<div dir="ltr"><div><br></div><div>Howdy all!</div><div><br></div><div><br></div><div><div>Background info:</div><div><br></div><div>Be aware that my terminology may not be correct as I'm still pretty new using and installing shibboleth/IDP. </div><div><br></div><div>I'm taking a test run at migrating from idp 2.2.4 to idp 3.3.1. I did a fresh install of ipd 3.3.1 using jetty 9.3.20 with java 1.8.</div><div>Following that I used the documentation at <a href="https://wiki.shibboleth.net/confluence/display/IDP30/UpgradingFromV2">https://wiki.shibboleth.net/confluence/display/IDP30/UpgradingFromV2</a> to manually bring over neccessary configuration files/settings from the idp 2.x system and was able to get idp 3.x to load successfully. </div><div>While running in what I think is called Legacy mode, I was also able to successfully Authenticate/SSO using the Test shib site and a local application (FreshDesk) that we use in house. Those are the only two SP's that I have to test against for now.</div><div><br></div><div>After having what appeared to be a "BASIC working system" that was running in Legacymode. I proceeded to try move towards full idp 3.x configuration with new style relying-party.xml, metadata-providers.xml etc.. </div><div>I had two SP's that I know were going to be a challenge to get added into the metadata-providers.xml without generating errors. They both require signature validation. One of them being the entry for InCommon and the other for </div><div>an app we use called ActiveData Calendar So I left those out of the v3 config temporarily until I could work out all the deprecation messages and errors.</div><div><br></div><div><br></div><div>Without InCommon and ActiveData Calendar configured in my v3 metadata-providers.xml I can start idp 3.0 and SSO to the 2 SP's I'm testing with successfully ... and I have no errors or deprecation warnings, </div><div>in the idp-process.log. So at this point I'm pretty happy thinking all I have to do now is get these last two SP's figure out.</div><div><br></div><div>After much reading and tinkering, I got (InCommon) info added into v3 metadata-providers.xml and the idp started up OK, with no errors, woo hoo! </div><div>but when attempting to add the (ActiveData Calendar) I get the following errors.</div></div><div><br></div><div>+++++++++++++++++++++++++++++++++++++</div><div><div>idp-warn.log</div><div> </div><div> 2017-12-04 12:04:02,545 - WARN [org.apache.xml.security.signature.XMLSignature:760] - Signature verification failed.</div><div>2017-12-04 12:04:02,548 - WARN [org.apache.xml.security.signature.XMLSignature:760] - Signature verification failed.</div><div>2017-12-04 12:04:02,549 - ERROR [org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter:420] - Signature trust establishment failed for metadata entry <a href="https://eventcal.pima.edu/">https://eventcal.pima.edu/</a></div><div>2017-12-04 12:04:02,779 - WARN [org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter:251] - Saw fatal error validating metadata signature(s), metadata will be filtered out</div><div>org.opensaml.saml.metadata.resolver.filter.FilterException: Signature trust establishment failed for metadata entry</div><div> at org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter.verifySignature(SignatureValidationFilter.java:421)</div><div>++++++++++++++++++++++++++++++++++++++</div><div> </div><div><br></div><div>+++++++++++++++++++++++++++++++++++++ </div><div> idp-process.log</div><div> </div><div>2017-12-04 12:04:02,209 - DEBUG [net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.impl.SignatureValidationCriteriaSetFactoryBean:123] - Building CriteriaSet based on factory bean inputs</div><div>2017-12-04 12:04:02,210 - DEBUG [net.shibboleth.idp.profile.spring.relyingparty.metadata.filter.impl.SignatureValidationCriteriaSetFactoryBean:140] - Resolving SignatureValidationParameters from supplied SignatureValidationConfigurations</div><div>2017-12-04 12:04:02,278 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:283] - Metadata Resolver FilesystemMetadataResolver ADMD: Beginning refresh of metadata from '/opt/shibboleth-idp/metadata/PimaEventCalSP.xml'</div><div>2017-12-04 12:04:02,435 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:290] - Metadata Resolver FilesystemMetadataResolver ADMD: Processing new metadata from '/opt/shibboleth-idp/metadata/PimaEventCalSP.xml'</div><div>2017-12-04 12:04:02,436 