<html><head></head><body><div>Hmm, I think I might have more information now, from testshib's log.</div><div><br></div><div><pre>2015-07-16 11:10:01 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [75]: validating signature profile
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]: resolving ds:X509Certificate
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]: resolved 1 certificate(s)
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]: resolved 0 CRL(s)
2015-07-16 11:10:01 DEBUG XMLTooling.TrustEngine.ExplicitKey [75]: attempting to validate signature with the peer's credentials
2015-07-16 11:10:01 DEBUG XMLTooling.TrustEngine.ExplicitKey [75]: signature validated with credential
2015-07-16 11:10:01 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [75]: signature verified against message issuer
2015-07-16 11:10:01 DEBUG Shibboleth.SSO.SAML2 [75]: processing message against SAML 2.0 SSO profile
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]: resolved 0 certificate(s)
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: key algorithm didn't match ('AES' != 'RSA')
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: key algorithm didn't match ('AES' != 'RSA')
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: key algorithm didn't match ('AES' != 'RSA')
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]: resolving ds:X509Certificate
2015-07-16 11:10:01 DEBUG XMLTooling.KeyInfoResolver.Inline [75]: resolved 1 certificate(s)
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: credential name(s) didn't overlap
2015-07-16 11:10:01 DEBUG XMLTooling.CredentialCriteria [75]: keys didn't match</pre></div><div><br></div><div><br></div><div>This would reinforce what you said before about it being a credential issue, but I'm not sure where that would be breaking down. The openssl commands I did before verified idp-signing.key and idp-signing.crt matched, and they are set as such in idp.properties.</div><div><br></div><div>Brandon</div><div><br></div><div>On Thu, 2015-07-16 at 14:20 +0000, Cantor, Scott wrote:</div><blockquote type="cite"><pre>On 7/16/15, 9:46 AM, "users on behalf of McKean, Brandon Scott - mckeanbs" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:mckeanbs@jmu.edu">mckeanbs@jmu.edu</a>> wrote:
<blockquote type="cite">
I think I've managed to get past this part, though now I'm getting failures on more or less all SPs, though none of them are really printing an error message to go on.
</blockquote>
Without logs to go on, there's not much that can be determined.
If you need to set up an SP to test against to get logs yourself, then that would be your next step I guess, takes a few minutes if you have a spare VM handy.
<blockquote type="cite">
Perhaps you guys could look at the SAML assertion I'm getting and point me in the right direction to fix this.
</blockquote>
An obvious difference is that one is signed with rsa-sha1 and one is signed with rsa-sha256. The SP would have to be running on absolutely ancient software to not be able to handle that, but for the record, an SP running on, say, Red Hat 4, would in fact throw the error page you posted originally. My day will be immensely better if that turns out to be the case because I nourish myself on the tears of the damned.
-- Scott
</pre></blockquote></body></html>