<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Mike,</div>
<div><br>
</div>
<div>That's your configuration, not what the IdP is saying is the error. While you're getting back a SAML error message, it's likely that the IdP has more detailed information about exactly what they didn't like to generate that message. You need to trace the
flow of what's happening here. You've repeatedly stated that nothing has changed on your side, so prove it. You're signing the requests as indicated by your configuration. Capture the actual SAML AuthnRequest sent to that IdP. Verify the signature using a
tool against the key that you believe to be used. That's a pretty simple check. The stuff going over the wire never lies.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Mike Flynn <<a href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Monday, August 12, 2013 2:24 PM<br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: Yet another Idp error after SP upgrade<br>
</div>
<div><br>
</div>
<div>
<div>
<div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt">
<div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"><span>It varies depending on the IDp but it looks like authN signing is not working...</span></div>
<div style="font-family: arial, helvetica, sans-serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">
<span><br>
</span></div>
<div style="font-family: arial, helvetica, sans-serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">
<span>In my config I have this:</span></div>
<div style="font-family: arial, helvetica, sans-serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;">
<span><br>
</span></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space: pre;"></span><RelyingParty Name="usjoneslanglasalle:default:entityid" signing ="true"/></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"></span><RelyingParty Name="MWG:PRO:Lynda:SAML2:IdP" signing ="true"/></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"></span><RelyingParty Name="<a href="https://fed.erau.edu/fed/idp">https://fed.erau.edu/fed/idp</a>" signing ="true"/></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"></span><RelyingParty Name="<a href="http://adfs.engauge.com/adfs/services/trust">http://adfs.engauge.com/adfs/services/trust</a>" signing ="true"/></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"></span><RelyingParty Name="<a href="http://login.oliverwymangroup.com/adfs/services/trust">http://login.oliverwymangroup.com/adfs/services/trust</a>" signing ="true"/><span class="Apple-tab-span" style="white-space:pre"></span> </div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"></span><RelyingParty Name="<a href="https://adfs.gmcr.com/adfs/services/trust">https://adfs.gmcr.com/adfs/services/trust</a>" signing ="true"/></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"></span><RelyingParty Name="<a href="http://studentfs.studygroup.com/adfs/services/trust">http://studentfs.studygroup.com/adfs/services/trust</a>" signing ="true"/></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"></span><RelyingParty Name="<a href="http://fs.dolby.com/adfs/services/trust">http://fs.dolby.com/adfs/services/trust</a>" signing ="true"/></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space:pre"></span><RelyingParty Name="ping.mbopartners.com:saml2" signing ="true"/></div>
<div style="background-color: transparent;"><span></span></div>
<div style="background-color: transparent;"><span class="Apple-tab-span" style="white-space: pre;"></span><RelyingParty Name="localhost:default:entityId" signing ="true"/></div>
<div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: arial, helvetica, sans-serif; font-style: normal;">
<br>
</div>
<div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: arial, helvetica, sans-serif; font-style: normal;">
Worked fine on the old system and shibd -check does not complain about them...</div>
<div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br>
</div>
<div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;">
<div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;">
<div dir="ltr">
<hr size="1">
<font size="2" face="Arial"><b><span style="font-weight:bold;">From:</span></b> Paul Hethmon <<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a>><br>
<b><span style="font-weight: bold;">To:</span></b> Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>>
<br>
<b><span style="font-weight:
bold;">Sent:</span></b> Monday, August 12, 2013 11:16 AM<br>
<b><span style="font-weight: bold;">Subject:</span></b> Re: Yet another Idp error after SP upgrade<br>
</font></div>
<div class="y_msg_container"><br>
<div id="yiv2344532424">
<div>
<div>Have you asked the IdP for the details of the error they are sending you? Perhaps that would help find the source.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<div><span style="font-family: Calibri; font-size: 11pt; text-align: left; font-weight: bold;"><br>
</span></div>
<div><span style="font-family: Calibri; font-size: 11pt; text-align: left; font-weight: bold;">From:
</span><span style="font-family: Calibri; font-size: 11pt; text-align: left;">Mike Flynn <</span><a rel="nofollow" ymailto="mailto:shibbolethlynda@yahoo.com" target="_blank" href="mailto:shibbolethlynda@yahoo.com" style="font-family: Calibri; font-size: 11pt; text-align: left;">shibbolethlynda@yahoo.com</a><span style="font-family: Calibri; font-size: 11pt; text-align: left;">></span></div>
<span id="yiv2344532424OLK_SRC_BODY_SECTION">
<div style="font-family: Calibri; font-size: 11pt; text-align: left; color: black; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);">
<span style="font-weight:bold;">Reply-To: </span>Shibboleth Users <<a rel="nofollow" ymailto="mailto:users@shibboleth.net" target="_blank" href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold;">Date: </span>Monday, August 12, 2013 2:14 PM<br>
<span style="font-weight:bold;">To: </span>Shibboleth Users <<a rel="nofollow" ymailto="mailto:users@shibboleth.net" target="_blank" href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold;">Subject: </span>Re: Yet another Idp error after SP upgrade<br>
</div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px;">
<span>Well, you folks are saying that I changed an entityID etc to cause this error - but like I said - I copied etc verbatim. No change.... Only certain IDps are failing (and still failing now). In the logs I am getting things like this:</span></div>
<br class="yiv2344532424Apple-interchange-newline">
</span></div>
</div>
<br>
--<br>
To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>