<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi all,<br>
<br>
Newbie here.... be gentle :-)<br>
<br>
I have Shibboleth IdP v2.4 running and I can successfully log into
TestShib. We recently joined the InCommon Federation and I did the
steps they required (submitted our participation agreement,
protected Tomcat by getting a GeoTrust-issued SSL certificate, I
uploaded our new certificate and our metadata to InCommon, etc..).
but I am running into issues trying to make a connection to their
test SP located here<br>
<br>
<a class="moz-txt-link-freetext" href="https://service1.internet2.edu/test/">https://service1.internet2.edu/test/</a><br>
<br>
I get redirected to our local login page and after I successfully
authenticate against Active Directory I get the following error<br>
<br>
********************************************************<br>
opensaml::FatalProfileException<br>
<br>
The system encountered an error at Thu Oct 3 14:54:24 2013<br>
<br>
To report this problem, please contact the site administrator at
root@localhost.<br>
<br>
Please include the following message in any email:<br>
<br>
opensaml::FatalProfileException at
(<a class="moz-txt-link-freetext" href="https://service1.internet2.edu/Shibboleth.sso/SAML2/POST">https://service1.internet2.edu/Shibboleth.sso/SAML2/POST</a>)<br>
<br>
<b>Message was signed, but signature could not be verified.</b><br>
********************************************************<br>
<br>
I was told by an InCommon Tech that our configured signing key does
not match the certificate
in the metadata that we submitted. Taking a guess here, I think the
problem has to do with the following entry in our relying-party.xml
file<br>
<br>
---------------------------------------------------------------------------------<br>
<!-- ========================================== --><br>
<!-- Security Configurations --><br>
<!-- ========================================== --><br>
<security:Credential id="IdPCredential"
xsi:type="security:X509Filesystem"><br>
<security:PrivateKey>C:\Program Files
(x86)\Internet2\Shib2Idp/credentials/idp.key</security:PrivateKey><br>
<security:Certificate>C:\Program Files
(x86)\Internet2\Shib2Idp/credentials/idp.crt</security:Certificate><br>
</security:Credential><br>
----------------------------------------------------------------------------------<br>
<br>
The idp.key and idp.crt files look to be self signed certs that were
put in place when Shibboleth was installed. I "think" I need to
point the <security:PrivateKey> and
<security:Certificate> values at the keystore database file we
generated using the keytool.exe command along with the new SSL cert
that we bought from GeoTrust (which was based off the CSR generated
off of the keystore database). <br>
<br>
But...when I switch the above values to this<br>
<br>
-------------------------------------------------------------------------------------<br>
<!-- ========================================== --><br>
<!-- Security Configurations --><br>
<!-- ========================================== --><br>
<security:Credential id="IdPCredential"
xsi:type="security:X509Filesystem"><br>
<security:PrivateKey>C:\ssl\shib.wheatonma.edu.kdb</security:PrivateKey><br>
<security:Certificate>C:\ssl\shib_wheatonma_edu.p7s</security:Certificate><br>
</security:Credential><br>
--------------------------------------------------------------------------------------<br>
<br>
and stop/start Tomcat the IdP will not come up and in the
idp-process.log file I get the following<br>
<br>
--------------------------------------------------------------------------------------<br>
16:06:01.188 - ERROR
[edu.internet2.middleware.shibboleth.common.config.BaseService:188]
- Configuration was not loaded for
shibboleth.RelyingPartyConfigurationManager service, error creating
components. The root cause of this error was:
org.apache.commons.ssl.ProbablyNotPKCS8Exception: asn1 parse
failure: java.io.IOException: DER length more than 4 bytes<br>
---------------------------------------------------------------------------------------<br>
<br>
Any thoughts on where I am going wrong? Should I be separating the
certificates and use the GeoTrust one just for browser traffic
protection and use the self signed ones that came with Shibboleth as
the ones I submit to InCommon?<br>
<br>
Thanks<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
++++++++++++++++++++++++++++
Brian Gibson
Systems Administrator
Wheaton College
Are you a musician? If so visit my Arbans Online music site at
<a class="moz-txt-link-freetext" href="http://arbansonline.com">http://arbansonline.com</a> and listen & contribute
</pre>
</body>
</html>