<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 1/9/13 5:50 PM, Sean R. McNamara
wrote:<br>
</div>
<blockquote
cite="mid:13DE6CDC5C02C040A962C8E7E553E54379BB853E@SN2PRD0310MB394.namprd03.prod.outlook.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif;
font-size: 14px; ">
Hello all,</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif;
font-size: 14px; ">
<br>
</div>
<div><font face="Calibri,sans-serif">We're running the Shibboleth
IdP 2.1.2 and are members of incommon. We've recently been
trying to interoperate with a new SP and are running into
issues with their attribute request. The end result is an
exception "</font><span style="color: rgb(0, 0, 0);
font-family: Helvetica; font-size: 12px; ">Client certificate
authentication failed for context issuer entity ID", but, it
appears the real issue has to do with the line: "</span><font
face="Helvetica"><span style="font-size: 12px;">Failed to
validate untrusted credential against trusted key" </span></font></div>
</blockquote>
<br>
Yes, exactly, that's the problem. <br>
<br>
<blockquote
cite="mid:13DE6CDC5C02C040A962C8E7E553E54379BB853E@SN2PRD0310MB394.namprd03.prod.outlook.com"
type="cite">
<div><br>
</div>
<div><br>
<p style="margin: 0px; font-size: 12px; font-family: Helvetica;
">16:47:23.754 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:206]
- Searching for entity descriptor with an entity ID of
<a class="moz-txt-link-freetext" href="https://Broken-SP/shibboleth">https://Broken-SP/shibboleth</a></p>
<br>
</div>
</blockquote>
<blockquote type="cite">
<p style="margin: 0px; font-size: 12px; font-family: Helvetica; ">16:47:23.755
- DEBUG
[org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver:296]
- Processing KeyInfo child
{<a class="moz-txt-link-freetext" href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>}X509Data with provider
org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider</p>
<p style="margin: 0px; font-size: 12px; font-family: Helvetica; ">16:47:23.756
- DEBUG
[org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:122]
- Attempting to extract credential from an X509Data</p>
<p style="margin: 0px; font-size: 12px; font-family: Helvetica; ">16:47:23.763
- DEBUG
[org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:195]
- Found 1 X509Certificates</p>
<p style="margin: 0px; font-size: 12px; font-family: Helvetica; ">16:47:23.763
- DEBUG
[org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:176]
- Found 0 X509CRLs</p>
<p style="margin: 0px; font-size: 12px; font-family: Helvetica; ">16:47:23.763
- DEBUG
[org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider:214]
- Single certificate was present, treating as end-entity
certificate</p>
</blockquote>
<br>
<blockquote
cite="mid:13DE6CDC5C02C040A962C8E7E553E54379BB853E@SN2PRD0310MB394.namprd03.prod.outlook.com"
type="cite">
<div>
<p style="margin: 0px; font-size: 12px; font-family: Helvetica;
">16:47:23.764 - DEBUG
[org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver:301]
- Credentials successfully extracted from child
{<a class="moz-txt-link-freetext" href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>}X509Data by provider </p>
</div>
</blockquote>
<br>
<br>
<br>
Looks like the metadata you have for the Broken-SP has 1 certificate
in metadata.<br>
<br>
<br>
<br>
<blockquote
cite="mid:13DE6CDC5C02C040A962C8E7E553E54379BB853E@SN2PRD0310MB394.namprd03.prod.outlook.com"
type="cite">
<div><br>
<p style="margin: 0px; font-size: 12px; font-family: Helvetica;
">16:47:23.766 - DEBUG
[org.opensaml.xml.security.trust.ExplicitKeyTrustEvaluator:94]
- Failed to validate untrusted credential against trusted key</p>
</div>
</blockquote>
<br>
<br>
This line however indicates that the metadata cert's public key does
not match the public key in the client cert being presented during
client TLS. <br>
<br>
So, either the SP is using the wrong cert with your IdP, or the
metadata is out-of-date. Take your pick, but that's the basic
problem. <br>
<br>
<br>
<br>
<br>
</body>
</html>