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:380] - Metadata Resolver FilesystemMetadataResolver ADMD: Unmarshalling metadata from '/opt/shibboleth-idp/metadata/PimaEventCalSP.xml'</div><div>2017-12-04 12:04:02,534 - DEBUG [org.apache.xml.security.utils.ElementProxy:91] - setElement("Signature", "")</div><div>2017-12-04 12:04:02,534 - DEBUG [org.apache.xml.security.utils.ElementProxy:91] - setElement("SignedInfo", "")</div><div>2017-12-04 12:04:02,534 - DEBUG [org.apache.xml.security.utils.ElementProxy:91] - setElement("SignatureMethod", "")</div><div>2017-12-04 12:04:02,535 - DEBUG [org.apache.xml.security.algorithms.SignatureAlgorithm:148] - Create URI "<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>" class "class org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA1"</div><div>2017-12-04 12:04:02,535 - DEBUG [org.apache.xml.security.algorithms.JCEMapper:321] - Request for URI <a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></div><div>2017-12-04 12:04:02,535 - DEBUG [org.apache.xml.security.algorithms.implementations.SignatureBaseRSA:57] - Created SignatureRSA using SHA1withRSA</div><div>2017-12-04 12:04:02,536 - DEBUG [org.apache.xml.security.utils.ElementProxy:91] - setElement("KeyInfo", "")</div><div>2017-12-04 12:04:02,537 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:423] - Metadata Resolver FilesystemMetadataResolver ADMD: Preprocessing metadata from '/opt/shibboleth-idp/metadata/PimaEventCalSP.xml'</div><div>2017-12-04 12:04:02,537 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:376] - Metadata Resolver FilesystemMetadataResolver ADMD: Applying metadata filter</div><div>2017-12-04 12:04:02,537 - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:75] - Applying filter org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter</div><div>2017-12-04 12:04:02,538 - DEBUG [org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter:403] - Verifying signature on metadata entry: <a href="https://eventcal.pima.edu/">https://eventcal.pima.edu/</a></div><div>2017-12-04 12:04:02,538 - DEBUG [org.apache.xml.security.utils.ElementProxy:91] - setElement("Reference", "")</div><div>2017-12-04 12:04:02,538 - DEBUG [org.apache.xml.security.utils.ElementProxy:91] - setElement("Transforms", "")</div><div>2017-12-04 12:04:02,539 - DEBUG [org.apache.xml.security.utils.ElementProxy:91] - setElement("Transform", "")</div><div>2017-12-04 12:04:02,539 - DEBUG [org.opensaml.saml.security.impl.SAMLSignatureProfileValidator:235] - Saw Enveloped signature transform</div><div>2017-12-04 12:04:02,539 - DEBUG [org.apache.xml.security.utils.ElementProxy:91] - setElement("Transform", "")</div><div>2017-12-04 12:04:02,539 - DEBUG [org.opensaml.saml.security.impl.SAMLSignatureProfileValidator:239] - Saw Exclusive C14N signature transform</div><div>2017-12-04 12:04:02,540 - DEBUG [org.apache.xml.security.signature.XMLSignature:731] - signatureMethodURI = <a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></div><div>2017-12-04 12:04:02,541 - DEBUG [org.apache.xml.security.signature.XMLSignature:732] - jceSigAlgorithm = SHA1withRSA</div><div>2017-12-04 12:04:02,541 - DEBUG [org.apache.xml.security.signature.XMLSignature:733] - jceSigProvider = SunRsaSign</div><div>2017-12-04 12:04:02,542 - DEBUG [org.apache.xml.security.signature.XMLSignature:734] - PublicKey = Sun RSA public key, 1024 bits</div><div> modulus: 139903893700818129923763917507283348539565831909513904498144681001062613781591380290246167882978567758383367896585313556206278819370392138141890359518747198864175236186240358004044099091514930338900369886675005990687898507665880009509192577982265000195960680632675200295946362219208818811104695564396648767203</div><div> public exponent: 65537</div><div>2017-12-04 12:04:02,542 - DEBUG [org.apache.xml.security.utils.SignerOutputStream:64] - Canonicalized SignedInfo:</div><div>2017-12-04 12:04:02,543 - DEBUG [org.apache.xml.security.utils.SignerOutputStream:69] - <SignedInfo xmlns="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div> <CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"></CanonicalizationMethod></div><div> <SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"></SignatureMethod></div><div> <Reference URI="#_e0ffb229-c45d-428b-b44c-d306f5c58af6"></div><div> <Transforms></div><div> <Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"></Transform></div><div> <Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"></div><div> <InclusiveNamespaces xmlns="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" PrefixList="#default md saml ds xs xsi"></InclusiveNamespaces></div><div> </Transform></div><div> </Transforms></div><div> <DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>"></DigestMethod></div><div> <DigestValue>JgZYpKMrgUQSBTEjRK/sLvXIzCw=</DigestValue></div><div> </Reference></div><div> </SignedInfo></div><div>2017-12-04 12:04:02,545 - WARN [org.apache.xml.security.signature.XMLSignature:760] - Signature verification failed.