<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi Scott,<br>
<br>
This is to confirm that you were spot-on as usual in your helpful
response. The problem ended being my incorrectly specifying the
KeyInfo for jetty's SSL connector (used for transport layer
encryption) in Jetty's keystore in the IdP metadata. I should have
specified KeyInfo for Shib IdP's key in Shib IdP's keystore
instead. Once I fixed this all is back to being well.<br>
<br>
As a newbie to Shib, I am very impressed with the project, dev
team and community.<br>
<br>
Thanks for your kind help. <br>
<br>
On 05/23/2013 10:50 AM, Farrukh Najmi wrote:<br>
</div>
<blockquote cite="mid:519E2CCC.9020807@wellfleetsoftware.com"
type="cite">
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
Hi Guys,<br>
<br>
I was successfully getting Web SSO to work between my
spring-security-saml2 based SP and Shib 2.4.0 IdP. I was elated!<br>
<br>
Then I am not sure what I changed that started Web SSO to fail
right after I entered credentials on Idp's login.jsp page.<br>
<br>
Looking at logs the problem was a signature validation error on
the SP side when processing a <saml2p:ArtifactResponse>
issued by the IdP. <br>
<br>
Then looking at the Idp side logged protocol message I notice that
the KeyInfo in the <b>ArtifactResponse</b> message is for the key
used by my SP to earlier send the corresponding <b>ArtifactResolve</b>
request message. Should the IdP <b>ArtifactResponse</b> message
not be using the KeyInfo for the IdP's key instead of the KeyInfo
of the SP's key?<br>
<br>
What could cause this mixup in my configuration?<br>
<br>
What follows is relevant parts of SP and IdP stack traces and log
messages.<br>
<br>
Thanks very much for any advice.<br>
<br>
---------------------------Begin SP side trace
--------------------------<br>
<br>
INFO: 10:01:16,576 DEBUG SignatureValidator:77 - Signature did not
validate against the credential's key<br>
<br>
INFO: 10:01:16,577 DEBUG BaseSignatureTrustEngine:144 - Signature
validation using candidate validation credential failed<br>
org.opensaml.xml.validation.ValidationException: Signature did not
validate against the credential's key<br>
at
org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:79)<br>
at
org.opensaml.xml.signature.impl.BaseSignatureTrustEngine.verifySignature(BaseSignatureTrustEngine.java:142)<br>
at
org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:110)<br>
at
org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine.validate(ExplicitKeySignatureTrustEngine.java:49)<br>
at
org.springframework.security.saml.websso.AbstractProfileBase.verifySignature(AbstractProfileBase.java:271)<br>
at
org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertionSignature(WebSSOProfileConsumerImpl.java:416)<br>
at
org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertion(WebSSOProfileConsumerImpl.java:287)<br>
at
org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:204)<br>
at
org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:81)<br>
at
org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)<br>
...<br>
INFO: 10:01:16,578 DEBUG ExplicitKeySignatureTrustEngine:115 -
Failed to verify signature using either KeyInfo-derived or
directly trusted credentials<br>
<br>
---------------------------End SP side trace
--------------------------<br>
<br>
<br>
-----------------------Begin <b>ArtifactResolve</b> request
message in IdP --------------------------<br>
<br>
<?xml version="1.0" encoding="UTF-8"?><soap11:Envelope
xmlns:soap11=<a moz-do-not-send="true"
class="moz-txt-link-rfc2396E"
href="http://schemas.xmlsoap.org/soap/envelope/">"http://schemas.xmlsoap.org/soap/envelope/"</a>><br>
<soap11:Body><br>
<saml2p:ArtifactResolve
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="<a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://wellfleet1.wellfleetsoftware">https://wellfleet1.wellfleetsoftware</a>.<br>
com:9443/idp/profile/SAML2/SOAP/ArtifactResolution"
ID="a4jd9a3fceg3e34g2a672dadf06aa3j"
IssueInstant="2013-05-23T14:01:16.118Z" Ver<br>
sion="2.0"><br>
<saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:wellfleetsoftware:wellgeo-regrep</saml2:Issuer><br>
<ds:Signature xmlns:ds=<a moz-do-not-send="true"
class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2000/09/xmldsig#">"http://www.w3.org/2000/09/xmldsig#"</a>><br>
<ds:SignedInfo><br>
<ds:CanonicalizationMethod Algorithm=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/10/xml-exc-c14n#">"http://www.w3.org/2001/10/xml-exc-c14n#"</a>/><br>
<ds:SignatureMethod Algorithm=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">"http://www.w3.org/2000/09/xmldsig#rsa-sha1"</a>/><br>
<ds:Reference
