I would not bother about the UUID. <div>Inside your shibboleth configuration, you should have something like</div><div> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/></div>
<div><br></div><div>Use the following openssl command to get the subject of the certificate:</div><div><div>openssl x509 -in sp-cert.pem -subject -noout</div><div><br></div><div>You should see something like </div><div>subject= /EMAILADDRESS=<a href="mailto:cloudops@audaxhealth.com" target="_blank">cloudops@audaxhealth.com</a>/ CN=<a href="http://www.dev.careverge.com/" target="_blank">www.dev.careverge.com</a>/OU=Cloud Ops/O=Audax Health Inc./ L=Washington/ST=District of Columbia/C=US</div>
</div><div><br></div><div>How did you get the metadata you sent to your IdP?</div><div><br></div><div>In any case, I would to try to exchange again the metadata. <br><br>Y.<br><br><div class="gmail_quote">On Mon, Jul 23, 2012 at 10:54 PM, Rob Whitener <span dir="ltr"><<a href="mailto:rob.whitener@audaxhealth.com" target="_blank">rob.whitener@audaxhealth.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Its hard to tell. I have this in the assertion for the encrypted assertion:</div><div><br></div></EncryptionMethod><ds:KeyInfo><EncryptedKey Id="uuidb5469dbb-0138-1020-ab16-fef9662dd66c"><EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-1_5" target="_blank">http://www.w3.org/2001/04/xmlenc#rsa-1_5</a>"></EncryptionMethod><ds:KeyInfo><ds:KeyName>EMAILADDRESS=<a href="mailto:cloudops@audaxhealth.com" target="_blank">cloudops@audaxhealth.com</a>, CN=<a href="http://www.dev.careverge.com" target="_blank">www.dev.careverge.com</a>, OU=Cloud Ops, O=Audax Health Inc., L=Washington, ST=District of Columbia, C=US</ds:KeyName><div>
<br></div><div>Where it looks like the encrypted key is being looked up by UUID. There is a key in the asswertion, but the assertion indicates it is used for the signature. Comparing the key in the assertion to the keys in the IDP metadata, it looks like the same key that is used for both encryption and signing (odd). I have no UUID indicators in the metadata anywhere, so I am not sure if there is another way to see either what the UUID is indexing or how it is being used.</div>
<div><br></div><div>Thanks,</div><div><br></div><div>Rob</div><div class="HOEnZb"><div class="h5"><div><br><br><div class="gmail_quote">On Mon, Jul 23, 2012 at 4:30 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 7/23/12 4:14 PM, "Rob Whitener" <<a href="mailto:rob.whitener@audaxhealth.com" target="_blank">rob.whitener@audaxhealth.com</a>> wrote:<br>
><br>
>At Scott Cantor's suggestion, I asked our partner to encrypt the whole<br>
>assertion, rather than just the attributes (they took it upon themselves<br>
>to have the attributes remain encrypted as well, inside the already<br>
>encrypted assertion? Seems like too much encryption<br>
> to me).<br>
<br>
</div>It also won't fix your issue, although...<br>
<div><br>
>Now, we are seeing errors like this in Syslog:<br>
><br>
>Jul 23 19:18:21 ip-10-90-230-192 shibboleth-sp: 1343071101 ERROR<br>
>Shibboleth.Listener [24585] shib_check_user: remoted message returned an<br>
>error: A valid authentication statement was not found in the incoming<br>
>message.<br>
<br>
</div>That means you can't decrypt with the key they used, as Nate said, and<br>
that should also be happening in the original case of the<br>
EncryptedAttribute (not in syslog, it will just be a warning in shibd.log).<br>
<div><div><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>