</div><div>2017-12-04 12:04:02,546 - DEBUG [org.apache.xml.security.signature.XMLSignature:731] - signatureMethodURI = <a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a></div><div>2017-12-04 12:04:02,546 - DEBUG [org.apache.xml.security.signature.XMLSignature:732] - jceSigAlgorithm = SHA1withRSA</div><div>2017-12-04 12:04:02,547 - DEBUG [org.apache.xml.security.signature.XMLSignature:733] - jceSigProvider = SunRsaSign</div><div>2017-12-04 12:04:02,547 - DEBUG [org.apache.xml.security.signature.XMLSignature:734] - PublicKey = Sun RSA public key, 1024 bits</div><div> modulus: 139903893700818129923763917507283348539565831909513904498144681001062613781591380290246167882978567758383367896585313556206278819370392138141890359518747198864175236186240358004044099091514930338900369886675005990687898507665880009509192577982265000195960680632675200295946362219208818811104695564396648767203</div><div> public exponent: 65537</div><div>2017-12-04 12:04:02,548 - DEBUG [org.apache.xml.security.utils.SignerOutputStream:64] - Canonicalized SignedInfo:</div><div>2017-12-04 12:04:02,548 - DEBUG [org.apache.xml.security.utils.SignerOutputStream:69] - <SignedInfo xmlns="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div><div> <CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"></CanonicalizationMethod></div><div> <SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"></SignatureMethod></div><div> <Reference URI="#_e0ffb229-c45d-428b-b44c-d306f5c58af6"></div><div> <Transforms></div><div> <Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"></Transform></div><div> <Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"></div><div> <InclusiveNamespaces xmlns="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>" PrefixList="#default md saml ds xs xsi"></InclusiveNamespaces></div><div> </Transform></div><div> </Transforms></div><div> <DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>"></DigestMethod></div><div> <DigestValue>JgZYpKMrgUQSBTEjRK/sLvXIzCw=</DigestValue></div><div> </Reference></div><div> </SignedInfo></div><div>2017-12-04 12:04:02,548 - WARN [org.apache.xml.security.signature.XMLSignature:760] - Signature verification failed.</div><div>2017-12-04 12:04:02,549 - ERROR [org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter:420] - Signature trust establishment failed for metadata entry <a href="https://eventcal.pima.edu/">https://eventcal.pima.edu/</a></div><div>2017-12-04 12:04:02,779 - WARN [org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter:251] - Saw fatal error validating metadata signature(s), metadata will be filtered out</div><div>org.opensaml.saml.metadata.resolver.filter.FilterException: Signature trust establishment failed for metadata entry</div><div> at org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter.verifySignature(SignatureValidationFilter.java:421)</div><div>2017-12-04 12:04:02,780 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractBatchMetadataResolver:285] - Metadata Resolver FilesystemMetadataResolver ADMD: Metadata filtering process produced a null document, resulting in an empty data set</div></div><div>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</div><div><br></div><div><br></div><div>Listed here are entries in the for the two SP's loaded in a<br></div><div><div><br></div><div><br></div><div>v3 metadata providers (InCommon loads ...Active Data errors out erros listed above)</div><div>++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</div><div><br></div><div><MetadataProvider id="ICMD"</div><div> xsi:type="FileBackedHTTPMetadataProvider"</div><div> backingFile="/opt/shibboleth-idp/metadata/InCommon-metadata.xml"</div><div> metadataURL="<a href="http://md.incommon.org/InCommon/InCommon-metadata.xml">http://md.incommon.org/InCommon/InCommon-metadata.xml</a>"></div><div> <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P15D"/></div><div> <MetadataFilter xsi:type="SignatureValidation" certificateFile="/opt/shibboleth-idp/credentials/inc-md-cert.pem"/></div><div> <MetadataFilter