<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Trev,<div><br></div><div>Your immediate problem is that there is no way to encrypt assertions sent to Service-Now, according to the guide you referenced. As such, that's usually turned off strictly for that SP by this configuration:</div><div><br></div><div><div style="background-color: transparent; font-family: Times; "><div style="margin-left: 36pt; margin-top: 0pt; margin-bottom: 0pt; "><span style="font-size: 11pt; font-family: 'Times New Roman'; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "><!-- relying party for service-now --></span></div><div style="margin-left: 36pt; margin-top: 0pt; margin-bottom: 0pt; "><span style="font-size: 11pt; font-family: 'Times New Roman'; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "> <RelyingParty id="<a href="https://uchicagotest.service-now.com">https://uchicagotest.service-now.com</a>"</span></div><div style="margin-left: 36pt; margin-top: 0pt; margin-bottom: 0pt; "><span style="font-size: 11pt; font-family: 'Times New Roman'; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "> provider="<a href="https://matlock.uchicago.edu/idp/shibboleth">https://matlock.uchicago.edu/idp/shibboleth</a>"</span></div><div style="margin-left: 36pt; margin-top: 0pt; margin-bottom: 0pt; "><span style="font-size: 11pt; font-family: 'Times New Roman'; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "> defaultSigningCredentialRef="IdPCredential"></span></div><div style="margin-left: 36pt; margin-top: 0pt; margin-bottom: 0pt; "><span style="font-size: 11pt; font-family: 'Times New Roman'; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "> <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" /></span></div><div style="margin-left: 36pt; margin-top: 0pt; margin-bottom: 0pt; "><span style="font-size: 11pt; font-family: 'Times New Roman'; color: rgb(0, 0, 0); background-color: transparent; font-weight: normal; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap; "> </RelyingParty></span></div></div></div><div><br></div><div>... which you may be missing.</div><div><br></div><div>Their parsing code is probably not ultra sophisticated, and it interprets the error code the IdP sends as a response missing an assertion with a subject in it. Which, I guess is true, in a very narrow sense...</div><div><br></div><div>Make sure you're not trying to encrypt assertions sent to them,</div><div>Nate.</div><div><br><div><div>On Sep 21, 2011, at 19:54 , Fong, Trevor wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><br>Hi Guys,<br><br>We're trying to integrate with Service-Now also and are trying to follow uChicago's recipe from <a href="https://docs.google.com/document/d/1yApSgHn0C02z09zYC3CD_edX7s3DbnuGgJ-kI-BhqYI/edit?hl=en_US&authkey=CPK1ppQN&pli=1">https://docs.google.com/document/d/1yApSgHn0C02z09zYC3CD_edX7s3DbnuGgJ-kI-BhqYI/edit?hl=en_US&authkey=CPK1ppQN&pli=1</a><br><br>We've also commented out some of the lines in Service-Now scripts to do with SPNameQualifier as suggested by James Bardin.<br><br>However, we still have a problem: when someone tries to login, they get the Service-Now error message "Could not extract //Subject/NameID from SAMLResponse"<br><br>Delving into our idp-process.log, we see:<br><br>10:24:24.448 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:888] - Could not resolve a key encryption credential for peer entity: <a href="https://xxxx.service-now.com">https://xxxx.service-now.com</a><br>10:24:25.913 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:275] - Unable to construct encrypter<br>org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:889) ~[shibboleth-identityprovider-2.2 .0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:272) ~[shibboleth-identityprovider-2.<br>2.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:280) [shibboleth-identityprovider-2.2.0.j<br>ar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:164) [shibboleth-identityprovider-2.2.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:84) [shibboleth-identityprovider-2.2.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.2.0.jar:na]<br> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.29]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]<br> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:77) [shibboleth-identityprovider-2.2.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.29]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]<br> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:51) [shibboleth-common-1.2.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.29]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]<br> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.29]<br> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.29]<br> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.29]<br> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.29]<br> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.29]<br> at org.terracotta.modules.tomcat.tomcat_5_5.SessionValve55.invoke(SessionValve55.java:88) [na:na]<br> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina.jar:6.0.29]<br> at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote.jar:6.0.29]<br> at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote.jar:6.0.29]<br> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:774) [tomcat-coyote.jar:6.0.29]<br> at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:703) [tomcat-coyote.jar:6.0.29]<br> at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:896) [tomcat-coyote.jar:6.0.29]<br> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote.jar:6.0.29]<br> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_24]<br><br>... <snip> ...<br><br> <saml2p:Status><br> <saml2p:StatusCode Value="<a href="urn:oasis:names:tc:SAML:2.0:status:Responder">urn:oasis:names:tc:SAML:2.0:status:Responder</a>"/><br> <saml2p:StatusMessage>Unable to encrypt assertion</saml2p:StatusMessage><br> </saml2p:Status><br><br><br>Any ideas?<br><br>Thanks a lot,<br>Trev<br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></div></blockquote></div><br></div></body></html>