<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 8/6/18 2:29 PM, Cody Carmichael
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAL9ddzJgZ=DdRMEFDiAY+SX1caDrQ9iorBLe0wNpR45yH=qzfg@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<div dir="ltr">
<div><span
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">What
I put for my original metadata-rpovider was a poor
copy/paste, sorry.</span></div>
<div><span
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br>
</span></div>
<span
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">When
I configure my metadata provider like so:</span>
<div
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><br>
</div>
<div
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex"><MetadataProvider
id="LocalEntityMetadataCRC" xsi:type="<wbr>FilesystemMetadataProvider"<br>
metadataFile="/opt/shibboleth-<wbr>idp/metadata/meta-cert2.xml"><br>
</MetadataProvider></blockquote>
<div><br>
</div>
<div>It's able to resolve it, per the logs</div>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">Metadata Resolver
FilesystemMetadataResolver LocalEntityMetadataCRC: Resolved
1 candidates via EntityIdCriterion: EntityIdCriterion [id=<a
href="https://mysp.net/rest/v2/sso/message/shibboleth/metadata"
target="_blank" style="color:rgb(17,85,204)"
moz-do-not-send="true">https://mySP.net/rest/v2/<wbr>sso/message/shibboleth/<wbr>metadata</a>]
<br>
</blockquote>
</div>
</div>
</blockquote>
<br>
Ok, good. Then there's nothing fundamentally wrong with the
metadata itself.<br>
<br>
<blockquote type="cite"
cite="mid:CAL9ddzJgZ=DdRMEFDiAY+SX1caDrQ9iorBLe0wNpR45yH=qzfg@mail.gmail.com">
<div dir="ltr">
<div
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<div><br>
</div>
If I recall correctly, this is because there are no configured
child elements so it falls back to using the well-known
location strategy (which I guess means it uses the entityID?
Unless falling back to the well-known location strategy is
just for <wbr>DynamicHTTPMetadataProvider where that warning
about lack of child filters is documented).</div>
</div>
</blockquote>
<br>
The well-known location issue is only for the DynamicHTTP- provider,
and not relevant for any others, including the Filesystem- one.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAL9ddzJgZ=DdRMEFDiAY+SX1caDrQ9iorBLe0wNpR45yH=qzfg@mail.gmail.com">
<div dir="ltr">
<div
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
But I would like to configure the metadata provider with
SignatureValidation. So I configured the metadata-provider
thusly:</div>
<div
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><br>
</div>
<div
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex"><MetadataProvider
id="LocalEntityMetadataCRC" xsi:type="<wbr>FilesystemMetadataProvider"<br>
metadataFile="/opt/shibboleth-<wbr>idp/metadata/meta-cert2.xml"><br>
<MetadataFilter xsi:type="SignatureValidation"
certificateFile="%{idp.home}/<wbr>credentials/cert.pem"
/><br>
</MetadataProvider></blockquote>
<div><br>
</div>
</div>
</div>
</blockquote>
<br>
There's nothing obviously wrong (that I can see) with the syntax,
etc, so....<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAL9ddzJgZ=DdRMEFDiAY+SX1caDrQ9iorBLe0wNpR45yH=qzfg@mail.gmail.com">
<div dir="ltr">
<div
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<div>And the logs tell me this:</div>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">Metadata Resolver
FilesystemMetadataResolver LocalEntityMetadataCRC: Metadata
backing store does not contain any EntityDescriptors with
the ID:<span> </span><a
href="https://mysp.net/rest/v2/sso/message/shibboleth/metadata"
target="_blank" style="color:rgb(17,85,204)"
moz-do-not-send="true">https://mySP.net/rest/v2/sso/<wbr>message/shibboleth/metadata</a></blockquote>
<div> </div>
<div>So what's happening here? The cert.pem contains the
public key that was used to sign the metadata. </div>
</div>
</div>
</blockquote>
<br>
It's 99.9% certain that the signature validation is failing, and so
the message is correct. If that is the case, you should have clear
logs indicating the signature failure.<br>
<br>
Didn't you post last week-ish about something failing with signature
validation? IIRC you had some custom metadata signing from your
org's developer, and the signature digest wasn't matching the
validation digest. If you still haven't resolved that, then it's
not going to work. Or if you did resolve that, then there's still
something wrong with signature validation, such as the validation
cert you're pointing at doesn't match the private key used to sign.<br>
<br>
<blockquote type="cite"
cite="mid:CAL9ddzJgZ=DdRMEFDiAY+SX1caDrQ9iorBLe0wNpR45yH=qzfg@mail.gmail.com">
<div dir="ltr">
<div
style="font-size:small;text-decoration-style:initial;text-decoration-color:initial">
<div>If it's not using the entityID anymore because of the
presence of a child element, and it's not using the ID in
the metadata, what is it using? What's the big giant
elephant I'm missing?</div>
</div>
</div>
<div class="gmail_extra"><br>
</div>
</blockquote>
<br>
It's nothing like that. The fact that it works without the
SignatureValidation filter tells you that the metadata and entityID
fundamentally are correct. It's a virtual certainly that the
metadata is simply not passing the signature validation check.
Again, you should see earlier log messages about that failure.<br>
</body>
</html>