<div dir="ltr"><div><div><div><div><div>Hello,<br><br></div>We have installed a Shibboleth IdP (version 2.4.4) following this procedure:<br><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall"><br>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall</a><br><br></div><div>The servlet container used is Jetty 9.2. If we run a quick test we receive an "ok" page indicating that the IdP is properly installed and running.<br><br></div><div>But if we try to connect from a SP to our new Shibboleth Idp, we receive the following error: <i>"Message did not meet security requirements"</i>.<br><br></div><div>It seems a problem with the certificate configuration, but we do not see the problem. I would like to ask if you can help to understand this problem.<br><br></div><div>Here our certificate configuration:<br></div><div><br></div><div>Certificates are located in IDP_HOME/credentials:<br><br><div style="margin-left:40px"><i>~]# ls /opt/shibboleth-idp/credentials/<br>idp.crt  idp.jks  idp.key  idp.p12</i><br><br></div>In IDP_HOME/conf/relying-party.xml we have the following config:<br><br></div><div>         <i> <security:Credential id="IdPCredential" xsi:type="security:X509Filesystem"><br></i><div style="margin-left:40px"><i><security:Certificate>/opt/shibboleth-idp/credentials/idp.crt</security:Certificate><br><security:PrivateKey>/opt/shibboleth-idp/credentials/idp.key</security:PrivateKey><br></security:Credential></i><br><br></div><br></div><div>And in JETTY_BASE/modules/ssl.mod we have this configuration:<br><i><br></i></div><div style="margin-left:40px"><i>[depend]<br>server<br>[xml]<br>etc/jetty-ssl.xml<br>[files]<br><a href="http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git/plain/jetty-server/src/main/config/etc/keystore|etc/keystore">http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git/plain/jetty-server/src/main/config/etc/keystore|etc/keystore</a><br>[ini-template]<br>jetty.secure.port=443<br>jetty.keystore=/opt/shibboleth-idp/credentials/idp.p12<br>jetty.keystore.type=PKCS12<br>jetty.keystore.password=mypassword</i><br><br></div><div style="margin-left:40px"><br></div>For stablishing communication between SP and the new IdP, we have copied the idp-metadata.xml into SP. From SP we are redirected to IdP but fails when the certificate is checked. Here the logfiles:<br><br><div style="margin-left:40px"><i>16:17:15.173 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria for criteria class org.opensaml.xml.security.criteria.UsageCriteria<br>16:17:15.173 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:105] - Registry could not locate evaluable criteria for criteria class org.opensaml.security.MetadataCriteria<br>16:17:15.173 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria for criteria class org.opensaml.xml.security.criteria.EntityIDCriteria<br>16:17:15.177 - DEBUG [org.opensaml.xml.security.credential.criteria.EvaluableCredentialCriteriaRegistry:74] - Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableKeyAlgorithmCredentialCriteria for criteria class org.opensaml.xml.security.criteria.KeyAlgorithmCriteria<br>16:17:15.178 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:159] - Attempting to verify signature using trusted credentials<br>16:17:15.185 - DEBUG [org.opensaml.xml.signature.impl.ExplicitKeySignatureTrustEngine:172] - Failed to verify signature using either supplied candidate credential or directly trusted credentials<br>16:17:15.185 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:171] - Candidate credential was either not supplied or did not contain verification key<br>16:17:15.186 - DEBUG [org.opensaml.xml.signature.impl.PKIXSignatureTrustEngine:172] - PKIX trust engine requires supplied key, skipping PKIX trust evaluation<br>16:17:15.186 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195] - Simple signature validation (with no request-derived credentials) failed<br>16:17:15.186 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer: https://.../mellon<br>16:17:15.187 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements<br>org.opensaml.ws.security.SecurityPolicyException: Validation of request simple signature failed for context issuer<br>    at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.doEvaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:139) ~[opensaml-2.6.5.jar:na]<br>    at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.evaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:103) ~[opensaml-2.6.5.jar:na]<br>    at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51) ~[openws-1.5.5.jar:na]<br>    at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132) ~[openws-1.5.5.jar:na]<br>    at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83) ~[openws-1.5.5.jar:na]   </i><br>    .....<br></div><br></div>Another question about Shibboleth configuration is: How we can load the SAML metadata from the SP with which we will interact? We tried to configure it in IDP_HOME/conf/relying-party.xml following this procedure:<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider"> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-HTTPMetadataProvider</a> but we can not find where we need to register the SP. How should be set this step?<br><br><br></div>Thanks in advance,<br></div>Esther<br><div><div><div><br><div><br></div></div></div></div></div>