<html><head></head><body><div>I think I've managed to get past this part, though now I'm getting failures on more or less all SPs, though none of them are really printing an error message to go on.</div><div><br></div><div>Perhaps you guys could look at the SAML assertion I'm getting and point me in the right direction to fix this.</div><div><br></div><div><b>Here's the one from the existing v2 IDP that works:</b></div><div><br></div><div><saml1p:Response xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"</div><div> IssueInstant="2015-07-16T13:37:32.724Z"</div><div> MajorVersion="1"</div><div> MinorVersion="1"</div><div> Recipient="<a href="https://www.zimride.com/Shibboleth.sso/SAML/POST">https://www.zimride.com/Shibboleth.sso/SAML/POST</a>"</div><div> ResponseID="_ca43239c3f02bc89ec02482a725fd521"</div><div> ></div><div> <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" >"="">http://www.w3.org/2000/09/xmldsig#"></a>;</div><div> <ds:SignedInfo></div><div> <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></div><div> <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>" /></div><div> <ds:Reference URI="#_ca43239c3f02bc89ec02482a725fd521"></div><div> <ds:Transforms></div><div> <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>" /></div><div> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></div><div> </ds:Transforms></div><div> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>" /></div><div> <ds:DigestValue>DeeHpKPnpqW/sMr166OnPzuRhCo=</ds:DigestValue></div><div> </ds:Reference></div><div> </ds:SignedInfo></div><div> <ds:SignatureValue>aCUtDHxvSYVpizf0wYvuK3+18+gzNY5L1K1frMHVMEV/OGNCz8PCKZBLeD1O6LuKHMe0cm984n3U9NAc4HVPXBy1BTtq8gmbnPu/HAfBqQKMCzXzHayGs0aDyPzfa+/PFmeCitv/8uMuKYcpZsTGeCrXgvLeNtC6w6D6Jm5yMKSh60tQhyGdbP2xRzE01o7q1AfwSOptlfJ0jlZ5kgdnRThvYkKsKu0Pea+h994F/3jqssnNNEdGNa7HQOa5cizJXgc3D+BoqLAvkN09NWy5Emj0qqLUZ9ToLnpmxDQdG2dQ5MdFEThtXssBdZbGn/PwBVcJ80QoKRZPqtk50nzXWQ==</ds:SignatureValue></div><div> <ds:KeyInfo></div><div> <ds:X509Data></div><div> <ds:X509Certificate>MIIEvTCCA6WgAwIBAgIJAMwnlWaj6tOPMA0GCSqGSIb3DQEBBQUAMIGaMQswCQYDVQQGEwJVUzER</div><div>MA8GA1UECBMIVmlyZ2luaWExFTATBgNVBAcTDEhhcnJpc29uYnVyZzEhMB8GA1UEChMYSmFtZXMg</div><div>TWFkaXNvbiBVbml2ZXJzaXR5MR8wHQYDVQQLExZJbmZvcm1hdGlvbiBUZWNobm9sb2d5MR0wGwYD</div><div>VQQDExRpdGZlZGVyYXRpb24uam11LmVkdTAeFw0xMjA2MDUxNTExMTRaFw0yMjA2MDUxNTExMTRa</div><div>MIGaMQswCQYDVQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWExFTATBgNVBAcTDEhhcnJpc29uYnVy</div><div>ZzEhMB8GA1UEChMYSmFtZXMgTWFkaXNvbiBVbml2ZXJzaXR5MR8wHQYDVQQLExZJbmZvcm1hdGlv</div><div>biBUZWNobm9sb2d5MR0wGwYDVQQDExRpdGZlZGVyYXRpb24uam11LmVkdTCCASIwDQYJKoZIhvcN</div><div>AQEBBQADggEPADCCAQoCggEBAMoRMpZ+1Y8Z6de8v1Zj3UYNEj0b2V/mSd9rseQtcAgPMwL2khVt</div><div>/GJoPpdG7DGmRCATuVpkzD/k1vA06cBOknCHpOhHvn2AgYyfPFqbHY1bBLE0sKqynnj2W5S19Sb+</div><div>9DYl5lY7gQsoXCX5o0qliBjp7Yqo1aMT/rImOZlcw4r7GL/dTi+0Q1ScWUX+YNCJF22sAg/HctNj</div><div>qCkEwPqVv5K0UHZ96YpdOXmC+pzQ9oo33RANpaMGHpA63eM70rzVZccVspb0LG8sZZLuTavHXTpG</div><div>f2tR2TauKS1zP9ok0ZD5rweDem3BKtRP7i9R+tuejzHi3JH2Dur59At616y1jN0CAwEAAaOCAQIw</div><div>gf8wHQYDVR0OBBYEFJ50wNaJkgk5WSLNo0w/NhDjxmYpMIHPBgNVHSMEgccwgcSAFJ50wNaJkgk5</div><div>WSLNo0w/NhDjxmYpoYGgpIGdMIGaMQswCQYDVQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWExFTAT</div><div>BgNVBAcTDEhhcnJpc29uYnVyZzEhMB8GA1UEChMYSmFtZXMgTWFkaXNvbiBVbml2ZXJzaXR5MR8w</div><div>HQYDVQQLExZJbmZvcm1hdGlvbiBUZWNobm9sb2d5MR0wGwYDVQQDExRpdGZlZGVyYXRpb24uam11</div><div>LmVkdYIJAMwnlWaj6tOPMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAK8EXe8Og7W6</div><div>M384gTsVNHcG1h6B6pmXhHZfVwVucYEenggcSQ7ErWCZliCE0Ae8hfiqPZDdLrrzaF6/gp6sfueu</div><div>RbKXaa41FfcuvOGaUs25TD3hf7tH2N4Voq7akAtPYCdtupLvbB7eM8CFJwKdOc43tLUO3eG4eJzM</div><div>WV6hX+PwwqCbZIvcKbFpFhzMSN/uMsH+FBVwtyV/jxAkRpw/MRczHruwPObYT6mKoVMdOaP0NvAE</div><div>tqQRFBuJQh760wpzQzYSjyLb8gehpoRs8nWw73l8FgKhXa/hz06Vp9hibCfxxSWb8bktOu8MruAM</div><div>4zVeItgUieNNRzPjqrr/K8B4rWo=</ds:X509Certificate></div><div> </ds:X509Data></div><div> </ds:KeyInfo></div><div> </ds:Signature></div><div> <saml1p:Status></div><div> <saml1p:StatusCode Value="saml1p:Success" /></div><div> </saml1p:Status></div><div> <saml1:Assertion xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion"</div><div> AssertionID="_1f2513d5a3b297f810798f2f3d471ec0"</div><div> IssueInstant="2015-07-16T13:37:32.724Z"</div><div> Issuer="urn:mace:incommon:jmu.edu"</div><div> MajorVersion="1"</div><div> MinorVersion="1"</div><div> ></div><div> <saml1:Conditions NotBefore="2015-07-16T13:37:32.724Z"</div><div> NotOnOrAfter="2015-07-16T13:42:32.724Z"</div><div> ></div><div> <saml1:AudienceRestrictionCondition></div><div> <saml1:Audience><a href="https://www.zimride.com/shibboleth</saml1:Audience>">https://www.zimride.com/shibboleth</saml1:Audience></a>;</div><div> </saml1:AudienceRestrictionCondition></div><div> </saml1:Conditions></div><div> <saml1:AuthenticationStatement AuthenticationInstant="2015-07-16T13:37:32.507Z"</div><div> AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"</div><div> ></div><div> <saml1:Subject></div><div> <saml1:NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier"</div><div> NameQualifier="urn:mace:incommon:jmu.edu"</div><div> >_1f3da579407d93d78d8a9d811214c644</saml1:NameIdentifier></div><div> <saml1:SubjectConfirmation></div><div> <saml1:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml1:ConfirmationMethod></div><div> </saml1:SubjectConfirmation></div><div> </saml1:Subject></div><div> <saml1:SubjectLocality IPAddress="134.126.38.114" /></div><div> </saml1:AuthenticationStatement></div><div> </saml1:Assertion></div><div></saml1p:Response></div><div><br></div><div><br></div><div><br></div><div><b>And here's the new one that isn't liked by the SP:</b></div><div><br></div><div><br></div><div><br></div><div><saml1p:Response IssueInstant="2015-07-16T13:36:32.460Z"</div><div> MajorVersion="1"</div><div> MinorVersion="1"</div><div> Recipient="<a href="https://www.zimride.com/Shibboleth.sso/SAML/POST">https://www.zimride.com/Shibboleth.sso/SAML/POST</a>"</div><div> ResponseID="_60adadba18a05747f120578c162a06cd"</div><div> xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"</div><div> ></div><div> <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" >"="">http://www.w3.org/2000/09/xmldsig#"></a>;</div><div> <ds:SignedInfo></div><div> <ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></div><div> <ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>" /></div><div> <ds:Reference