SLO Logout Propagation error - Resolver returned no EncryptionParameters

[Lipscomb, Gary]

Hi Scott,

I've tried the below extension entries[2] in the metadata and I am still see the error[1].
The vendor is looking at adding encryption to the metadata, no-one else had asked about it, and also the SAML logout as well.

Regards
Gary

[1] error in idp-process.log
2022-02-08 08:22:33,857 - 10.9.245.71 - WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:243] - Validation failure: Failed to resolve an encryption key
2022-02-08 08:22:33,858 - 10.9.245.71 - WARN [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:335] - Profile Action PopulateEncryptionParameters: Resolver returned no EncryptionParameters
2022-02-08 08:22:33,859 - 10.9.245.71 - INFO [Shibboleth-Audit.LogoutPropagation:283] - 10.9.245.71|2022-02-07T21:22:33.854684Z|2022-02-07T21:22:33.859298Z||https://www.mentimeter.com/auth/saml/metadata||||||||||||||||Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0


[2] metadata

[2a]
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/saml2/logout/encryptionOptional" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue xsi:type="xsd:boolean">true</saml:AttributeValue>
        </saml:Attribute> 

[2b]
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/saml2/logout/encryptAssertions"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue xsi:type="xsd:boolean">false</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/saml2/logout/encryptAttributes"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue xsi:type="xsd:boolean">false</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/saml2/logout/encryptNameIDs"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue xsi:type="xsd:boolean">false</saml:AttributeValue>
        </saml:Attribute> 

[2c]
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/encryptAssertions"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue xsi:type="xsd:boolean">false</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/encryptAttributes"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue xsi:type="xsd:boolean">false</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/encryptNameIDs"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml:AttributeValue xsi:type="xsd:boolean">false</saml:AttributeValue>
        </saml:Attribute>


Gary Lipscomb
Technical Officer, Systems | IT Infrastructure & Security | Division of Information Technology
Charles Sturt University


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Tuesday, 8 February 2022 00:00
To: Shib Users <users at shibboleth.net>
Cc: Lipscomb, Gary <glipscomb at csu.edu.au>
Subject: Re: SLO Logout Propagation error - Resolver returned no EncryptionParameters

>    I am too. I'm either misremembering something or it's probably a 
> bug, but I'll review it. I didn't recall the property in question being wired into that part of the configuration.

I am mistaken, it eventually became a profile setting, it's just defaulted based on the property. I don't see any bugs anywhere, and I don't see anything wrong in what you posted, so I don't have any ideas. There's something wrong in your metadata I imagine, but I don't know what.

The purpose of the property honestly was to be global. It doesn't serve any particular purpose to use it that way because you could just as easily use the more deliberate settings and turn NameID encryption off for that SP (and save it the effort of looking for a key at all). I guess if one imagines a key might show up later, it might matter, but that's not too likely. 

-- Scott