Message was signed, but signature could not be verified.

[Goldberg, Arthur P]

The “Message was signed, but signature could not be verified.” is documented a https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335423/CommonErrors#Message-was-signed,-but-signature-could-not-be-verified., which says, initially

The certificate that was used to sign the message didn't match the one the SP expected based on metadata. That can be caused by, in order of likelihood:

  1.  The certificate in the metadata is different from the one configured for the IdP, and hence, the one in the message. …

Consistent with this, shibd.log & shibd_warn.log contain:
2022-07-11 13:05:06 WARN Shibboleth.SSO.SAML2 [1] [default]: detected a problem with assertion: Message was signed, but signature could not be verified.
2022-07-11 13:05:06 WARN Shibboleth.SSO.SAML2 [1] [default]: error processing incoming assertion: Message was signed, but signature could not be verified.

Is it correct that the “certificate … configured for the IdP [at the SP]” is given by this chain of references?

  1.  shibd is configured by /etc/shibboleth/shibboleth2.xml
  2.  The MetadataProvider element shibboleth2.xml contains a path attribute, which names a file, call AzureIdPMetadata.xml in my system, that contains the metadata describing the IdP.
  3.  AzureIdPMetadata.xml contains a certificate, identified by the nested elements EntityDescriptor.Signature.KeyInfo.X509Data.X509Certificate (where the dot notation indicates nesting).

I’m simultaneously verifying with the IdP managers that this certificate in AzureIdPMetadata.xml is the IdP’s certificate which is used to communicate with my SP.

Running shibboleth 3.2.2.

Thanks
Arthur


--
Arthur Goldberg, PhD
Mount Sinai Data Warehouse<https://labs.icahn.mssm.edu/msdw/>
Scientific Computing and Data<https://labs.icahn.mssm.edu/minervalab/scientific-computing-and-data>
Associate Professor of Genetics and Genomic Sciences
Institute for Data Science and Genomic Technology
Mount Sinai School of Medicine

Arthur.Goldberg at mssm.edu<mailto:Arthur.Goldberg at mssm.edu>
646 526 5020
Zoom<https://mssm.zoom.us/my/arthur.goldberg?pwd=LzByMGJOZC9wM3A2aHV6OU94eUtSQT09>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220711/3996b407/attachment.htm>