<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>Hello, </div>
<div><br>
</div>
<div>I have an SP that’s up and running with 4 IdPs, and everything’s good. We have a new IdP that wants to join, but when they send their assertion, we get a message saying:</div>
<div>Unable to establish security of incoming assertion</div>
<div><br>
</div>
<div>And it’s because:</div>
<div><span style="font-family: Calibri; font-size: medium;">2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: public key did not validate signature: Digital signature does not validate with the supplied key.</span></div>
<div><br>
</div>
<div>
<div><b>Here’s the relevant portion of the shibd.log file:</b></div>
<div style="font-family: Calibri; font-size: medium;">
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [9]: validating signature profile</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: attempting to validate signature with the peer's credentials</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: public key did not validate signature: Digital signature does not validate with the supplied key.</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: no peer credentials validated the signature</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: validating signature using certificate from within the signature</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: Digital signature does not validate with the supplied key.</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: failed to verify signature with embedded certificates</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [9]: unable to verify message signature with supplied trust engine</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG Shibboleth.SSO.SAML2 [9]: processing message against SAML 2.0 SSO profile</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG Shibboleth.SSO.SAML2 [9]: extracting issuer from SAML 2.0 assertion</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [9]: evaluating message flow policy (replay checking on, expiration 60)</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG XMLTooling.StorageService [9]: inserted record (c75f7ca4-a232-419b-bbd3-5a60dd11a6c5) in context (MessageFlow) with expiration (1392820357)</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [9]: assertion satisfied bearer confirmation requirements</font></div>
<div><font face="Calibri,sans-serif">2014-02-19 09:28:45 WARN Shibboleth.SSO.SAML2 [9]: detected a problem with assertion: Unable to establish security of incoming assertion.</font></div>
</div>
<div style="font-family: Calibri; font-size: medium;"><font face="Calibri,sans-serif"><br>
</font></div>
<div>The client swears up and down that the signature is valid, but <font face="Calibri,sans-serif">I</font><font face="Calibri">’<font face="Calibri,sans-serif">m not too familiar with how the signature stuff works.</font></font></div>
<div style="font-family: Calibri; font-size: medium;"><br>
</div>
<div style="font-family: Calibri; font-size: medium;">Do you have any suggestions on:</div>
<ol style="font-family: Calibri; font-size: medium;">
<li>How can I validate the signature myself?</li><li>Is there any configuration I can do to get the signature verified?</li><li>Any thoughts on what I can do next?</li><li>Are they using a signature method that Shibboleth doesn’t like?</li></ol>
</div>
<div>Thanks for your help, </div>
<div>Jim</div>
<div><br>
</div>
<div><br>
</div>
<div><b>In case it matters, the client wants to post an unsolicited assertion from a simple webpage like this:</b></div>
<div>
<div><<script>window.onload = function() { document.forms[0].submit(); }</script></div>
<div><html></div>
<div> <form action="<a href="https://myserver.com/Shibboleth.sso/SAML2/POST">https://myserver.com/Shibboleth.sso/SAML2/POST</a>" method="post"></div>
<div> <span class="Apple-tab-span" style="white-space: pre;"></span><input type="hidden" name="applicationId" value=“myapp" /></div>
<div> <span class="Apple-tab-span" style="white-space: pre;"></span><input type="hidden" name="entityID" value=“myentity" /></div>
<div> <span class="Apple-tab-span" style="white-space: pre;"></span><input type="hidden" name="RelayState" value=“myCustomUrl" /> </div>
<div> <input type="hidden" name="SAMLResponse" value=“[A base64 encoded message]" /></div>
<div> </form></div>
<div> </div>
<div></html></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><b>Here’s the full log in case it’s useful:</b></div>
<div>
<div>2014-02-19 09:28:45 DEBUG Shibboleth.Listener [9]: dispatching message (default/SAML2/POST)</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2POST [9]: validating input</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2POST [9]: decoded SAML message:</div>
<div><br>
</div>
<div><saml2p:Response Destination="<a href="https://myserver.com/Shibboleth.sso/SAML2/POST">https://myserver.com/Shibboleth.sso/SAML2/POST</a>"</div>
<div> ID="324bbbee-53dd-493b-9803-8ff29929a985"</div>
<div> IssueInstant="2014-02-19T14:28:37Z"</div>
