<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/29/15 8:11 PM, IAM David Bantz
wrote:<br>
</div>
<blockquote
cite="mid:CAJ9XvwGJQdh1rW7kgUSchadboP+6uis7D-if3DSVnGXm=5DUeQ@mail.gmail.com"
type="cite">
<div dir="ltr">Attempting integration between my IdP and a
Salesforce application (SP). First attempt failed with the
message:
<div><br>
</div>
<div><span style="color:rgb(80,0,80);font-size:12.8px">11:40:34.793
- ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:927]
- Could not resolve a key encryption credential for peer
entity: <a moz-do-not-send="true"
style="color:rgb(34,34,34)">https://....force.com</a><br>
</span><span style="color:rgb(80,0,80);font-size:12.8px">11:40:34.793
- ERROR
[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289]
- Unable to construct encrypter<br>
</span><span style="color:rgb(80,0,80);font-size:12.8px">org.opensaml.xml.security.SecurityException:
Could not resolve key encryption credential.</span><br>
</div>
<div><span style="color:rgb(80,0,80);font-size:12.8px"><br>
</span></div>
<div><span style="color:rgb(80,0,80);font-size:12.8px">I can
disable encryption to this SP in relying-party.xml for now
but it highlighted my lack of understanding: There is a
certificate in this SP's metadata; why wasn't it used to
encrypt the assertion. Decoded certificate indicates key
usage for "Digital Signature, Key Encipherment"</span></div>
<div><span style="color:rgb(80,0,80);font-size:12.8px"><br>
</span></div>
</div>
</blockquote>
<br>
The cert key usage data has nothing to do with it, the IdP doesn't
even look at it. The cert in the SP's metadata isn't resolvable for
encryption, mostly likely because its KeyDescriptor has
use="signing". You'd want to either remove the 'use' attribute, or
add a new KeyDescriptor with the same or another cert, and marked
with use="encryption"<br>
<br>
More esoteric: If the SP cert has a DSA key, rather then RSA, that
fundamentally isn't usable for encryption period, so won't be
resolved even if it's (non-nonsensically) marked with
use="encryption".<br>
<br>
<br>
<blockquote
cite="mid:CAJ9XvwGJQdh1rW7kgUSchadboP+6uis7D-if3DSVnGXm=5DUeQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><span style="color:rgb(80,0,80);font-size:12.8px">The
service provider subsequently sent the following message:</span></div>
<div><span style="font-size:12.8px">"</span><span
style="color:rgb(60,61,62);font-family:proxima-nova,sans-serif;font-size:14px;line-height:20px">When </span><span
style="color:rgb(60,61,62);font-family:proxima-nova,sans-serif;font-size:14px;line-height:20px">Salesforce</span><span
style="color:rgb(60,61,62);font-family:proxima-nova,sans-serif;font-size:14px;line-height:20px"> is
the service provider for inbound SAML assertions, you can
pick a saved certificate to decrypt inbound assertions from
third party identity providers. You need to provide a copy
of this certificate to the identity provider.</span><span
style="color:rgb(80,0,80);font-size:12.8px"><br>
</span></div>
<div><span
style="color:rgb(60,61,62);font-family:proxima-nova,sans-serif;font-size:14px;line-height:20px"><br>
</span></div>
<div><span
style="color:rgb(60,61,62);font-family:proxima-nova,sans-serif;font-size:14px;line-height:20px">I've
haven't previously received a separate key for encrypting
assertions. What do I do with it??</span></div>
<div><span
style="color:rgb(60,61,62);font-family:proxima-nova,sans-serif;font-size:14px;line-height:20px"><br>
</span></div>
</div>
</blockquote>
<br>
Whichever one you pick from Salesforce, it needs to be in the IdP's
copy of the SP's metadata, and its KeyDescriptor either marked with
use="encryption", or 'use' omitted entirely if you want to use the
same cert/key for both.<br>
<br>
<br>
</body>
</html>