<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hello,</div><div class=""><br class=""></div><div class="">I’m setting up an SP test site with a customer’s IdP and we’re getting the "Message was signed, but signature could not be verified.” error. I’m hoping someone can help me understand where the mismatch may be. </div><div class=""><br class=""></div><div class="">According to the troubleshooting doc for this error, I should check the following three things:</div><div class=""><br class=""></div><div class=""><div class=""><blockquote type="cite" class="">1. The certificate in the metadata is different from the one configured in relying-party.xml, and hence, the one in the message. You should change them so they match.</blockquote></div><div class=""><br class=""></div><div class=""><div class="">I have verified the certificate in the metadata is the same as what we received in the <ds:X509Certificate> value of the assertion. Is there something else I should check for being out of alignment here?</div></div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">2. If PKIX(CN matching with a signed root) is being used, the CN of the certificate used to sign the message is not the same as the CN expected by the KeyName of that provider's metadata.<br class=""></blockquote></div><div class=""><br class=""></div><div class="">According to the log:</div><div class=""><br class=""></div><div class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: adding to list of trusted names (<a href="https://shib3.abcd.edu/idp/shibboleth" class="">https://shib3.abcd.edu/idp/shibboleth</a>)<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: certificate subject: CN=<a href="http://shib3.abcd.edu" class="">shib3.abcd.edu</a>,OU=shib3.abcd.edu,O=shib3.abcd.edu,L=El Paso,ST=Texas,C=US<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match DN, trying TLS subjectAltName match</div><div class=""><br class=""></div><div class="">The CN value is "CN=<a href="http://shib3.abcd.edu" class="">shib3.abcd.edu</a>”. Shouldn’t that match "<a href="https://shib3.abcd.edu/idp/shibboleth" class="">https://shib3.abcd.edu/idp/shibboleth</a>” or am I misunderstanding?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><blockquote type="cite" class="">3. The IdP is using the wrong entityID and mistakenly trying to spoof another IdP.</blockquote></div></div><div class=""><br class=""></div><div class="">The metadata entityID matches what we have configured on the SP side and what we received in the <saml2:Issuer> assertion value.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Any guidance that would help point me in the right direction is appreciated. This is what we are getting in our log:</div><br class="">2017-03-27 19:30:06 DEBUG XMLTooling.CredentialCriteria [1]: keys didn't match<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: unable to validate signature, no credentials available from peer<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: validating signature using certificate from within the signature<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: signature verified with key inside signature, attempting certificate validation...<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: checking that the certificate name is acceptable<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: adding to list of trusted names (<a href="https://shib3.abcd.edu/idp/shibboleth" class="">https://shib3.abcd.edu/idp/shibboleth</a>)<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: certificate subject: CN=shib3.abcd.edu,OU=shib3.abcd.edu,O=shib3.abcd.edu,L=El Paso,ST=Texas,C=US<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match DN, trying TLS subjectAltName match<br class="">2017-03-27 19:30:06 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match subjectAltName, trying TLS CN match<br class="">2017-03-27 19:30:06 ERROR XMLTooling.TrustEngine.PKIX [1]: certificate name was not acceptable<br class="">2017-03-27 19:30:06 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [1]: unable to verify message signature with supplied trust engine<br class="">2017-03-27 19:30:06 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: Message was signed, but signature could not be verified.<br class=""><br class="">
<br class="">Thanks,<br class=""><br class="">-Harold<div class=""><br class=""></div><div class=""><br class=""><div class=""><br class=""></div></div></body></html>