<div> Version="2.0"</div>
<div> xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"</div>
<div> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div>
<div> ></div>
<div> <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"</div>
<div> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div>
<div> >myentityID</saml2:Issuer></div>
<div> <saml2p:Status></div>
<div> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></div>
<div> </saml2p:Status></div>
<div> <saml2:Assertion ID="c75f7ca4-a232-419b-bbd3-5a60dd11a6c5"</div>
<div> IssueInstant="2014-02-19T14:28:37"</div>
<div> Version="2.0"</div>
<div> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"</div>
<div> ></div>
<div> <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity”> myentityID</saml2:Issuer></div>
<div> <saml2:Subject></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> <saml2:NameID</div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> <span class="Apple-tab-span" style="white-space: pre;">
</span><a href="mailto:joe@smith.com">joe@smith.com</a></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> </saml2:NameID></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><saml2:SubjectConfirmation</div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span>Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><saml2:SubjectConfirmationData</div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span>Recipient="<a href="https://myserver.com/Shibboleth.sso/SAML2/POST">https://myserver.com/Shibboleth.sso/SAML2/POST</a>" </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span>NotOnOrAfter="2014-02-19T14:48:37Z"</div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span>/></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></saml2:SubjectConfirmation></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></saml2:Subject></div>
<div> <saml2:AuthnStatement AuthnInstant="2014-02-19T14:28:37Z"></div>
<div> <saml2:AuthnContext></div>
<div> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></div>
<div> </saml2:AuthnContext></div>
<div> </saml2:AuthnStatement></div>
<div> <saml2:AttributeStatement></div>
<div> <saml2:Attribute Name="COMPANYID"</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"</div>
<div> ></div>
<div> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div>
<div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div>
<div> >144</saml2:AttributeValue></div>
<div> </saml2:Attribute></div>
<div> <saml2:Attribute Name="persistent-id"</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"</div>
<div> ></div>
<div> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div>
<div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</div>
<div> ><a href="mailto:joe@smith.com">joe@smith.com</a></saml2:AttributeValue></div>
<div> </saml2:Attribute></div>
<div> </saml2:AttributeStatement></div>
<div> </saml2:Assertion></div>
<div> </div>
<div> <Signature xmlns="<a href="http://www.w3.org/2000/09/xmldsig#"">http://www.w3.org/2000/09/xmldsig#"</a>></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><SignedInfo></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><CanonicalizationMethod Algorithm="<a href="http://www.w3.org/TR/2001/REC-xml-c14n-20010315">http://www.w3.org/TR/2001/REC-xml-c14n-20010315</a>" /> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>" /> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><Reference URI=""></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><Transforms></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>" /> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></Transforms></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>" /> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><DigestValue>BRIbSP7q4VxG5/sPllz4Xi+NIoM=</DigestValue> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></Reference></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></SignedInfo></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><SignatureValue>QJcEG/kZxINORad9pprp4+LCaw8EUYM5PtqdwyzUY1o1WCuUDkKXqGSMcCYLJPAx+k6xTGd8cyRwYch2/mPrlmfkrt42BYRyYI+YixIeQqbG4JfcArda7N1jCk/Ak/rBSK3e6MC+Ll74H62P4oCCvsuMXhx6ceFXTMn6AIRw1lU=</SignatureValue> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><KeyInfo></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><X509Data></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><X509Certificate>MIIB/TCCAWqgAwIBAgIQJfGyh4Sm76xCGw7IjeYfyTAJBgUrDgMCHQUAMBkxFzAVBgNVBAMTDmludC5zYy5tdWZnLmpwMB4XDTEyMDEwMjAwMDAwMFoXDTIyMDEwMjAwMDAwMFowGTEXMBUGA1UEAxMOaW50LnNjLm11ZmcuanAwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMfxjpGrzF+7+RQljEIMNf7k5Z+6gmqXsRlZkreKCgUHcnUcy64k3h0a4jR1ZMJCOdqg6guiByj+O1QS+ZHORfimGfsDkCDBgUXQgEFtrwyQZ0d/9/EDAQ7lTt3lgvoeK/brWvLt4hkjLCxw/mwh1XgRtzM0RE3Cduied/ZeFuhLAgMBAAGjTjBMMEoGA1UdAQRDMEGAEDoHSUgUNl6mzGHaVednaL+hGzAZMRcwFQYDVQQDEw5pbnQuc2MubXVmZy5qcIIQJfGyh4Sm76xCGw7IjeYfyTAJBgUrDgMCHQUAA4GBAATJQ1tC1EDHkB3DevkgOMXKBuEq3b2iA90j9jUtr2Vwuw08mv4VT8yQzly6UueUjm5t4i8V1z1uGX6euTFuS4VTUKogrGoDR2/cKIaQACjmYJYFkUFX4ZNgQm7x4qI71u8BwGP5JJVP98wU5dhaSkEa9zr7YuxKIafoMCPAiSTz</X509Certificate> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></X509Data></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></KeyInfo></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></Signature></div>
