<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D;}
h1
{mso-style-priority:9;
mso-style-link:"Heading 1 Char";
margin-top:24.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:14.0pt;
font-family:"Cambria","serif";
color:#365F91;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
margin-top:10.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:13.0pt;
font-family:"Cambria","serif";
color:#4F81BD;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
margin-top:10.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:11.0pt;
font-family:"Cambria","serif";
color:#4F81BD;}
h4
{mso-style-priority:9;
mso-style-link:"Heading 4 Char";
margin-top:10.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:11.0pt;
font-family:"Cambria","serif";
color:#4F81BD;
font-style:italic;}
h5
{mso-style-priority:9;
mso-style-link:"Heading 5 Char";
margin-top:10.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:11.0pt;
font-family:"Cambria","serif";
color:#243F60;
font-weight:normal;}
h6
{mso-style-priority:9;
mso-style-link:"Heading 6 Char";
margin-top:10.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:11.0pt;
font-family:"Cambria","serif";
color:#243F60;
font-weight:normal;
font-style:italic;}
p.MsoHeading7, li.MsoHeading7, div.MsoHeading7
{mso-style-priority:9;
mso-style-link:"Heading 7 Char";
margin-top:10.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:11.0pt;
font-family:"Cambria","serif";
color:#404040;
font-style:italic;}
p.MsoHeading8, li.MsoHeading8, div.MsoHeading8
{mso-style-priority:9;
mso-style-link:"Heading 8 Char";
margin-top:10.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:10.0pt;
font-family:"Cambria","serif";
color:#4F81BD;}
p.MsoHeading9, li.MsoHeading9, div.MsoHeading9
{mso-style-priority:9;
mso-style-link:"Heading 9 Char";
margin-top:10.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:10.0pt;
font-family:"Cambria","serif";
color:#404040;
font-style:italic;}
p.MsoCaption, li.MsoCaption, div.MsoCaption
{mso-style-priority:35;
margin:0in;
margin-bottom:.0001pt;
font-size:9.0pt;
font-family:"Calibri","sans-serif";
color:#4F81BD;
font-weight:bold;}
p.MsoTitle, li.MsoTitle, div.MsoTitle
{mso-style-priority:10;
mso-style-link:"Title Char";
margin-top:0in;
margin-right:0in;
margin-bottom:15.0pt;
margin-left:0in;
mso-add-space:auto;
border:none;
padding:0in;
font-size:26.0pt;
font-family:"Cambria","serif";
color:#17365D;
letter-spacing:.25pt;}
p.MsoTitleCxSpFirst, li.MsoTitleCxSpFirst, div.MsoTitleCxSpFirst
{mso-style-priority:10;
mso-style-link:"Title Char";
mso-style-type:export-only;
margin:0in;
margin-bottom:.0001pt;
mso-add-space:auto;
border:none;
padding:0in;
font-size:26.0pt;
font-family:"Cambria","serif";
color:#17365D;
letter-spacing:.25pt;}
p.MsoTitleCxSpMiddle, li.MsoTitleCxSpMiddle, div.MsoTitleCxSpMiddle
{mso-style-priority:10;
mso-style-link:"Title Char";
mso-style-type:export-only;
margin:0in;
margin-bottom:.0001pt;
mso-add-space:auto;
border:none;
padding:0in;
font-size:26.0pt;
font-family:"Cambria","serif";
color:#17365D;
letter-spacing:.25pt;}
p.MsoTitleCxSpLast, li.MsoTitleCxSpLast, div.MsoTitleCxSpLast
{mso-style-priority:10;
mso-style-link:"Title Char";
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:15.0pt;
margin-left:0in;
mso-add-space:auto;
border:none;
padding:0in;
font-size:26.0pt;
font-family:"Cambria","serif";
color:#17365D;
letter-spacing:.25pt;}
p.MsoSubtitle, li.MsoSubtitle, div.MsoSubtitle
{mso-style-priority:11;
mso-style-link:"Subtitle Char";
margin:0in;
margin-bottom:.0001pt;
line-height:115%;
font-size:12.0pt;
font-family:"Cambria","serif";
color:#4F81BD;
letter-spacing:.75pt;
font-style:italic;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
line-height:115%;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:#1F497D;}
