multiple SPs - XMLSecurity exception while decrypting key: OpenSSL:RSA privateKeyDecrypt - Error removing OAEPadding

[sacha+shibboleth at ssl.co.uk]

Many thanks Scott - your hunch was absolutely spot on. My 
ShibRequestSettings in the Apache config were applying only to the 
application Location and not to the /Shibboleth.sso Location.

Once I added them, everything kicked into life:

     <Location /Shibboleth.sso>
         SetHandler shib
         ShibRequestSetting applicationId <name of override>
         ShibRequestSetting entityId <entityID of IdP B>
     </Location>


On 16/03/2022 16:41, Cantor, Scott via users wrote:
> I simply can't debug this for you on list , but I will say that generally speaking the most common problem with overrides is that people only apply the override to the content and not to the handlers (i.e. the Assertion Consumer Service in particular) that handles the responses for that override. They have to line up.
> 
> It's possible your responses back in that you think are being handled by B are still coming back to A and operating with the other key. And you may not realize it as easily with this set up because it's dying due to the bad key before it gets far enough to notice there are other problems with the assertion such as the Audience.
> 
> Virtual host-based overrides are not all that commonly subject to that problem because the rules are easier and there's nothing obviously wrong with doing it this way.
> 
> But it's a pretty major clue that the metadata broke it. If it were setup properly, there's no reason there couldn't be separate metadata for B and since there wasn't, it's pretty clear that it was handling the response on behalf of A, not B.
> 
> -- Scott
> 
>