URI="#a4jd9a3fceg3e34g2a672dadf06aa3j"><br>
<ds:Transforms><br>
<ds:Transform Algorithm=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">"http://www.w3.org/2000/09/xmldsig#enveloped-signature"</a>/><br>
<ds:Transform Algorithm=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/10/xml-exc-c14n#">"http://www.w3.org/2001/10/xml-exc-c14n#"</a>/><br>
</ds:Transforms><br>
<ds:DigestMethod Algorithm=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2000/09/xmldsig#sha1">"http://www.w3.org/2000/09/xmldsig#sha1"</a>/><br>
<ds:DigestValue>8t6ByS9NYUFwk500JlT2dqOkBsY=</ds:DigestValue><br>
</ds:Reference><br>
</ds:SignedInfo><br>
<ds:SignatureValue>OWtHzd6PdJbcEbYGWJhlTjsDwg7eJRRPZj8cUCEGedaTineVDU3qt8zYFQZPnMy1xuodgjZbmEpIE03/W+E5i96vA6LWI8AkNHPiH<br>
ImeeT79JbMXvo10dHwmHGlYMLGP6EBRaWUY9NFG2L6YZEnC6VtLfFIe5ublT+CyFQmpb/nhvnSCcu+94ytUg6Q8ErkFO+huA1vlrrHfvqymd64+wv3FqL2sVQVhvoPDfUfZv<br>
9IuFdopX81eHCej9ai6IaL9/fXyAQDJxhWSrpy7YF5N3RQQW5fS73l06pg0nmNmb61w+FqpdS12BENA//oeumZN6d+CD6SjsqvzAh22qouyBg==</ds:SignatureValue><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><b>MIIDUjCCAj....</b></ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
....<br>
<br>
-----------------------End <b>ArtifactResolve</b> request message
in IdP --------------------------<br>
<br>
-----------------------Begin <b>ArtifactResponse</b> message in
IdP --------------------------<br>
<?xml version="1.0" encoding="UTF-8"?><soap11:Envelope
xmlns:soap11=<a moz-do-not-send="true"
class="moz-txt-link-rfc2396E"
href="http://schemas.xmlsoap.org/soap/envelope/">"http://schemas.xmlsoap.org/soap/envelope/"</a>><br>
<soap11:Body><br>
<saml2p:ArtifactResponse
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
ID="_627a6951cf8c38ea13b755b8e033077a"
InResponseTo="a4jd9a3fceg3e34g2a672dadf06aa3j"
IssueInstant="2013-05-23T14:01:16.292Z" Version="2.0"><br>
<saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"><a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://wellfleet1.wellfleetsoftware.com:9443/idp/shibboleth">https://wellfleet1.wellfleetsoftware.com:9443/idp/shibboleth</a></saml2:Issuer><br>
<saml2p:Status><br>
<saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/><br>
</saml2p:Status><br>
<saml2p:Response
ID="_eea41e50eb8b66c688d618c949343b43"
InResponseTo="a2aj02h8c03i8idg3g3f09c762668c5"
IssueInstant="2013-05-23T14:01:15.917Z" Version="2.0"><br>
<saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"><a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://wellfleet1.wellfleetsoftware.com:9443/idp/shibboleth">https://wellfleet1.wellfleetsoftware.com:9443/idp/shibboleth</a></saml2:Issuer><br>
<saml2p:Status><br>
<saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/><br>
</saml2p:Status><br>
<saml2:EncryptedAssertion
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br>
<xenc:EncryptedData xmlns:xenc=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmlenc#">"http://www.w3.org/2001/04/xmlenc#"</a>
Id="_24afbdf7a315e9502d568bce606a2496" Type=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmlenc#Element">"http://www.w3.org/2001/04/xmlenc#Element"</a>><br>
<xenc:EncryptionMethod Algorithm=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmlenc#aes128-cbc">"http://www.w3.org/2001/04/xmlenc#aes128-cbc"</a>
xmlns:xenc=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmlenc#">"http://www.w3.org/2001/04/xmlenc#"</a>/><br>
<ds:KeyInfo xmlns:ds=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2000/09/xmldsig#">"http://www.w3.org/2000/09/xmldsig#"</a>><br>
<xenc:EncryptedKey
Id="_6a58851feaaef986005b7e4a4dd86022" xmlns:xenc=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmlenc#">"http://www.w3.org/2001/04/xmlenc#"</a>><br>
<xenc:EncryptionMethod Algorithm=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">"http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"</a>
xmlns:xenc=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmlenc#">"http://www.w3.org/2001/04/xmlenc#"</a>><br>
<ds:DigestMethod Algorithm=<a
moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2000/09/xmldsig#sha1">"http://www.w3.org/2000/09/xmldsig#sha1"</a>
xmlns:ds=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2000/09/xmldsig#">"http://www.w3.org/2000/09/xmldsig#"</a>/><br>
</xenc:EncryptionMethod><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><b>MIIDUjCCAj....</b></ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
-----------------------End <b>ArtifactResponse</b> message in
IdP --------------------------<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Regards,
Farrukh Najmi
Web: <a class="moz-txt-link-freetext" href="http://www.wellfleetsoftware.com">http://www.wellfleetsoftware.com</a>
</pre>
</body>
</html>