<div dir="ltr"><div><div><div><div><div><div><div><div><div><br></div>I believe this has been discussed on this list previously.<br>However, there seems to be disagreement on the solution tasks.<br><br></div>We're the SP in this equation, our customer is the <span style="background:none repeat scroll 0% 0% yellow" class="">IdP</span> side.<br>
</div>When people reach our product site, they are redirected to the Shibboleth Challenge Page (a.k.a. <span style="background:none repeat scroll 0% 0% yellow" class="">Login</span> Page) of the Customer.<br><br></div><div>
So far so good.<br></div><div><br></div>However, after entering User/Pass this error appears in the Browser and in the <span style="background:none repeat scroll 0% 0% yellow" class="">Shib</span> Logs:<br><br></div>Browser Error:<br>
<br><span style="background:none repeat scroll 0% 0% yellow" class="">opensaml</span>::<span style="background:none repeat scroll 0% 0% yellow" class="">FatalProfileException</span><br><br><span style="background:none repeat scroll 0% 0% yellow" class="">opensaml</span>::<span style="background:none repeat scroll 0% 0% yellow" class="">FatalProfileException</span> at (<a href="https://corp.com/customer0102/Shibboleth">https://corp.com/customer0102/Shibboleth</a>.<span style="background:none repeat scroll 0% 0% yellow" class="">sso</span>/SAML2/POST)<br>
<br>Message was signed, but signature could not be verified.<br><br><br><br></div><div>From the SP-side logs:<br><br></div><br></div>From <span style="background:none repeat scroll 0% 0% yellow" class="">Shibd</span>.log:<br>
<br>2014-04-22 20:48:32 DEBUG <span style="background:none repeat scroll 0% 0% yellow" class="">OpenSAML</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">SecurityPolicyRule</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">XMLSigning</span> [1]: validating signature profile<br>
2014-04-22 20:48:32 DEBUG <span style="background:none repeat scroll 0% 0% yellow" class="">XMLTooling</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">KeyInfoResolver</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">Inline</span> [1]: resolving <span style="background:none repeat scroll 0% 0% yellow" class="">ds</span>:X509Certificate<br>
2014-04-22 20:48:32 DEBUG <span style="background:none repeat scroll 0% 0% yellow" class="">XMLTooling</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">KeyInfoResolver</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">Inline</span> [1]: resolved 1 certificate(s)<br>
2014-04-22 20:48:32 DEBUG <span style="background:none repeat scroll 0% 0% yellow" class="">XMLTooling</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">KeyInfoResolver</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">Inline</span> [1]: resolved 0 <span style="background:none repeat scroll 0% 0% yellow" class="">CRL</span>(s)<br>
2014-04-22 20:48:32 ERROR <span style="background:none repeat scroll 0% 0% yellow" class="">OpenSAML</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">SecurityPolicyRule</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">XMLSigning</span> [1]: unable to verify message signature with supplied trust engine<br>
2014-04-22 20:48:32 WARN Shibboleth.<span style="background:none repeat scroll 0% 0% yellow" class="">SSO</span>.SAML2 [1]: detected a problem with assertion: Message was signed, but signature could not be verified.<br><br>
<br>From <span style="background:none repeat scroll 0% 0% yellow" class="">Shibd</span>_warn.log:<br><br>2014-04-22 20:48:32 ERROR <span style="background:none repeat scroll 0% 0% yellow" class="">OpenSAML</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">SecurityPolicyRule</span>.<span style="background:none repeat scroll 0% 0% yellow" class="">XMLSigning</span> [2]: unable to verify message signature with supplied trust engine<br>
2014-04-22 20:48:32 WARN Shibboleth.<span style="background:none repeat scroll 0% 0% yellow" class="">SSO</span>.SAML2 [2]: detected a problem with assertion: Message was signed, but signature could not be verified<br><br>
<br><br><br>native.log: <br><br>2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: sending message (customer0102::<span style="background:none repeat scroll 0% 0% yellow" class="">getHeaders</span>::Application)<br>
2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: trying to connect to listener<br>2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: socket (59) connected successfully<br>
2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: send completed, reading response message<br>2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: sending message (customer0102/<span style="background:none repeat scroll 0% 0% yellow" class="">Login</span>::run::SAML2SI)<br>
2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: send completed, reading response message<br>2014-04-22 20:48:32 DEBUG Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: sending message (customer0102/SAML2/POST)<br>
2014-04-22 20:48:32 DEBUG Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: trying to connect to listener<br>2014-04-22 20:48:32 DEBUG Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: socket (56) connected successfully<br>
2014-04-22 20:48:32 DEBUG Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: send completed, reading response message<br>2014-04-22 20:48:32 ERROR Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: <span style="background:none repeat scroll 0% 0% yellow" class="">remoted</span> message returned an error: Message was signed, but signature could not be verified.<br>
2014-04-22 20:48:32 ERROR Shibboleth.Apache [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: Message was signed, but signature could not be verified.<br><br><br>native_warn.log: <br>
<br>2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: sending message (customer0102::<span style="background:none repeat scroll 0% 0% yellow" class="">getHeaders</span>::Application)<br>
2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: trying to connect to listener<br>2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: socket (59) connected successfully<br>
2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: send completed, reading response message<br>2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: sending message (customer0102/<span style="background:none repeat scroll 0% 0% yellow" class="">Login</span>::run::SAML2SI)<br>
2014-04-22 20:48:12 DEBUG Shibboleth.Listener [24441] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_check_user: send completed, reading response message<br>2014-04-22 20:48:32 DEBUG Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: sending message (customer0102/SAML2/POST)<br>
2014-04-22 20:48:32 DEBUG Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: trying to connect to listener<br>2014-04-22 20:48:32 DEBUG Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: socket (56) connected successfully<br>
2014-04-22 20:48:32 DEBUG Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: send completed, reading response message<br>2014-04-22 20:48:32 ERROR Shibboleth.Listener [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: <span style="background:none repeat scroll 0% 0% yellow" class="">remoted</span> message returned an error: Message was signed, but signature could not be verified.<br>
2014-04-22 20:48:32 ERROR Shibboleth.Apache [24446] <span style="background:none repeat scroll 0% 0% yellow" class="">shib</span>_handler: Message was signed, but signature could not be verified.<br><br><br></div>OK, so either our side is signing with the wrong key or the <span style="background:none repeat scroll 0% 0% yellow" class="">IdP</span> side is using the wrong key to decrypt. It all comes down to which side needs to change? Is there a deterministic method of determining which side is using the wrong key? What log at the <span style="background:none repeat scroll 0% 0% yellow" class="">IdP</span> side would we look at for that level of error?<br>
<br></div><div>Of course, we at the SP side currently have no issues with our other customers. I'm sure the admin team on the customer0102 side will say their <span style="background:none repeat scroll 0% 0% yellow" class="">IdP</span> is authenticating everyone just fine on their side too.<br>
<br></div><div>...<span style="background:none repeat scroll 0% 0% yellow" class="">asprin</span> just doesn't cut it sometimes...<br><br></div><div><br><br></div>Thanks so much in advance.<br><div><div><br><div><div>
<div><div><div><div><div><div>-- <span style="background:none repeat scroll 0% 0% yellow" class="">RGS</span><br><br>==================================<br>Roy G. Specter<br><a href="mailto:roygspectech8@gmail.com" target="_blank">roygspectech8@gmail.com</a><br>
========================================<br></div>
</div></div></div></div></div></div></div></div></div></div>