Encryption configuration issue

[Mak, Steve]

Two reasons why you are seeing those errors:

1. IdP is not configured for encryption optional = true (You can solve this by flipping the property to true)
2. SP metadata does not list an encryption pub cert. (You can solve this by removing the "signing" label on the SP metadata

IdP resolves to "encryption is required" but SP can't do encryption, so it results in fail to operate with that SP.

On 7/29/20, 11:54, "users on behalf of Raymond DeCampo" <users-bounces at shibboleth.net on behalf of ray at decampo.org> wrote:

    Hello,

    I have an installation of Shibboleth IdP 4.0.1 and I have been able to
    verify that it works by using https://samltest.id/ as the SP.

    Furthermore I have an installation of Apache httpd with
    mod_auth_mellon (a SAML library for Apache) configured as an SP.  I am
    able to verify that this works against the IdP at
    https://samltest.id/.

    So far so good.  Now I want my SP and IdP to be integrated.  However,
    when I try this I get the following log messages from Shibboleth:

    2020-07-29 11:35:57,343 - 10.42.0.200 - WARN
    [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:234] -
    Validation failure: Failed to resolve both a data and a key encryption
    credential
    2020-07-29 11:35:57,345 - 10.42.0.200 - DEBUG
    [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:318]
    - Profile Action PopulateEncryptionParameters: Failed to resolve
    EncryptionParameters
    2020-07-29 11:35:57,345 - 10.42.0.200 - WARN
    [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:335]
    - Profile Action PopulateEncryptionParameters: Resolver returned no
    EncryptionParameters
    2020-07-29 11:35:57,351 - 10.42.0.200 - WARN
    [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event
    occurred while processing the request: InvalidSecurityConfiguration

    Now comes all the files you probably want or need.  I added the
    following in conf/metadata-providers.xml:

         <MetadataProvider id="RayDev"
             xsi:type="FilesystemMetadataProvider"
             metadataFile="%{idp.home}/metadata/https_localhost_rayDevEntityID.xml">
         </MetadataProvider>

    Here is the contents of metadata/https_localhost_rayDevEntityID.xml:

    <EntityDescriptor entityID="https://localhost/rayDevEntityID"
    xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="ht
    tp://www.w3.org/2000/09/xmldsig#">
      <SPSSODescriptor
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <KeyDescriptor use="signing">
          <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:X509Data>
              <ds:X509Certificate>MIICpDCCAYwCCQDKXGOSlGjvKTANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls
    b2NhbGhvc3QwHhcNMjAwNzI4MTgwNTU5WhcNMzAwNzI4MTgwNTU5WjAUMRIwEAYD
    VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDf
    cl7EEjxKo+ymMGKhQqnR9SBHdAriRcJf3Kl7prO8D1jjPtHjEopYhPyVntLVJWZs
    ayZG5Y2R9gf9FQzMH/c1pe1lE5aci3lSCV0yhhkN3CHdecmazGfCXzAslMHMIIHc
    y81MTRHTPE4LK6uXuEp1v9+X8ih4ep1Cb6Cp+5zPY8HqcfKxyEpdTr0I/L4L5azC
    CLsRQtTc9I9MDzRz2dVkJCpd9gTz1r35PZbP/AdJvmVvz6Ie9yEJ1IOoY1kzFWGD
    Yoat9KkVNkUDWkBuoghDgK1sRtrjbiwI6X1FJA/DpIc3H8he9u7gH5jPsLOptzTE
    gybgUMC/wwoqpFM8quYdAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAKeGvDpHoJK/
    k+tTmy5bB/qwPQr9LgTt8xjzgpE95iteiVcMEJ2+YZogna1380kny6srNpSk0419
    +Coyw3R1FgtS6v6NzlCTQoVlIJpsPILg5EDkacusieHOmtUD+4Bg4TEPZLde/YH/
    zPQFUpli5oE2kQkHeKXc3IjYKDE4HVaKsSyGnDA+KjZ4aHtNObs8tYLmWENJuDER
    yZRm9e1xqTISRxDV6RX1oxJxs36nuaKCA8gqnkxkn1kFneEjuAHk1f2n/mVhyFnj
    KpfI8aH2fu3uLR8cH5OFFhIPr//7wxn/yeWwwS1RjqvMbRbIFQaME3uq80SP+4Vk
    ab0lp8OoAXY=</ds:X509Certificate>
            </ds:X509Data>
          </ds:KeyInfo>
        </KeyDescriptor>
        <SingleLogoutService
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
    Location="https://localhost/mello
    n/logout"/>
        <AssertionConsumerService
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Location="https://localhost/mell
    on/postResponse" index="0"/>
      </SPSSODescriptor>
    </EntityDescriptor>

    For the IdP metadata, I used the sample which comes with Shibboleth,
    changing the expiration date and adding port 8443 to the URLs.  (This
    is the metadata I used successfully with samltest.id as the SP).

    Any feedback is appreciated.

    Thanks,
    Ray
    -- 
    For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net