xsi:type="EntityRoleWhiteList" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"></div><div> <RetainedRole>md:SPSSODescriptor</RetainedRole></div><div> </MetadataFilter></div><div> </MetadataProvider></div><div><br></div><div> <MetadataProvider id="ADMD"</div><div> xsi:type="FilesystemMetadataProvider"</div><div> metadataFile="/opt/shibboleth-idp/metadata/PimaEventCalSP.xml"></div><div> <MetadataFilter xsi:type="SignatureValidation" certificateFile="/opt/shibboleth-idp/credentials/eventcal.crt"/></div><div> <MetadataFilter xsi:type="EntityRoleWhiteList" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"></div><div> <RetainedRole>md:SPSSODescriptor</RetainedRole></div><div> </MetadataFilter></div><div><br></div><div> </MetadataProvider></div><div><br></div><div>++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</div><div><br></div></div><div><br></div><div><br></div><div>here's what I was loading in v2 compatablility mode version of the metadata-providers.xml</div><div><br></div><div><br></div><div><br></div><div><div>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</div><div><br></div><div> <!-- Load Metadata for Active Data Calendar <a href="http://eventcal.pima.edu">eventcal.pima.edu</a> --></div><div><br></div><div> <metadata:MetadataProvider id="ADMD" xsi:type="metadata:FilesystemMetadataProvider" maxRefreshDelay="PT1H"</div><div> metadataFile="/opt/shibboleth-idp/metadata/PimaEventCalSP.xml" /></div><div><br></div><div><br></div><div><!-- The following MetadataProvider (a child element of a ChainingMetadataProvider)</div><div> refreshes the InCommon production metadata aggregate. --></div><div><br></div><div> <metadata:MetadataProvider id="ICMD" xsi:type="metadata:FileBackedHTTPMetadataProvider" maxRefreshDelay="PT1H"</div><div> metadataURL="<a href="http://md.incommon.org/InCommon/InCommon-metadata.xml">http://md.incommon.org/InCommon/InCommon-metadata.xml</a>"</div><div> backingFile="/opt/shibboleth-idp/metadata/InCommon-metadata.xml"></div><div> <metadata:MetadataFilter xsi:type="metadata:ChainingFilter"></div><div><br></div><div> <!--</div><div> Require a validUntil XML attribute on the EntitiesDescriptor element</div><div> and make sure its value is no more than 14 days into the future </div><div> --></div><div> <metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil" maxValidityInterval="P15D" /></div><div><br></div><div> <!--</div><div> Require the metadata to be signed and use the trust engine</div><div> labeled id="ICTrust" to determine its trustworthiness</div><div> --></div><div> <metadata:MetadataFilter xsi:type="metadata:SignatureValidation"</div><div> trustEngineRef="ICTrust" requireSignedMetadata="true" /></div><div><br></div><div> <!-- Consume all SP metadata in the aggregate --></div><div> <metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList"></div><div> <metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole></div><div> </metadata:MetadataFilter></div><div><br></div><div> </metadata:MetadataFilter></div><div> </metadata:MetadataProvider></div><div><br></div><div><br></div><div> <!-- ========================================== --></div><div> <!-- Security Configurations --></div><div> <!-- ========================================== --></div><div><br></div><div><security:TrustEngine id="ICTrust" xsi:type="security:StaticExplicitKeySignature"></div><div><br></div><div> <security:Credential id="MyFederation1Credentials" xsi:type="security:X509Filesystem"></div><div> <security:Certificate>/opt/shibboleth-idp/credentials/inc-md-cert.pem</security:Certificate></div><div> </security:Credential></div><div><br></div><div><br></div><div> <security:Credential id="EventCalCredentials" xsi:type="security:X509Filesystem"></div><div> <security:Certificate>/opt/shibboleth-idp/credentials/eventcal.crt</security:Certificate></div><div> </security:Credential></div><div><br></div><div><br></div><div></security:TrustEngine></div><div><br></div><div>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</div></div><div><br></div><div><br></div><div><br></div><div>Thanks in advance for any help! </div><div><br></div><div><br></div><div><br></div><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div>Brad Mathis</div><div>Principal Systems Analyst</div><div>Pima Community College</div><div>IT - Technical Services</div><div>520.206.4826</div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div>
</div>