p.MsoNoSpacing, li.MsoNoSpacing, div.MsoNoSpacing
{mso-style-name:"No Spacing\,Code-Inline";
mso-style-priority:1;
mso-style-link:"No Spacing Char\,Code-Inline Char";
margin:0in;
margin-bottom:.0001pt;
font-size:9.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D;}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D;}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D;}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:115%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#1F497D;}
p.MsoQuote, li.MsoQuote, div.MsoQuote
{mso-style-priority:29;
mso-style-link:"Quote Char";
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
background:#F2F2F2;
border:none;
padding:0in;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#404040;}
p.MsoIntenseQuote, li.MsoIntenseQuote, div.MsoIntenseQuote
{mso-style-priority:30;
mso-style-link:"Intense Quote Char";
margin-top:10.0pt;
margin-right:.65in;
margin-bottom:14.0pt;
margin-left:.65in;
line-height:115%;
border:none;
padding:0in;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:#4F81BD;
font-weight:bold;
font-style:italic;}
span.MsoSubtleEmphasis
{mso-style-priority:19;
color:gray;
font-style:italic;}
span.MsoIntenseEmphasis
{mso-style-priority:21;
color:#4F81BD;
font-weight:bold;
font-style:italic;}
span.MsoSubtleReference
{mso-style-priority:31;
font-variant:small-caps;
color:#C0504D;
text-decoration:underline;}
span.MsoIntenseReference
{mso-style-priority:32;
font-variant:small-caps;
color:#C0504D;
letter-spacing:.25pt;
font-weight:bold;
text-decoration:underline;}
span.MsoBookTitle
{mso-style-priority:33;
font-variant:small-caps;
letter-spacing:.25pt;
font-weight:bold;}
p.MsoTocHeading, li.MsoTocHeading, div.MsoTocHeading
{mso-style-priority:39;
margin-top:24.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
line-height:115%;
page-break-after:avoid;
font-size:14.0pt;
font-family:"Cambria","serif";
color:#365F91;
font-weight:bold;}
p.Code, li.Code, div.Code
{mso-style-name:Code;
mso-style-link:"Code Char";
margin:0in;
margin-bottom:.0001pt;
line-height:115%;
font-size:9.0pt;
font-family:"Courier New";
color:black;}
span.QuoteChar
{mso-style-name:"Quote Char";
mso-style-priority:29;
mso-style-link:Quote;
color:#404040;
background:#F2F2F2;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.Heading1Char
{mso-style-name:"Heading 1 Char";
mso-style-priority:9;
mso-style-link:"Heading 1";
font-family:"Cambria","serif";
color:#365F91;
font-weight:bold;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Cambria","serif";
color:#4F81BD;
font-weight:bold;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Cambria","serif";
color:#4F81BD;
font-weight:bold;}
span.Heading4Char
{mso-style-name:"Heading 4 Char";
mso-style-priority:9;
mso-style-link:"Heading 4";
font-family:"Cambria","serif";
color:#4F81BD;
font-weight:bold;
font-style:italic;}
span.Heading5Char
{mso-style-name:"Heading 5 Char";
mso-style-priority:9;
mso-style-link:"Heading 5";
font-family:"Cambria","serif";
color:#243F60;}
span.Heading6Char
{mso-style-name:"Heading 6 Char";
mso-style-priority:9;
mso-style-link:"Heading 6";
font-family:"Cambria","serif";
color:#243F60;
font-style:italic;}
span.Heading7Char
{mso-style-name:"Heading 7 Char";
mso-style-priority:9;
mso-style-link:"Heading 7";
font-family:"Cambria","serif";
color:#404040;
font-style:italic;}
span.Heading8Char
{mso-style-name:"Heading 8 Char";
mso-style-priority:9;
mso-style-link:"Heading 8";
font-family:"Cambria","serif";
color:#4F81BD;}
span.Heading9Char
{mso-style-name:"Heading 9 Char";
mso-style-priority:9;
mso-style-link:"Heading 9";
font-family:"Cambria","serif";
color:#404040;
font-style:italic;}
span.TitleChar
{mso-style-name:"Title Char";
mso-style-priority:10;
mso-style-link:Title;
font-family:"Cambria","serif";
