<div dir="ltr"><span class="im"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div>When I attempt to log in to a new vendor SP, my IdP is unable to verify the signature on the request, with the following log entry</div></div></blockquote><div><br></div><div>I am interpreting this to mean either the vendor provided me a different certificate than used to sign the request, or that I botched the process of converting the certificate provided into the form needed in metadata. Have I missed other possible sources of failure that I need to explore?</div><div><br></div><div>Thanks,</div><div><br>David Bantz</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><br></div><div><p>14:11:50.760 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer: <a href="https://admin.dc4.pageuppeople.com/" target="_blank">https://admin.dc4.pageuppeople.com/</a></p><p>14:11:50.761 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements</p><p>org.opensaml.ws.security.SecurityPolicyException: Validation of request simple signature failed for context issuer</p><p><br></p><p>Here is the SAML request from Firefox SAMLtracer plugin:</p><p><br></p></div></div></blockquote></span><div><pre style="white-space:pre-wrap"><samlp:AuthnRequest ID="_6a479914-ecb4-4f47-9bb3-95c5f404b870"
Version="2.0"
IssueInstant="2015-11-19T23:21:43.013Z"
Destination="<a href="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO" target="_blank">https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO</a>"
ForceAuthn="false"
IsPassive="false"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
AssertionConsumerServiceURL="<a href="https://admin.dc4.pageuppeople.com//gateway/SAML.aspx?binding=urn%3aoasis%3anames%3atc%3aSAML%3a2.0%3abindings%3aHTTP-POST" target="_blank">https://admin.dc4.pageuppeople.com//gateway/SAML.aspx?binding=urn%3aoasis%3anames%3atc%3aSAML%3a2.0%3abindings%3aHTTP-POST</a>"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://admin.dc4.pageuppeople.com/" target="_blank">https://admin.dc4.pageuppeople.com/</a></saml:Issuer>
<samlp:NameIDPolicy AllowCreate="true" />
</samlp:AuthnRequest>
</pre><pre style="white-space:pre-wrap"><br></pre><pre style="white-space:pre-wrap">The "parameters" view of the request does include a signature:</pre><pre style="white-space:pre-wrap"><b>GET
</b><b>SAMLRequest</b>: jZJNb9swDIb/iiFgR1txrCyzEGfIGgwL0K1GnO3QSyHLTCpMljRR7se/n+y0W3YpdiElgtT7kNQKRa8d3wzh3uzh1wAYkt22InfvBVuWZc5SkC1L2ZEt07Jti7RcyMWRzVj7YTkjyQ/wqKypyDyLtx3iADuDQZgQQ7N8keZ5mpeHecHnOWdFNsuLW5Jso4oyIkyV9yE45JSqzmVCC/wpMuiG8Uqdt0elgTabr9dzuodOeZCBNs0NST5bL2HCrshRaIRRvhaI6gH+RGpvg5VWf1KmU+ZUkcEbbgUq5Eb0gDxIPj7OIz5vz0nIvxwOdVrfNAeSbBDBj5xX1uDQg2/APygJ3/fXf8lF1yuTdZJlTpxgcA6s05BJ21N6EgEexfPUQibQPX18kakiyrtCTDDRTzjRBxnNmBxdhIr2FSseL8Ceem2QT8t7uyv3MgKyXo3ZfNqRv6h/u1y8DoCs/6PdFb3QOAs6/i0+utvWViv5nGy0to9XHuJYKhL8EJdE1+eyf3/h+jc=
<b>RelayState</b>: landingPage=recruiter&instID=751
<b>SigAlg</b>: <a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>
<b>Signature</b>: lU6+Drh8QgSOJGzdJUdalmsaS2bi65L1QUZH8zXgXQAvlxC43LjeGZYFPgOyOjmz7riDsoGNT75yvaScolDTRMKXblH4sOmHLHrK5pEe3CDRZIq9AK/BDEcrExeqEm5hoV0O+WC6X1FBhl4okx6NTC1GBIlpteYWlY5FaeKm4Mk7O3BrS1DwomJyZy5gshch/9uJ6BFpCkpFCu7sls8ASXGaKSoK964A9Uwecs0NuCOArhm7sXE0gHyTkTIEzWqWgNFTLoV513kes/UueTZcXMOAaxPoqzJsTEIjsfIcchsgkvuAqqM7tOi8/n83XAVeRgXf6N4QtQOYZhiBYJaj2A==
</pre></div><div><br></div></div>