<div dir="ltr"><div><div><div><div><div>Scott,<br><br>Sorry about that I should have been more careful when I send out the first email.<br><br></div>I am trying to use certificate viewer to view the X509Certificate, and it looks like they are different:<br>
<br></div>This is the X509Certificate captured from idp metadata file:<br>MIIDKzCCAhOgAwIBAgIUBmArgGbiur6uu2YfHg5RCcmZWkQwDQYJKoZIhvcNAQEF<br>BQAwGzEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0xMjAyMjQwMTEwMDla<br>Fw0zMjAyMjQwMTEwMDlaMBsxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmcwggEi<br>
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCUS4L8kz+wB94NmjiNh0Ff3KuB<br>tM2L/oeBzpQJoTALQ5HLnZdCWHRaQYD2LV2lp1zPQTBpS1aRghGrHUrBCuowq172<br>H9RcEk3vOb44NnVmxFCBTIbCDv6SjjLBY35QTwzcQVwWLIMq833Wt4dQKrapfwJr<br>p8jJd8RobpFJl0K3BbwtFTa3gBL+FDT5jYpsmld3oOLDSgUG+lqcjjVPQMgY+FC2<br>
Jb/tyzMibd8AFUTck1TYZ8uSk44XtYfTMvz3fZYCNsympxGUVk5Qno2AoZvObSbF<br>unC2MSEjKQzEmdwBUJkIhV81sjC+ofH4JuImY9y7I5BA62HET5/J8/SpKV0BAgMB<br>AAGjZzBlMEQGA1UdEQQ9MDuCEGlkcC50ZXN0c2hpYi5vcmeGJ2h0dHBzOi8vaWRw<br>LnRlc3RzaGliLm9yZy9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4EFgQUtEusYC7zyykK<br>
OxNnq+L9Wo67uy8wDQYJKoZIhvcNAQEFBQADggEBABr3g1EG530HWcovEFo/3RC9<br>AWnD0I7zEbFZEDdMPHRdmdjpzskMF6J+Olq86qBaKL5Wn92BNIPmJvFpypokRmlo<br>kti7aJqvjggXNRG+6yLqBbZX4P1cK6tyT8SAZ5zwn52uw1+XFJS6HHUtPLcbnhXe<br>2YnXpgEE6dkx1BhEL+vKSFOeLlFiGiex3DsA5j4qpR+Za2FTbAWl0eU8H4ipMNTp<br>
CdSxaerQTV4NMw5asLXDtRF5AMBwv2nXer+MOx2YN6t85+TCaXeQlx9svl2a5JTz<br>1Hayl8yhcskcx9B2O2DTQsgL0lFWeogJ2O8qoHI0eST/mCDDbnfKZ7uGuGswyws=<br><br></div>This is the certificate in the <Assertion> tag that return to my SP:<br>
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM<br>UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG<br>A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx<br>
CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx<br>ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG<br>9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp<br>
u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT<br>pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI<br>fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB<br>
5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE<br>MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8<br>3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET<br>
MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0<br>c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M<br>FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk<br>
OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4<br>/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx<br>pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW<br>
<br></div>Can you confirm if they are using the same key to generate the digest? I am not farmiliar with this part, if you can tell me how to do that I would be glad to do it by myself.<br><br></div>Thanks<br>Yaowen<br></div>
<div class="gmail_extra"><br clear="all"><div>Yaowen</div>
<br><br><div class="gmail_quote">On Wed, Apr 17, 2013 at 5:42 PM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Yaowen,<br>
<br>
I think it's using the keypair(and certificate) as configured in metadata to sign assertions:<br>
<br>
<ds:SignatureValue>gVi0RA0xHz3UKQIhv464B4i5hrdq88GbL5JgS5m6zUtox7zW3ttBX6gU2QDEb6oXCB/GJ1JAtqYzmjhXXP+TYyVVs+htVhty4aXABj3+0cE/cgKULzksgr42GMOmib7O6Zvy8Yp6mQu72fCSJdDvZsI3bRgq24HOY1Y6qR2rzC78ApVh7u+bnGOx9xil4pFokWGdJTf22xD1ZLYeNzVkO2dKLhK+SSruPR1sbkj6WCTDEiSW5aIxG/hPbx18LzEJBVyiiNq/ppr7OB4xe7GOa3+AJPHNdwxz6BPMXoaHbnG6ITQB1Gx2uKETeqPwW6aytC9DieddJ60zWQt7r/SSkA==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEVMBMGA1UECBMM<br>
UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYDVQQKEwhUZXN0U2hpYjEZMBcG<br>
A1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcx<br>
CzAJBgNVBAYTAlVTMRUwEwYDVQQIEwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gx<br>
ETAPBgNVBAoTCFRlc3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG<br>
9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7CyVTDClcp<br>
u93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe3OQ01Ow3yT4I+Wdg1tsT<br>
pSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aTNPFmDixzUjoYzbGDrtAyCqA8f9CN2txI<br>