<div></saml2p:Response></div>
<div><br>
</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject.Builder [9]: located XMLObjectBuilder for element name: saml2p:Response</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling DOM element (saml2p:Response)</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling attributes for DOM element (saml2p:Response)</div>
<div>[… Generic unmarshalling messages …]</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject.Builder [9]: located XMLObjectBuilder for element name: {<a href="http://www.w3.org/2000/09/xmldsig#}Signature">http://www.w3.org/2000/09/xmldsig#}Signature</a></div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling child element ({<a href="http://www.w3.org/2000/09/xmldsig#}Signature">http://www.w3.org/2000/09/xmldsig#}Signature</a>)</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject.Signature [9]: unmarshalling ds:Signature</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: processing text content at position (4)</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2 [9]: extracting issuer from SAML 2.0 protocol message</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject.Builder [9]: located XMLObjectBuilder for element name: saml2:Issuer</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling DOM element (saml2:Issuer)</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling attributes for DOM element (saml2:Issuer)</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: processing generic attribute</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: found namespace declaration, adding it to the list of namespaces on the XMLObject</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: unmarshalling child nodes of DOM element (saml2:Issuer)</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.XMLObject [9]: processing text content at position (0)</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2 [9]: message from (myEntity)</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.MessageDecoder.SAML2 [9]: searching metadata for message issuer...</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [9]: evaluating message flow policy (replay checking on, expiration 60)</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.StorageService [9]: inserted record (324bbbee-53dd-493b-9803-8ff29929a985) in context (MessageFlow) with expiration (1392820357)</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [9]: validating signature profile</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: attempting to validate signature with the peer's credentials</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: public key did not validate signature: Digital signature does not validate with the supplied key.</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.ExplicitKey [9]: no peer credentials validated the signature</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: validating signature using certificate from within the signature</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: Digital signature does not validate with the supplied key.</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.TrustEngine.PKIX [9]: failed to verify signature with embedded certificates</div>
<div>2014-02-19 09:28:45 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [9]: unable to verify message signature with supplied trust engine</div>
<div>2014-02-19 09:28:45 DEBUG Shibboleth.SSO.SAML2 [9]: processing message against SAML 2.0 SSO profile</div>
<div>2014-02-19 09:28:45 DEBUG Shibboleth.SSO.SAML2 [9]: extracting issuer from SAML 2.0 assertion</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [9]: evaluating message flow policy (replay checking on, expiration 60)</div>
<div>2014-02-19 09:28:45 DEBUG XMLTooling.StorageService [9]: inserted record (c75f7ca4-a232-419b-bbd3-5a60dd11a6c5) in context (MessageFlow) with expiration (1392820357)</div>
<div>2014-02-19 09:28:45 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [9]: assertion satisfied bearer confirmation requirements</div>
<div>2014-02-19 09:28:45 WARN Shibboleth.SSO.SAML2 [9]: detected a problem with assertion: Unable to establish security of incoming assertion.</div>
</div>
</div>
<div><br>
</div>
<HR>This e-mail may contain information that is privileged, confidential or protected under state or federal law. If you are not an intended recipient of this email, please delete it, notify the sender immediately, and do not copy, use or disseminate any information in the e-mail. Pursuant to IRS Circular 230, any tax advice in this email may not be used to avoid any penalties imposed under U.S. tax laws. E-mail sent to or from this e-mail address may be monitored, reviewed and archived.<BR>
</body>
</html>