<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello,<br>
<br>
i might need some help. I, or some co-worker, registered an IDP with
an old certificate, which might cause the following error:<br>
<br>
2016-11-14 07:33:46 DEBUG OpenSAML.MessageDecoder.SAML2 [7903]:
extracting issuer from SAML 2.0 protocol message<br>
2016-11-14 07:33:46 DEBUG OpenSAML.MessageDecoder.SAML2 [7903]:
message from (<a class="moz-txt-link-freetext" href="https://idp-dev.gfz-potsdam.de/cas/idp">https://idp-dev.gfz-potsdam.de/cas/idp</a>)<br>
2016-11-14 07:33:46 DEBUG OpenSAML.MessageDecoder.SAML2 [7903]:
searching metadata for message issuer...<br>
2016-11-14 07:33:46 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow
[7903]: evaluating message flow policy (replay checking on,
expiration 60)<br>
2016-11-14 07:33:46 DEBUG XMLTooling.StorageService [7903]: inserted
record (_3694091438223139691) in context (MessageFlow) with
expiration (1479127065)<br>
2016-11-14 07:33:46 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning
[7903]: validating signature profile<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolved 4 certificate(s)<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolved 0 CRL(s)<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolving ds:X509Certificate<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolved 4 certificate(s)<br>
2016-11-14 07:33:46 DEBUG XMLTooling.KeyInfoResolver.Inline [7903]:
resolved 0 CRL(s)<br>
2016-11-14 07:33:46 DEBUG XMLTooling.CredentialCriteria [7903]: keys
didn't match<br>
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.ExplicitKey [7903]:
unable to validate signature, no credentials available from peer<br>
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]:
validating signature using certificate from within the signature<br>
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]:
signature verified with key inside signature, attempting certificate
validation...<br>
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]:
checking that the certificate name is acceptable<br>
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: adding
to list of trusted names (<a class="moz-txt-link-freetext" href="https://idp-dev.gfz-potsdam.de/cas/idp">https://idp-dev.gfz-potsdam.de/cas/idp</a>)<br>
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]:
certificate subject:
CN=idp-dev.gfz-potsdam.de,OU=Rechenzentrum,O=GeoForschungsZentrum
Potsdam,L=Potsdam,ST=Brandenburg,C=DE<br>
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: unable
to match DN, trying TLS subjectAltName match<br>
2016-11-14 07:33:46 DEBUG XMLTooling.TrustEngine.PKIX [7903]: unable
to match subjectAltName, trying TLS CN match<br>
2016-11-14 07:33:46 ERROR XMLTooling.TrustEngine.PKIX [7903]:
certificate name was not acceptable<br>
2016-11-14 07:33:46 ERROR OpenSAML.SecurityPolicyRule.XMLSigning
[7903]: unable to verify message signature with supplied trust
engine<br>
<br>
Could some one delete all IDP Registrations with an entity ID
starting with <a class="moz-txt-link-rfc2396E" href="https://idp-gfz-potsdam.de">"https://idp-gfz-potsdam.de"</a>
(<a class="moz-txt-link-freetext" href="https://idp-dev.gfz-potsdam.de/cas/idp">https://idp-dev.gfz-potsdam.de/cas/idp</a>,
<a class="moz-txt-link-freetext" href="https://idp-dev.gfz-potsdam.de">https://idp-dev.gfz-potsdam.de</a>, ....).<br>
<br>
Many thanks!<br>
<br>
<br>
PS: Is it correct to have the cert chain inside multiple
<ds:X509Certificate> tags? My metdata looks like this:<br>
<br>
<?xml version="1.0" encoding="UTF-8"?><br>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2000/09/xmldsig#">"http://www.w3.org/2000/09/xmldsig#"</a>
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xml=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/XML/1998/namespace">"http://www.w3.org/XML/1998/namespace"</a>
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
entityID=<a class="moz-txt-link-rfc2396E" href="https://idp-dev.gfz-potsdam.de/cas/idp">"https://idp-dev.gfz-potsdam.de/cas/idp"</a>><br>
...<br>
<IDPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0"><br>
...<br>
<KeyDescriptor use="signing"><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<!--Signer cert:
CN=idp-dev.gfz-potsdam.de,OU=Rechenzentrum,O=GeoForschungsZentrum
Potsdam,L=Potsdam,ST=Brandenburg,C=DE --><br>
<ds:X509Certificate><br>
...<br>
</ds:X509Certificate><br>
<!-- Intermediate CA subject=
/C=DE/O=GeoForschungsZentrum Potsdam/CN=GeoForschungsZentrum Potsdam
CA - <a class="moz-txt-link-abbreviated" href="mailto:G01/emailAddress=pki@gfz-potsdam.de">G01/emailAddress=pki@gfz-potsdam.de</a> --><br>
<ds:X509Certificate><br>
...<br>
</ds:X509Certificate><br>
<!-- Intermediate CA subject=
/C=DE/O=GeoForschungsZentrum Potsdam/CN=GeoForschungsZentrum Potsdam
CA - <a class="moz-txt-link-abbreviated" href="mailto:G01/emailAddress=pki@gfz-potsdam.de">G01/emailAddress=pki@gfz-potsdam.de</a> --><br>
<ds:X509Certificate><br>
...<br>
</ds:X509Certificate><br>
<!-- Root CA subject= /C=DE/O=Deutsche
Telekom AG/OU=T-TeleSec Trust Center/CN=Deutsche Telekom Root CA 2
--><br>
<ds:X509Certificate><br>
...<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
</KeyDescriptor><br>
...<br>
</IDPSSODescriptor><br>
...<br>
</EntityDescriptor><br>
<pre class="moz-signature" cols="72">--
B.Sc. Robert Kornmesser
Rechenzentrum
Tel.: +49 (0)331/288-28763
Fax: +49 (0)331/288-1703
Email: <a class="moz-txt-link-abbreviated" href="mailto:robert.kornmesser@gfz-potsdam.de">robert.kornmesser@gfz-potsdam.de</a>
___________________________________
Helmholtz-Zentrum Potsdam
Deutsches GeoForschungsZentrum GFZ
Stiftung des öff. Rechts Land Brandenburg
Telegrafenberg, 14473 Potsdam</pre>
</body>
</html>