<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Andale Mono";
panose-1:2 11 5 9 0 0 0 0 0 4;}
@font-face
{font-family:Times;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:Consolas;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D">Hi Everyone,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D">Yup - we have turned off encryption for their SP, exactly as uChicago and Nate have suggested. We have the following in our relying-party.xml:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Andale Mono";color:black">
</span><span style="font-size:9.0pt;font-family:"Andale Mono";color:teal"><</span><span style="font-size:9.0pt;font-family:"Andale Mono";color:#3F7F7F">RelyingParty</span><span style="font-size:9.0pt;font-family:"Andale Mono"">
<span style="color:#7F007F">id</span><span style="color:black">=</span><i><span style="color:#2A00FF">"https://xxxx.service-now.com"</span></i><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Andale Mono""> <span style="color:#7F007F">provider</span><span style="color:black">=</span><i><span style="color:#2A00FF">"https://xxxxx/idp/shibboleth"</span></i><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Andale Mono""> <span style="color:#7F007F">defaultSigningCredentialRef</span><span style="color:black">=</span><i><span style="color:#2A00FF">"IdPCredential"</span></i><span style="color:teal">></span><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Andale Mono";color:black">
</span><span style="font-size:9.0pt;font-family:"Andale Mono";color:teal"><</span><span style="font-size:9.0pt;font-family:"Andale Mono";color:#3F7F7F">ProfileConfiguration</span><span style="font-size:9.0pt;font-family:"Andale Mono""><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Andale Mono"">
<span style="color:#7F007F">xsi:type</span><span style="color:black">=</span><i><span style="color:#2A00FF">"saml:SAML2SSOProfile"</span></i>
<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Andale Mono""> <span style="color:#7F007F">encryptAssertions</span><span style="color:black">=</span><i><span style="color:#2A00FF">"never"</span></i><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Andale Mono"">
<span style="color:#7F007F">encryptNameIds</span><span style="color:black">=</span><i><span style="color:#2A00FF">"never"</span></i>
<span style="color:teal">/></span><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:9.0pt;font-family:"Andale Mono";color:black">
</span><span style="font-size:9.0pt;font-family:"Andale Mono";color:teal"></</span><span style="font-size:9.0pt;font-family:"Andale Mono";color:#3F7F7F">RelyingParty</span><span style="font-size:9.0pt;font-family:"Andale Mono";color:teal">></span><span style="font-size:9.0pt;font-family:"Andale Mono""><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D">So still no dice…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D">Trev<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Nate Klingenstein<br>
<b>Sent:</b> September-21-11 1:01 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Could not resolve a key encryption credential for peer entity<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Trev,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Your immediate problem is that there is no way to encrypt assertions sent to Service-Now, according to the guide you referenced. As such, that's usually turned off strictly for that SP by this configuration:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div style="margin-left:36.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><!-- relying party for service-now --></span><span style="font-family:"Times","serif""><o:p></o:p></span></p>
</div>
<div style="margin-left:36.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"> <RelyingParty id="<a href="https://uchicagotest.service-now.com">https://uchicagotest.service-now.com</a>"</span><span style="font-family:"Times","serif""><o:p></o:p></span></p>
</div>
<div style="margin-left:36.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"> provider="<a href="https://matlock.uchicago.edu/idp/shibboleth">https://matlock.uchicago.edu/idp/shibboleth</a>"</span><span style="font-family:"Times","serif""><o:p></o:p></span></p>
</div>
<div style="margin-left:36.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"> defaultSigningCredentialRef="IdPCredential"></span><span style="font-family:"Times","serif""><o:p></o:p></span></p>
</div>
<div style="margin-left:36.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"> <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" /></span><span style="font-family:"Times","serif""><o:p></o:p></span></p>
</div>
<div style="margin-left:36.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"> </RelyingParty></span><span style="font-family:"Times","serif""><o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">... which you may be missing.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Their parsing code is probably not ultra sophisticated, and it interprets the error code the IdP sends as a response missing an assertion with a subject in it. Which, I guess is true, in a very narrow sense...<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Make sure you're not trying to encrypt assertions sent to them,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Nate.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Sep 21, 2011, at 19:54 , Fong, Trevor wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
Hi Guys,<br>
<br>
We're trying to integrate with Service-Now also and are trying to follow uChicago's recipe from
<a href="https://docs.google.com/document/d/1yApSgHn0C02z09zYC3CD_edX7s3DbnuGgJ-kI-BhqYI/edit?hl=en_US&authkey=CPK1ppQN&pli=1">
https://docs.google.com/document/d/1yApSgHn0C02z09zYC3CD_edX7s3DbnuGgJ-kI-BhqYI/edit?hl=en_US&authkey=CPK1ppQN&pli=1</a><br>
<br>
We've also commented out some of the lines in Service-Now scripts to do with SPNameQualifier as suggested by James Bardin.<br>
<br>
However, we still have a problem: when someone tries to login, they get the Service-Now error message "Could not extract //Subject/NameID from SAMLResponse"<br>
<br>
Delving into our idp-process.log, we see:<br>
<br>
10:24:24.448 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:888] - Could not resolve a key encryption credential for peer entity:
<a href="https://xxxx.service-now.com">https://xxxx.service-now.com</a><br>
10:24:25.913 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:275] - Unable to construct encrypter<br>
org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:889) ~[shibboleth-identityprovider-2.2 .0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:272) ~[shibboleth-identityprovider-2.<br>
2.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:280) [shibboleth-identityprovider-2.2.0.j<br>
ar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:164) [shibboleth-identityprovider-2.2.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:84) [shibboleth-identityprovider-2.2.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.2.0.jar:na]<br>
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.29]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]<br>
at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:77) [shibboleth-identityprovider-2.2.0.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.29]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]<br>
at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:51) [shibboleth-common-1.2.0.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.29]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]<br>
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.29]<br>
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.29]<br>
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.29]<br>
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.29]<br>
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.29]<br>
at org.terracotta.modules.tomcat.tomcat_5_5.SessionValve55.invoke(SessionValve55.java:88) [na:na]<br>
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina.jar:6.0.29]<br>
at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote.jar:6.0.29]<br>
at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote.jar:6.0.29]<br>
at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:774) [tomcat-coyote.jar:6.0.29]<br>
at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:703) [tomcat-coyote.jar:6.0.29]<br>
at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:896) [tomcat-coyote.jar:6.0.29]<br>
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote.jar:6.0.29]<br>
at java.lang.Thread.run(Thread.java:662) [na:1.6.0_24]<br>
<br>
... <snip> ...<br>
<br>
<saml2p:Status><br>
<saml2p:StatusCode Value="<a href="urn:oasis:names:tc:SAML:2.0:status:Responder">urn:oasis:names:tc:SAML:2.0:status:Responder</a>"/><br>
<saml2p:StatusMessage>Unable to encrypt assertion</saml2p:StatusMessage><br>
</saml2p:Status><br>
<br>
<br>
Any ideas?<br>
<br>
Thanks a lot,<br>
Trev<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>