Error: Message was signed, but signature could not be verified.

[Goldberg, Arthur P]

Hello Shibboleth users

You may recall that I’m configuring a Shibboleth SO to authenticate via an Azure IdP.

Shibbolith has the browser issue this request:
https://login.microsoftonline.com/77e89d61-570f-43b0-b9e4-634f462e34b8/saml2?SAMLRequest=fVLJbsIwE ..., which generates the response

    opensaml::FatalProfileException
    The system encountered an error at Mon May 24 18:16:24 2021

    To report this problem, please contact the site administrator at Arthur.p.Goldberg at mssm.edu.

    Please include the following message in any email:

    opensaml::FatalProfileException at (https://leaf.mssm.edu/Shibboleth.sso/SAML2/POST)

    Message was signed, but signature could not be verified.

The important Shibboleth configuration files for this issue are shibboleth2.xml, leaf.mssm.edu-metadata.xml -- a metadata file generated by executing "curl -o leaf.mssm.edu-metadata.xml -k https://leaf.mssm.edu/Shibboleth.sso/Metadata" against the webapp, and AzureIdPMetadata.xml -- a metadata file that describes the Azure IdP metadata which was provided by an Azure admin. These three files are attached, with some non-essential data removed to make them easier to read and this email small enough.

Certain configuration choices are not clear to me:
  In leaf.mssm.edu-metadata.xml, should the KeyName and the X509 CN which are "*.mssm.edu" because I'm using a wildcard certificate be changed to leaf.mssm.edu?
  Does AzureIdPMetadata.xml have the proper format for an XML MetadataProvider in shibboleth2.xml?

Do you see problems with these configuration files?

Thanks
Arthur


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210524/df3b2f50/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: shibboleth2.xml
Type: application/xml
Size: 3515 bytes
Desc: shibboleth2.xml
URL: <http://shibboleth.net/pipermail/users/attachments/20210524/df3b2f50/attachment.wsdl>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: AzureIdPMetadata.xml
Type: application/xml
Size: 11718 bytes
Desc: AzureIdPMetadata.xml
URL: <http://shibboleth.net/pipermail/users/attachments/20210524/df3b2f50/attachment-0001.wsdl>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: leaf.mssm.edu-metadata.xml
Type: application/xml
Size: 5083 bytes
Desc: leaf.mssm.edu-metadata.xml
URL: <http://shibboleth.net/pipermail/users/attachments/20210524/df3b2f50/attachment-0002.wsdl>