<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>All keys are back in place. I did that yesterday. I think the issue is indeed signed requests since I had a customer do an IDP initiated and that worked but SP init did not...</span></div><div><br></div> <div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> "Cantor, Scott" <cantor.2@osu.edu><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, August 12, 2013 11:26 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Yet another Idp error after SP upgrade<br> </font> </div>
<div class="y_msg_container"><br>On 8/12/13 2:14 PM, "Mike Flynn" <<a ymailto="mailto:shibbolethlynda@yahoo.com" href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> wrote:<br><br>>Well, you folks are saying that I changed an entityID etc to cause this<br>>error - but like I said - I copied etc verbatim. No change.... Only<br>>certain IDps are failing (and still<br>> failing now).<br><br>Then it couldn't have worked before, at least based on the errors claimed.<br>If it was a case of some kind of TLS stack issue, then sure, I could<br>imagine an upgrade causing something, but not audience errors or signed<br>redirect failures, or decryption failures.<br><br>>In the logs I am getting things like this:<br>><br>><br>>2013-08-12 08:46:44 ERROR OpenSAML.SOAPClient [7]: SOAP client detected a<br>>SAML error: (saml1p:Responder) (Message did not meet security<br>>requirements)<br>>2013-08-12
08:46:44 ERROR Shibboleth.AttributeResolver.Query [7]:<br>>attribute authority returned a SAML error<br><br>Also a sign the entityID or key changed, generally the latter.<br><br>You've already said at an earlier point in this thread that you had<br>multiple keys and removed one. I can't say when you did it, but it seems<br>like that's clearly the issue. I think you had both keys active,<br>apparently being used in special circumstances, and then you dropped one<br>and had IdPs stuck on old metadata (possibly due to their own malfeasance<br>in keeping metadata updated) and now it fails because you switched off the<br>old key.<br><br>That is the most straightforward change that explains most of this<br>behavior.<br><br>-- Scott<br><br><br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br></div> </div>
</div> </div></body></html>