URI="#_60adadba18a05747f120578c162a06cd"></div><div> <ds:Transforms></div><div> <ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>" /></div><div> <ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" /></div><div> </ds:Transforms></div><div> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a>" /></div><div> <ds:DigestValue>5rkixDu6J+IpEg9uqhE4RryKc6Sis+jb/N+QH1Kqto4=</ds:DigestValue></div><div> </ds:Reference></div><div> </ds:SignedInfo></div><div> <ds:SignatureValue></div><div>Bu3/5mZtdg88Dhkju5YwUL20tj5bl9IpAJm/aHWSClX2Hex60q7pIH1t83LMNtOpAxeP1hfcHgme</div><div>MkeZo2o86o+nFRuTi5KTlgYhyZ54r/pFRxjgVTuo6Pe3WDY8ESJX7DEIwZ/GUhGlcDI7GrbdfzQc</div><div>NqtdHuJ35vbEl4qrKq7UwBCN2yqe9IlYI8XXuNXIKQhIMqP95P0+N/BOlW9/k1QeTqXmdX0u8pvf</div><div>l6pqTkt5YIgZ5Ibc1n8/EHYwDs2jYOmUxF2G/AbXul43tQb9fLYECc3GAYP13OVKxezS9opj66lb</div><div>jWY2l9SkXs+wLuewNu0taOTDsOdaH5ZOl3dVBA==</div><div></ds:SignatureValue></div><div> <ds:KeyInfo></div><div> <ds:X509Data></div><div> <ds:X509Certificate>MIIEvTCCA6WgAwIBAgIJAMwnlWaj6tOPMA0GCSqGSIb3DQEBBQUAMIGaMQswCQYDVQQGEwJVUzER</div><div>MA8GA1UECBMIVmlyZ2luaWExFTATBgNVBAcTDEhhcnJpc29uYnVyZzEhMB8GA1UEChMYSmFtZXMg</div><div>TWFkaXNvbiBVbml2ZXJzaXR5MR8wHQYDVQQLExZJbmZvcm1hdGlvbiBUZWNobm9sb2d5MR0wGwYD</div><div>VQQDExRpdGZlZGVyYXRpb24uam11LmVkdTAeFw0xMjA2MDUxNTExMTRaFw0yMjA2MDUxNTExMTRa</div><div>MIGaMQswCQYDVQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWExFTATBgNVBAcTDEhhcnJpc29uYnVy</div><div>ZzEhMB8GA1UEChMYSmFtZXMgTWFkaXNvbiBVbml2ZXJzaXR5MR8wHQYDVQQLExZJbmZvcm1hdGlv</div><div>biBUZWNobm9sb2d5MR0wGwYDVQQDExRpdGZlZGVyYXRpb24uam11LmVkdTCCASIwDQYJKoZIhvcN</div><div>AQEBBQADggEPADCCAQoCggEBAMoRMpZ+1Y8Z6de8v1Zj3UYNEj0b2V/mSd9rseQtcAgPMwL2khVt</div><div>/GJoPpdG7DGmRCATuVpkzD/k1vA06cBOknCHpOhHvn2AgYyfPFqbHY1bBLE0sKqynnj2W5S19Sb+</div><div>9DYl5lY7gQsoXCX5o0qliBjp7Yqo1aMT/rImOZlcw4r7GL/dTi+0Q1ScWUX+YNCJF22sAg/HctNj</div><div>qCkEwPqVv5K0UHZ96YpdOXmC+pzQ9oo33RANpaMGHpA63eM70rzVZccVspb0LG8sZZLuTavHXTpG</div><div>f2tR2TauKS1zP9ok0ZD5rweDem3BKtRP7i9R+tuejzHi3JH2Dur59At616y1jN0CAwEAAaOCAQIw</div><div>gf8wHQYDVR0OBBYEFJ50wNaJkgk5WSLNo0w/NhDjxmYpMIHPBgNVHSMEgccwgcSAFJ50wNaJkgk5</div><div>WSLNo0w/NhDjxmYpoYGgpIGdMIGaMQswCQYDVQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWExFTAT</div><div>BgNVBAcTDEhhcnJpc29uYnVyZzEhMB8GA1UEChMYSmFtZXMgTWFkaXNvbiBVbml2ZXJzaXR5MR8w</div><div>HQYDVQQLExZJbmZvcm1hdGlvbiBUZWNobm9sb2d5MR0wGwYDVQQDExRpdGZlZGVyYXRpb24uam11</div><div>LmVkdYIJAMwnlWaj6tOPMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAK8EXe8Og7W6</div><div>M384gTsVNHcG1h6B6pmXhHZfVwVucYEenggcSQ7ErWCZliCE0Ae8hfiqPZDdLrrzaF6/gp6sfueu</div><div>RbKXaa41FfcuvOGaUs25TD3hf7tH2N4Voq7akAtPYCdtupLvbB7eM8CFJwKdOc43tLUO3eG4eJzM</div><div>WV6hX+PwwqCbZIvcKbFpFhzMSN/uMsH+FBVwtyV/jxAkRpw/MRczHruwPObYT6mKoVMdOaP0NvAE</div><div>tqQRFBuJQh760wpzQzYSjyLb8gehpoRs8nWw73l8FgKhXa/hz06Vp9hibCfxxSWb8bktOu8MruAM</div><div>4zVeItgUieNNRzPjqrr/K8B4rWo=</ds:X509Certificate></div><div> </ds:X509Data></div><div> </ds:KeyInfo></div><div> </ds:Signature></div><div> <saml1p:Status></div><div> <saml1p:StatusCode