fJnpHE6q6CmKcoLADS4UrNPlhHSzd614kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB<br>
5/9nb0yh/ojRuJGmgMWHgWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HE<br>
MIHBMB0GA1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ869nh8<br>
3KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBlbm5zeWx2YW5pYTET<br>
MBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNoaWIxGTAXBgNVBAMTEGlkcC50ZXN0<br>
c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5M<br>
FfSVk98t3CT9jHZoYxd8QMRLI4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpk<br>
OAvZZUosVkUo93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4<br>
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAjGeka8nz8Jjwx<br>
pUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr8K/qhmFT2nIQi538n6rVYLeW<br>
j8Bbnl+ev0peYzxFyF5sQA==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="<a href="https://idp.testshib.org/idp/shibboleth" target="_blank">https://idp.testshib.org/idp/shibboleth</a>" SPNameQualifier="<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.org/shibboleth-sp</a>">_4639f7dc6610a693820b8bcbf9123f20</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><br>
<br>
<br>
<br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><br>
MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV<br>
MBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMREwDwYD<br>
VQQKEwhUZXN0U2hpYjEZMBcGA1UEAxMQaWRwLnRlc3RzaGliLm9yZzAeFw0wNjA4<br>
MzAyMTEyMjVaFw0xNjA4MjcyMTEyMjVaMGcxCzAJBgNVBAYTAlVTMRUwEwYDVQQI<br>
EwxQZW5uc3lsdmFuaWExEzARBgNVBAcTClBpdHRzYnVyZ2gxETAPBgNVBAoTCFRl<br>
c3RTaGliMRkwFwYDVQQDExBpZHAudGVzdHNoaWIub3JnMIIBIjANBgkqhkiG9w0B<br>
AQEFAAOCAQ8AMIIBCgKCAQEArYkCGuTmJp9eAOSGHwRJo1SNatB5ZOKqDM9ysg7C<br>
yVTDClcpu93gSP10nH4gkCZOlnESNgttg0r+MqL8tfJC6ybddEFB3YBo8PZajKSe<br>
3OQ01Ow3yT4I+Wdg1tsTpSge9gEz7SrC07EkYmHuPtd71CHiUaCWDv+xVfUQX0aT<br>
NPFmDixzUjoYzbGDrtAyCqA8f9CN2txIfJnpHE6q6CmKcoLADS4UrNPlhHSzd614<br>
kR/JYiks0K4kbRqCQF0Dv0P5Di+rEfefC6glV8ysC8dB5/9nb0yh/ojRuJGmgMWH<br>
gWk6h0ihjihqiu4jACovUZ7vVOCgSE5Ipn7OIwqd93zp2wIDAQABo4HEMIHBMB0G<br>
A1UdDgQWBBSsBQ869nh83KqZr5jArr4/7b+QazCBkQYDVR0jBIGJMIGGgBSsBQ86<br>
9nh83KqZr5jArr4/7b+Qa6FrpGkwZzELMAkGA1UEBhMCVVMxFTATBgNVBAgTDFBl<br>
bm5zeWx2YW5pYTETMBEGA1UEBxMKUGl0dHNidXJnaDERMA8GA1UEChMIVGVzdFNo<br>
aWIxGTAXBgNVBAMTEGlkcC50ZXN0c2hpYi5vcmeCAQAwDAYDVR0TBAUwAwEB/zAN<br>
BgkqhkiG9w0BAQUFAAOCAQEAjR29PhrCbk8qLN5MFfSVk98t3CT9jHZoYxd8QMRL<br>
I4j7iYQxXiGJTT1FXs1nd4Rha9un+LqTfeMMYqISdDDI6tv8iNpkOAvZZUosVkUo<br>
93pv1T0RPz35hcHHYq2yee59HJOco2bFlcsH8JBXRSRrJ3Q7Eut+z9uo80JdGNJ4<br>
/SJy5UorZ8KazGj16lfJhOBXldgrhppQBb0Nq6HKHguqmwRfJ+WkxemZXzhediAj<br>
Geka8nz8JjwxpUjAiSWYKLtJhGEaTqCYxCCX2Dw+dOTqUzHOZ7WKv4JXPK5G/Uhr<br>
8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
You might be looking at the encryption key, which corresponds to the SP and also matches metadata.<br>
<br>
Thanks,<br>
Nate.<br>
<div class="HOEnZb"><div class="h5"><br>
On Apr 18, 2013, at 0:15 , Yaowen Tu wrote:<br>
<br>
> Actually I meant that the Assertion is signed. It looks like <a href="http://testshib.org" target="_blank">testshib.org</a> is using a different certificate to sign the assertion.<br>
><br>
> Thanks,<br>
> Yaowen<br>
><br>
> Yaowen<br>
><br>
><br>
> On Wed, Apr 17, 2013 at 5:08 PM, Yaowen Tu <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
> But the response returned to my SP is signed. In the Assertion object, the isSigned() flag is true.<br>
><br>
> Did I miss anything?<br>
><br>
> Thanks,<br>
> Yaowen<br>
><br>
> Yaowen<br>
><br>
><br>
> On Wed, Apr 17, 2013 at 4:48 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
> On 4/17/13 7:35 PM, "Yaowen Tu" <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
> ><br>
> >From the SAMLResponse of the <a href="http://testshib.org" target="_blank">testshib.org</a> <<a href="http://testshib.org" target="_blank">http://testshib.org</a>> IdP, it<br>
> >contains a different certificate in the <Response> tag.<br>
><br>
> I just looked at a response from it. Since it's not signing the response,<br>
> there is no certificate in it. So I would guess that given nothing would<br>
> have changed, that you are probably mistaken about the issue.<br>
><br>
> -- Scott<br>
><br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>