<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/7/15 6:10 PM, Willem D'Haeseleer
wrote:<br>
</div>
<blockquote
cite="mid:CAFfzYXcvp5zBsTuSddJZ09MUNr0NY4JLxp=_yw6+URK3yQWNNA@mail.gmail.com"
type="cite">
<div dir="ltr"><br>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">When I try to login I get
redirected back to my SP but the the IDP fails to encrypt the
assertion. </div>
<div style="font-size:12.8px">It gives the following error:</div>
<div style="font-size:12.8px">
<pre style="white-space:pre-wrap;color:rgb(0,0,0);word-wrap:break-word"><pre style="white-space:pre-wrap;word-wrap:break-word">17:55:15.117 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927] - Could not resolve a key encryption credential for peer entity: <a moz-do-not-send="true" href="http://local.origami42.com:8000/metadata/" target="_blank">http://local.origami42.com:8000/metadata/</a>
17:55:15.117 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter
org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential</pre></pre>
<pre style="white-space:pre-wrap;color:rgb(0,0,0);word-wrap:break-word"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;white-space:normal">
</span></pre>
<pre style="white-space:pre-wrap;word-wrap:break-word"><font face="arial, sans-serif"><span style="white-space:normal">Why can't the IDP encrypt the assertion ?
</span></font></pre>
</div>
</div>
</blockquote>
<br>
Well, it really does mean that the metadata that the IdP has for
your SP doesn't have an encryption key in it. Since the metadata
file you attached does seem to have a key descriptor with
use="encryption", and the entityIDs seem to match up, the logical
conclusion is that the IdP isn't actually using that metadata.<br>
<br>
<blockquote
cite="mid:CAFfzYXcvp5zBsTuSddJZ09MUNr0NY4JLxp=_yw6+URK3yQWNNA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div style="font-size:12.8px">
<pre style="white-space:pre-wrap;word-wrap:break-word"><span style="white-space:normal;font-family:arial,sans-serif">Am I using an incorrect certificate / public key, should I update the medata somehow ?</span>
</pre>
</div>
</div>
</blockquote>
<br>
I would double-check what metadata testshib actually has for your SP
and/or upload it again.<br>
<br>
Could also potentially be something on the testshib end, like not
having reloaded new metadata or something. Occasionally it has
hiccups. <br>
</body>
</html>