Value="saml1p:Success" /></div><div> </saml1p:Status></div><div> <saml1:Assertion AssertionID="_099eb00e3c94a8a6f3347c8ec02fcad4"</div><div> IssueInstant="2015-07-16T13:36:32.460Z"</div><div> Issuer="urn:mace:incommon:jmu.edu"</div><div> MajorVersion="1"</div><div> MinorVersion="1"</div><div> xmlns:saml1="urn:oasis:names:tc:SAML:1.0:assertion"</div><div> ></div><div> <saml1:Conditions NotBefore="2015-07-16T13:36:32.460Z"</div><div> NotOnOrAfter="2015-07-16T13:41:32.460Z"</div><div> ></div><div> <saml1:AudienceRestrictionCondition></div><div> <saml1:Audience><a href="https://www.zimride.com/shibboleth</saml1:Audience>">https://www.zimride.com/shibboleth</saml1:Audience></a>;</div><div> </saml1:AudienceRestrictionCondition></div><div> </saml1:Conditions></div><div> <saml1:AuthenticationStatement AuthenticationInstant="2015-07-16T13:36:26.419Z"</div><div> AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password"</div><div> ></div><div> <saml1:Subject></div><div> <saml1:NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier"</div><div> NameQualifier="urn:mace:incommon:jmu.edu"</div><div> >AAdzZWNyZXQxWm65wXv3q//YKZgH8LwWyAs7jtRQFV07iTQxocs7LYKIeBVtCVhFQu4c6e7yBG9JHY/sPhPAO1Nz/b0rd3lUc8LJJYoyO9KOnBr49wHWqe/zoLFfKUNcDzoztQciLFtmrIhWEuJPHKev</saml1:NameIdentifier></div><div> <saml1:SubjectConfirmation></div><div> <saml1:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml1:ConfirmationMethod></div><div> </saml1:SubjectConfirmation></div><div> </saml1:Subject></div><div> <saml1:SubjectLocality IPAddress="134.126.38.114" /></div><div> </saml1:AuthenticationStatement></div><div> </saml1:Assertion></div><div></saml1p:Response></div><div><br></div><div><br></div><div>As far as I can tell, the IDP hasn't produced errors while creating those. This is just an example though, it appears none of the SPs like what they're getting.</div><div><br></div><div>Anything that could point me in the right direction is appreciated.</div><div><br></div><div>Thanks,</div><div><br></div><div><br class="Apple-interchange-newline"><span style="font-family: monospace; white-space: pre;">--
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235</span></div><div><br></div><div>On Wed, 2015-07-15 at 20:38 +0000, Cantor, Scott wrote:</div><blockquote type="cite"><pre>On 7/15/15, 4:28 PM, "users on behalf of McKean, Brandon Scott - mckeanbs" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:mckeanbs@jmu.edu">mckeanbs@jmu.edu</a>> wrote:
<blockquote type="cite">
Hmm, doing more digging I found that I hadn't commented out the encryption key/cert in credentials.xml
</blockquote>
That file isn't used unless you're using a non-legacy relying party file, but if you are, then you need to have that credential defined.
<blockquote type="cite">
Is there something else that needs done for that part?
</blockquote>
Disabling that would be a great deal of work if it's actually even possible. If you're concerned about not supporting decryption, just don't publish it in your metadata. It won't matter for anything you're testing anyway.
(None of this has anything to do with the error you posted.)
-- Scott
</pre></blockquote></body></html>