<div dir="ltr"><div><div>Hi Scott:<br><br></div>Attached below is the error generated in the IdP logs.<br><br></div>Would you happen to have any tips on why the rror was triggered? I am reverse engineering the integration between production and development (as I do not have access to the ServiceNow config) - the production works but not the development instance (although the confis on the IdP side are the same).<br>
<div><br><br><div><br><br>21:08:04.261 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:552] - Determining if SAML assertion to relying party '<a href="https://xxx.service-now.com">https://xxx.service-now.com</a>' should be signed<br>
21:08:04.261 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:625] - IdP relying party configuration 'default' indicates to sign assertions: false<br>21:08:04.262 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:632] - Entity metadata for relying party '<a href="https://xxx.service-now.com">https://xxx.service-now.com</a> 'indicates to sign assertions: false<br>
21:08:04.262 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:269] - Attempting to encrypt assertion to relying party '<a href="https://xxx.service-now.com">https://xxx.service-now.com</a>'<br>
21:08:04.266 - DEBUG [org.opensaml.security.MetadataCredentialResolver:157] - Forcing on-demand metadata provider refresh if necessary<br>21:08:04.271 - DEBUG [org.opensaml.security.MetadataCredentialResolver:205] - Attempting to retrieve credentials from cache using index: [<a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a>,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]<br>
21:08:04.271 - DEBUG [org.opensaml.security.MetadataCredentialResolver:222] - Unable to retrieve credentials from cache using index: [<a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a>,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]<br>
21:08:04.271 - DEBUG [org.opensaml.security.MetadataCredentialResolver:242] - Attempting to retrieve credentials from metadata for entity: <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>21:08:04.271 - DEBUG [org.opensaml.security.MetadataCredentialResolver:314] - Retrieving metadata for entity '<a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a>' in role '{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor' for protocol 'urn:oasis:names:tc:SAML:2.0:protocol'<br>
21:08:04.272 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:254] - Checking child metadata provider for entity descriptor with entity ID: <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>
21:08:04.272 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:509] - Searching for entity descriptor with an entity ID of <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>
21:08:04.272 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] - Metadata document did not contain a descriptor for entity <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>
21:08:04.272 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] - Metadata document did not contain any role descriptors of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>
21:08:04.272 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] - Metadata document does not contain a role of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol urn:oasis:names:tc:SAML:2.0:protocol for entity <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>
21:08:04.273 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:254] - Checking child metadata provider for entity descriptor with entity ID: <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>
21:08:04.273 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:509] - Searching for entity descriptor with an entity ID of <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>
21:08:04.273 - DEBUG [org.opensaml.security.MetadataCredentialResolver:347] - Added new credential collection to cache with key: [<a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a>,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]<br>
21:08:04.276 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:185] - Loading default evaluable credential criteria mappings<br>21:08:04.277 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluableKeyAlgorithmCredentialCriteria as evaluator for class org.opensaml.xml.security.criteria.KeyAlgorithmCriteria<br>
21:08:04.278 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluableKeyLengthCredentialCriteria as evaluator for class org.opensaml.xml.security.criteria.KeyLengthCriteria<br>
21:08:04.279 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluableX509SubjectKeyIdentifierCredentialCriteria as evaluator for class org.opensaml.xml.security.x509.X509SubjectKeyIdentifierCriteria<br>
21:08:04.280 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluablePublicKeyCredentialCriteria as evaluator for class org.opensaml.xml.security.criteria.PublicKeyCriteria<br>
21:08:04.281 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluableX509IssuerSerialCredentialCriteria as evaluator for class org.opensaml.xml.security.x509.X509IssuerSerialCriteria<br>
21:08:04.282 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria as evaluator for class org.opensaml.xml.security.criteria.UsageCriteria<br>
21:08:04.283 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria as evaluator for class org.opensaml.xml.security.criteria.EntityIDCriteria<br>
21:08:04.284 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluableKeyNameCredentialCriteria as evaluator for class org.opensaml.xml.security.criteria.KeyNameCriteria<br>
21:08:04.285 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:131] - Registering class org.opensaml.xml.security.credential.criteria.EvaluableX509SubjectNameCredentialCriteria as evaluator for class org.opensaml.xml.security.x509.X509SubjectNameCriteria<br>
21:08:04.285 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:106] - Registry could not locate evaluable criteria for criteria class org.opensaml.security.MetadataCriteria<br>21:08:04.285 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:75] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria for criteria class org.opensaml.xml.security.criteria.EntityIDCriteria<br>
21:08:04.286 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:75] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria for criteria class org.opensaml.xml.security.criteria.UsageCriteria<br>
21:08:04.287 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:888] - Could not resolve a key encryption credential for peer entity: <a href="https://ubcdev.service-now.com">https://ubcdev.service-now.com</a><br>
21:08:05.639 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:275] - Unable to construct encrypter<br>org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:889) ~[shibboleth-identityprovider.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:272) ~[shibboleth-identityprovider.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:280) [shibboleth-identityprovider.jar:na]<br></div></div></div><div class="gmail_extra"><br>
<br><div class="gmail_quote">On Wed, May 8, 2013 at 8:49 PM, It Meme <span dir="ltr"><<a href="mailto:it.meme01@gmail.com" target="_blank">it.meme01@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div>Hi Scott:<br><br>Thank you for your post.<div class="im"><br><br>>You have to sign the response or the assertion.<br><br></div></div><div>Where is signing of response or assertion set?<br><br></div>
<div>ServiceNow does things a little differently from other SPs we have integrated with - I am a bit at sea trying to figure out why this does not work in our development instance but works in production (but the configurations are identical).<br>
<br></div><div>Any guidance will be greatly appreciated.<br><br></div><div>Thanks.<br></div><br><br><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 8, 2013 at 5:21 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 5/8/13 5:36 PM, "It Meme" <<a href="mailto:it.meme01@gmail.com" target="_blank">it.meme01@gmail.com</a>> wrote:<br>
><br>
>Would you have any ideas on what to look for? Is this something<br>
>ServiceNow should update on their end?<br>
<br>
</div>Well, it's your setting. You have to sign the response or the assertion.<br>
AFAIK, S-N handles either correctly. I don't know if the IdP can be<br>
convinced to sign neither one, but obviously if you did, it's not going to<br>
work.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>