color:#17365D;
letter-spacing:.25pt;}
span.SubtitleChar
{mso-style-name:"Subtitle Char";
mso-style-priority:11;
mso-style-link:Subtitle;
font-family:"Cambria","serif";
color:#4F81BD;
letter-spacing:.75pt;
font-style:italic;}
span.IntenseQuoteChar
{mso-style-name:"Intense Quote Char";
mso-style-priority:30;
mso-style-link:"Intense Quote";
color:#4F81BD;
font-weight:bold;
font-style:italic;}
p.QuoteBlock, li.QuoteBlock, div.QuoteBlock
{mso-style-name:QuoteBlock;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
background:#F2F2F2;
border:none;
padding:0in;
font-size:10.0pt;
font-family:"Calibri","sans-serif";
color:#404040;}
span.NoSpacingChar
{mso-style-name:"No Spacing Char\,Code-Inline Char";
mso-style-priority:1;
mso-style-link:"No Spacing\,Code-Inline";
font-family:"Courier New";}
span.CodeChar
{mso-style-name:"Code Char";
mso-style-link:Code;
font-family:"Courier New";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;}
.MsoPapDefault
{mso-style-type:export-only;
margin-bottom:10.0pt;
line-height:115%;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:windowtext">Greetings,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">Note that I have moderate understanding of SP configuration and basically no understanding of IdP configurations.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">Running a hosted SAAS with option to interface with various Shibboleth IdPs for user authentication. Each server in the hosting environment has Shibboleth SP installed (Windows x64). Multiple Shibboleth customers
may be hosted on the same server (using Host Mapping and Application Override sections).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">A particular IdP integration is causing some issues for us. After the user enters their credentials on the IdP, they are returned to our hosted solution. Following error is logged in shibd_warn:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">2013-05-14 15:54:29 ERROR XMLTooling.TrustEngine.PKIX [76]: certificate name was not acceptable<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">2013-05-14 15:54:29 ERROR XMLTooling.SOAPTransport.CURL [76]: supplied TrustEngine failed to validate SSL/TLS server certificate<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">2013-05-14 15:54:29 ERROR Shibboleth.AttributeResolver.Query [76]: exception during SAML query to https://xxxxxxx/idp/profile/SAML2/SOAP/AttributeQuery: CURLSOAPTransport failed while contacting SOAP endpoint
(https://xxxxxxx/idp/profile/SAML2/SOAP/AttributeQuery): SSL certificate problem, verify that the CA cert is OK. Details:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">2013-05-14 15:54:29 ERROR Shibboleth.AttributeResolver.Query [76]: unable to obtain a SAML response from attribute authority<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">The client believes this has something to do with us having a gap in our trust chain of the certificate in use on their https connection and is not connected to the certificate used in the metadata (which,
incidentally, seems to match between the SP and the IdP, but I’m not certain I know the proper way to verify that). That seems strange to me, but all told it might be a non-issue; I’m not certain what is causing us to query for attributes—shouldn’t we be getting
those back when the client is returned to us? What might prevent that from occurring?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">I’m unfortunately not knowledgeable enough to troubleshoot this particular issue, so any handholding here would be appreciated. =]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">--<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">Pete Scott</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>