<div dir="ltr"><div class="gmail_extra">Yes I did post last week about the logs showing different values for the expected and actual digest values. The logs are no longer showing messages about that. Right now the logs spit out the decoded SAML message that contains stuff for the AuthnRequest like the DigestMethod, DigestValue, SignatureValue, KeyInfo, etc... And then right after that is the message that the Metadata backing store does not contain any EntityDescriptors. </div><div class="gmail_extra"><br></div><div class="gmail_extra">There is also this message at the end of the log:</div><div class="gmail_extra"><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Profile Action SelectProfileConfiguration: Profile <a href="http://shibboleth.net/ns/profiles/saml2/sso/browser">http://shibboleth.net/ns/profiles/saml2/sso/browser</a> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID <a href="https://mySP.net/rest/v2/sso/message/shibboleth/metadata">https://mySP.net/rest/v2/sso/message/shibboleth/metadata</a>)</blockquote><div class="gmail_extra"><br></div><div class="gmail_extra">But I figured that was because it's calling my SP unverified because it's not finding the metadata, and it's not finding the metadata for reasons I haven't figured out. If the signature validation check is still failing, the logs are not giving any indication of it. </div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Aug 6, 2018 at 2:39 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF"><span class="gmail-">
<p><br>
</p>
<br>
<div class="gmail-m_-831056527518250935moz-cite-prefix">On 8/6/18 2:29 PM, Cody Carmichael
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div><span style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">What
I put for my original metadata-rpovider was a poor
copy/paste, sorry.</span></div>
<div><span style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br>
</span></div>
<span style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">When
I configure my metadata provider like so:</span>
<div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><br>
</div>
<div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><MetadataProvider
id="LocalEntityMetadataCRC" xsi:type="FilesystemMetadataPr<wbr>ovider"<br>
metadataFile="/opt/shibboleth-<wbr>idp/metadata/meta-cert2.xml"><br>
</MetadataProvider></blockquote>
<div><br>
</div>
<div>It's able to resolve it, per the logs</div>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Metadata Resolver
FilesystemMetadataResolver LocalEntityMetadataCRC: Resolved
1 candidates via EntityIdCriterion: EntityIdCriterion [id=<a href="https://mysp.net/rest/v2/sso/message/shibboleth/metadata" style="color:rgb(17,85,204)" target="_blank">https://mySP.net/rest/v2/s<wbr>so/message/shibboleth/metadata</a><wbr>]
<br>
</blockquote>
</div>
</div>
</blockquote>
<br></span>
Ok, good. Then there's nothing fundamentally wrong with the
metadata itself.<span class="gmail-"><br>
<br>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<div><br>
</div>
If I recall correctly, this is because there are no configured
child elements so it falls back to using the well-known
location strategy (which I guess means it uses the entityID?
Unless falling back to the well-known location strategy is
just for DynamicHTTPMetadataProvide<wbr>r where that warning
about lack of child filters is documented).</div>
</div>
</blockquote>
<br></span>
The well-known location issue is only for the DynamicHTTP- provider,
and not relevant for any others, including the Filesystem- one.<span class="gmail-"><br>
<br>
<br>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
But I would like to configure the metadata provider with
SignatureValidation. So I configured the metadata-provider
thusly:</div>
<div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><br>
</div>
<div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><MetadataProvider
id="LocalEntityMetadataCRC" xsi:type="FilesystemMetadataPr<wbr>ovider"<br>
metadataFile="/opt/shibboleth-<wbr>idp/metadata/meta-cert2.xml"><br>
<MetadataFilter xsi:type="SignatureValidation"
certificateFile="%{idp.home}/c<wbr>redentials/cert.pem"
/><br>
</MetadataProvider></blockquote>
<div><br>
</div>
</div>
</div>
</blockquote>
<br></span>
There's nothing obviously wrong (that I can see) with the syntax,
etc, so....<span class="gmail-"><br>
<br>
<br>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<div>And the logs tell me this:</div>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Metadata Resolver
FilesystemMetadataResolver LocalEntityMetadataCRC: Metadata
backing store does not contain any EntityDescriptors with
the ID:<span> </span><a href="https://mysp.net/rest/v2/sso/message/shibboleth/metadata" style="color:rgb(17,85,204)" target="_blank">https://mySP.net/rest/v2/<wbr>sso/message/shibboleth/<wbr>metadata</a></blockquote>
<div> </div>
<div>So what's happening here? The cert.pem contains the
public key that was used to sign the metadata. </div>
</div>
</div>
</blockquote>
<br></span>
It's 99.9% certain that the signature validation is failing, and so
the message is correct. If that is the case, you should have clear
logs indicating the signature failure.<br>
<br>
Didn't you post last week-ish about something failing with signature
validation? IIRC you had some custom metadata signing from your
org's developer, and the signature digest wasn't matching the
validation digest. If you still haven't resolved that, then it's
not going to work. Or if you did resolve that, then there's still
something wrong with signature validation, such as the validation
cert you're pointing at doesn't match the private key used to sign.<span class="gmail-"><br>
<br>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<div>If it's not using the entityID anymore because of the
presence of a child element, and it's not using the ID in
the metadata, what is it using? What's the big giant
elephant I'm missing?</div>
</div>
</div>
<div class="gmail_extra"><br>
</div>
</blockquote>
<br></span>
It's nothing like that. The fact that it works without the
SignatureValidation filter tells you that the metadata and entityID
fundamentally are correct. It's a virtual certainly that the
metadata is simply not passing the signature validation check.
Again, you should see earlier log messages about that failure.<br>
</div>
</blockquote></div><div><br></div>
</div></div>