<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Nate - I was able to re-produce my issue over here on a 2.4.3
version of the Shib IdP.<br>
Without being able to see the config for the TestShib IdP, it
seems like the issue may be related to PKIX trust. My SP signs
Authn requests with a self-signed certificate so what I'm thinking
is that TestShib is trying to validate the trust of my self signed
cert and cannot. <br>
</p>
<p>Does the TestShib IdP config have a MetadataExplicitKeySignature
trust engine?<br>
My 2.x IdPs all have the following signature trust engine defined
(which I think is the default) because the relying-party.xml
config file has "DO NOT EDIT BELOW THIS POINT":</p>
<pre><security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:SignatureChaining">
<b><security:TrustEngine id="shibboleth.SignatureMetadataExplicitKeyTrustEngine" xsi:type="security:MetadataExplicitKeySignature" metadataProviderRef="ShibbolethMetadata"/></b>
<security:TrustEngine id="shibboleth.SignatureMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXSignature" metadataProviderRef="ShibbolethMetadata"/>
</security:TrustEngine>
</pre>
If I remove the <b>bolded </b>trust engine, and only have the
SignatureMetadataPKIXTrustEngine like in the example below, I get
the exact same behavior that I see on TestShib.<br>
<pre><security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:SignatureChaining">
<security:TrustEngine id="shibboleth.SignatureMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXSignature" metadataProviderRef="ShibbolethMetadata"/>
</security:TrustEngine>
</pre>
Can you check the TestShib config for me? If the
MetadataExplicitKeySignature trust engine isn't there, self-signed
certificates cannot be used and all certs used for signing would
need to be issued by a trusted CA...<br>
<br>
<br>
<br>
<div class="moz-cite-prefix">On 4/26/2018 12:56 PM, Klingenstein,
Nate wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CY4PR01MB32854CFD7A1CD420ED18AF05DE8E0@CY4PR01MB3285.prod.exchangelabs.com">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper"
style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;"
dir="ltr">
<p style="margin-top:0;margin-bottom:0">The upgrade to 3 is
stalled because Kevin is a vastly more competent sysadmin than
I am and he hasn't had time to do his thing.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">I would've been slapping
up versions just like I always did. We're in a better place.</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt"
face="Calibri, sans-serif" color="#000000"><b>From:</b> users
<a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.net"><users-bounces@shibboleth.net></a> on behalf of Bobby
Lawrence <a class="moz-txt-link-rfc2396E" href="mailto:robertl@jlab.org"><robertl@jlab.org></a><br>
<b>Sent:</b> Thursday, April 26, 2018 7:22:30 AM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Subject:</b> Re: TestShib metadata issues?</font>
<div> </div>
</div>
<div style="background-color:#FFFFFF">
<p>So it seems that the SP side of this is good to go now, but
I'm still having an issue on the IdP side. I'm not sure what
it is yet but my SP works with the exact same config with
other IdPs at my site. One of them is shibboleth idp 3.3 and
one is 2.3.8 (which I'm in the process of retiring). I do see
that TestShib is running 2.4. Seems odd to me that this test
environment is almost a full version behind, but oh
well..maybe a TestShib 3 will pop up sometime lol.
<br>
</p>
<p>Anyway - is it at all possible to change the TestShib IdP
process log config and set the "org.opensaml" logger to DEBUG?
<br>
</p>
<br>
<div class="x_moz-cite-prefix">On 4/25/2018 7:22 PM, Nate
Klingenstein wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="x_gmail_extra">I cleared out two uploads that
were bad, but they had been there for some time, and it
looked like the aggregator was skipping them. The SP logs
appear like it was loading metadata happily without
incident except for a one-minute hiccup at 9:20 EDT with
no obvious cause.</div>
<div class="x_gmail_extra"><br>
</div>
<div class="x_gmail_extra">I'm able to look up your IdP now
and the metadata file is loading without incident. I was
talking with Kevin, but he stepped away right before it
worked, so I don't think he did anything. I don't know an
invocation URL for the SP, but I suspect it'll work.</div>
<div class="x_gmail_extra"><br>
</div>
<div class="x_gmail_extra">Thanks for letting us know
promptly, please let me know if it doesn't work for you,
and I blame tommyknockers.</div>
</div>
<br>
<fieldset class="x_mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="x_moz-signature" cols="72">--
Bobby Lawrence (<a class="x_moz-txt-link-abbreviated" href="mailto:robertl@jlab.org" moz-do-not-send="true">robertl@jlab.org</a>)
Jefferson Lab MIS
757-269-5818</pre>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Bobby Lawrence (<a class="moz-txt-link-abbreviated" href="mailto:robertl@jlab.org">robertl@jlab.org</a>)
Jefferson Lab MIS
757-269-5818</pre>
</body>
</html>