesbI8clHnTp4JA2Pat
OP+aLGxWAP2dYHy/CS6ZGAux2Gb8hcTgqN+cVJ/DZ3VWS97I</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:Status>
        <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion ID="_315e5bbb1514fa511c8e02db44fb9769"
        IssueInstant="2019-06-21T07:16:20.528Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:Issuer>https://x.x.x.x/idp</saml2:Issuer>
        <saml2:Subject>
            <saml2:NameID
                Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                NameQualifier="https://x.x.x.x/idp"
SPNameQualifier="TestSP">AAdzZWNyZXQxXRC05tkk9QhxTR6kZgVRI6TUrRxJikyd0yrq+UbHWhivzXnxM3HnDIsz8hZ7P9WCA47lbgDZXVmGhcxCyMhEqQEJkEZPj1Gb5zASew==</saml2:NameID>
            <saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="10.91.66.55"
                    InResponseTo="_44553112b08ef875e89730a08fdb6470"
                    NotOnOrAfter="2019-06-21T07:21:20.546Z"
Recipient="http://x.x.x.x:8080/app/saml2/login"/>
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2019-06-21T07:16:20.528Z"
NotOnOrAfter="2019-06-21T07:21:20.528Z">
            <saml2:AudienceRestriction>
                <saml2:Audience>TestSP</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2019-06-21T07:16:19.389Z"
SessionIndex="_bfed76f340111782af685eab86a5a8be">
            <saml2:SubjectLocality Address="x.x.x.x"/>
            <saml2:AuthnContext>

<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
    </saml2:Assertion>
</saml2p:Response>

--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html