<html><head></head><body><div>Thanks for the tip Scott.</div><div><br></div><div>So I used this method to check the signing key and certificate:</div><div><br></div><div>openssl x509 -noout -modulus -in idp-signing.crt | openssl md5</div><div>openssl rsa -noout -modulus -in idp-signing.key | openssl md5</div><div><br></div><div>Hashes match in that case. Also, idp-signing.crt's contents match up in idp-metadata.xml</div><div><br></div><div>idp-signing.crt and idp-signing.key were migrated from idp.crt and idp.key, respectively, from our V2 installation. idp-metadata.xml was also copied from the V2 environment.</div><div><br></div><div>I hope I'm on the right track with this? </div><div><br></div><div>Thanks,</div><div><br></div><div><br class="Apple-interchange-newline"><span style="font-family: monospace; white-space: pre;">--
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235</span></div><div><br></div><div>On Wed, 2015-07-15 at 18:11 +0000, Cantor, Scott wrote:</div><blockquote type="cite"><pre>On 7/15/15, 2:04 PM, "users on behalf of McKean, Brandon Scott - mckeanbs" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:mckeanbs@jmu.edu">mckeanbs@jmu.edu</a>> wrote:
<blockquote type="cite">
The most meaningful data I could find stated the error was: Security of SAML 1.x SSO POST response not established, this was from the SP.
</blockquote>
Well, that's a signature issue, nothing to do with endpoints.
<blockquote type="cite">
I have Shibboleth running with debug logging on, and quite a bit seems to happen up to the point of failure, though I'm not sure what I should be looking for to troubleshoot.
</blockquote>
Your signing key's wrong or your metadata is, there's nothing else really to debug, but the IdP log can dump the SAML, as can the SP log.
-- Scott
</pre></blockquote></body></html>