<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 16px; font-family: Calibri, sans-serif;">
<span id="OLK_SRC_BODY_SECTION">
<div bgcolor="#FFFFFF" text="#000000">
<pre class="moz-signature" cols="72"><span style="font-family: Calibri, sans-serif; white-space: normal;">I currently have IdP version 2.4.4 installed in our production environment. I want to move to IdP version 3.1.1. However, rather than doing an upgrade to IdP version 2, I want to do a clean version 3.1.1 install and use the configuration files from version 2.4.4, making any changes as needed. At this point in a test environment, I have made the changes to the ldap.properties file, the attribute-filter.xml file, the attribute-resolver.xml file, the relying-party.xml file and the metadata-provider.xml. The v3 IdP loads and authenticates as expected and using a test SP, I can access the protected resource. </span><br><span style="font-family: Calibri, sans-serif; white-space: normal;"></span><div style="font-family: Calibri, sans-serif; white-space: normal;"><br></div><div style="font-family: Calibri, sans-serif; white-space: normal;">The issue that I am running into however is that if when I replace the test IdP metadata with the actual v2 PROD IdP metadata and when I add the actual v2 PROD IdP metadata to the test SP (using filesystem metadata provider), I get an error after authentication on the SP. In other words, the authentication from the IdP appears to work, but the SP throws the following error: <b>Message was signed, but signature could not be verified.</b></div><div style="font-family: Calibri, sans-serif; white-space: normal;">Also, the SP logs have the following: <b>2015-10-09 09:45:16 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [3]: unable to verify message signature with supplied trust engine</b></div><div style="font-family: Calibri, sans-serif; white-space: normal;"><br></div><div style="font-family: Calibri, sans-serif; white-space: normal;">In troubleshooting, I have verified that the SP is indeed using the metadata from the current v2 PROD IdP and that I have replaced the metadata in the metadata directory on the test v3 IdP with the metadata from the current PROD v2 IdP. Thus, the fix on the NativeSPTroubleshootingCommonErrors page does not appear to be relevant in this case. </div><div style="font-family: Calibri, sans-serif; white-space: normal;"><br></div><div style="font-family: Calibri, sans-serif; white-space: normal;">I am fairly certain that it has to do with a mismatch between the certs and keys in the credentials directory as created for IdP version 3 (could be wrong of course). </div></pre>
</div>
</span><span id="OLK_SRC_BODY_SECTION">
<div bgcolor="#FFFFFF" text="#000000">
<pre class="moz-signature" cols="72"><div style="font-family: Calibri, sans-serif; white-space: normal;">So my questions are:</div><div style="font-family: Calibri, sans-serif; white-space: normal;">1. How do the IdP version 2 credential files relate to the IdP version 3 credential files (if at all)?</div></pre>
</div>
</span>
<div>2. Is this method of doing a clean version 3 install and then porting over the files from version 2 possible? That is doing a clean install of IdP v3 and then copying over and changing the necessary IdPv2 files for IdPv3.</div>
<div><br>
</div>
<div>3. I have looked for DOC's regarding this scenario but I only see DOC's for upgrading from version 2 or installing IdP v3 from scratch. Can someone point me to DOC's that apply to my particular scenario? </div>
<span id="OLK_SRC_BODY_SECTION">
<div bgcolor="#FFFFFF" text="#000000">
<pre class="moz-signature" cols="72">
</pre>
</div>
</span><br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This e-mail message (including any attachments) is for the sole use of<br>
the intended recipient(s) and may contain confidential and privileged<br>
information. If the reader of this message is not the intended<br>
recipient, you are hereby notified that any dissemination, distribution<br>
or copying of this message (including any attachments) is strictly<br>
prohibited.<br>
<br>
If you have received this message in error, please contact<br>
the sender by reply e-mail message and destroy all copies of the<br>
original message (including attachments).<br>
</font>
</body>
</html>