<div>Its hard to tell. I have this in the assertion for the encrypted assertion:</div><div><br></div></EncryptionMethod><ds:KeyInfo><EncryptedKey Id="uuidb5469dbb-0138-1020-ab16-fef9662dd66c"><EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-1_5">http://www.w3.org/2001/04/xmlenc#rsa-1_5</a>"></EncryptionMethod><ds:KeyInfo><ds:KeyName>EMAILADDRESS=<a href="mailto:cloudops@audaxhealth.com">cloudops@audaxhealth.com</a>, CN=<a href="http://www.dev.careverge.com">www.dev.careverge.com</a>, OU=Cloud Ops, O=Audax Health Inc., L=Washington, ST=District of Columbia, C=US</ds:KeyName><div>
<br></div><div>Where it looks like the encrypted key is being looked up by UUID. There is a key in the asswertion, but the assertion indicates it is used for the signature. Comparing the key in the assertion to the keys in the IDP metadata, it looks like the same key that is used for both encryption and signing (odd). I have no UUID indicators in the metadata anywhere, so I am not sure if there is another way to see either what the UUID is indexing or how it is being used.</div>
<div><br></div><div>Thanks,</div><div><br></div><div>Rob</div><div><br><br><div class="gmail_quote">On Mon, Jul 23, 2012 at 4:30 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 7/23/12 4:14 PM, "Rob Whitener" <<a href="mailto:rob.whitener@audaxhealth.com">rob.whitener@audaxhealth.com</a>> wrote:<br>
><br>
>At Scott Cantor's suggestion, I asked our partner to encrypt the whole<br>
>assertion, rather than just the attributes (they took it upon themselves<br>
>to have the attributes remain encrypted as well, inside the already<br>
>encrypted assertion? Seems like too much encryption<br>
> to me).<br>
<br>
</div>It also won't fix your issue, although...<br>
<div class="im"><br>
>Now, we are seeing errors like this in Syslog:<br>
><br>
>Jul 23 19:18:21 ip-10-90-230-192 shibboleth-sp: 1343071101 ERROR<br>
>Shibboleth.Listener [24585] shib_check_user: remoted message returned an<br>
>error: A valid authentication statement was not found in the incoming<br>
>message.<br>
<br>
</div>That means you can't decrypt with the key they used, as Nate said, and<br>
that should also be happening in the original case of the<br>
EncryptedAttribute (not in syslog, it will just be a warning in shibd.log).<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>