No subject

[Hemi Taka]

Thanks Alan,
you were right, the IDP was misconfigured.

The data was encrypted using the new cert on one end and the attempt to
decrypt,
using the new cert resulted in the error.
The IDP was redirecting correctly but so appeared it was working on their
side.

Message: 1
Date: Tue, 15 Feb 2022 12:00:07 +0000
From: Alan Buxey <alan.buxey at myunidays.com>
To: Shib Users <users at shibboleth.net>
Subject: Re:
Message-ID:
        <CAObj+SXkNYVGVos8yBdF+THeS09+JPhsOZxnCSj38rBcNQ0OSw at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"

hi,

has the IdP updated their metadata to use the new certificate of the SP ?

alan


On Mon, Feb 14, 2022 at 5:47 PM Hemi Taka <hemi at atlasmd.com> wrote:

> HI,
>
> We are running a Shibboleth 3.3 Service provider and connecting to a
> remote IDP.
> All has been working well until we update the certificate on the service
> provider.
> The certificate and key have been checked.
>
> On starting the Shibboleth service on a windows server there are no errors
> in the shibboleth logs.
> Users logging in appear to redirect from the IDP before seeing
> the opensaml::FatalProfileException message.
>
> We are receiving the below errors in the logs.
>
>
> 2022-02-14 17:21:37 WARN XMLTooling.Decrypter [1] [default]: XMLSecurity
> exception while decrypting key: OpenSSL:RSA privateKeyDecrypt - Error
> removing OAEPadding
> 2022-02-14 17:21:37 WARN XMLTooling.Decrypter [1] [default]: unable to
> decrypt key, generating random key for defensive purposes
> 2022-02-14 17:21:37 ERROR Shibboleth.SSO.SAML2 [1] [default]: failed to
> decrypt assertion: XMLSecurity exception while decrypting: Errors occurred
> during de-serialisation of decrypted element content
> 2022-02-14 17:21:37 WARN Shibboleth.SSO.SAML2 [1] [default]: error
> processing incoming assertion: A valid authentication statement was not
> found in the incoming message.
>
>  I am not sure what other information is relevant to give and would like
> any pointers to help resolve.
>
> Thanks
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220221/eafcdbc9/attachment.htm>