<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 9/14/18 5:12 PM, Goebel, Brent
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:c340c8c5a13c47d5bbba19824ffff365@utdallas.edu">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi all, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been getting a few of the signature
verification errors (example below) lately and was wondering
if anyone could provide insight about this error. </p>
</div>
</blockquote>
<br>
To be clear, are you just seeing this logged at level ERROR, and
otherwise things are functioning normally? That's what I would
expect from reviewing the code. <br>
<br>
<br>
<blockquote type="cite"
cite="mid:c340c8c5a13c47d5bbba19824ffff365@utdallas.edu">
<div class="WordSection1">
<p class="MsoNormal">I’m using Java 8 version 91. I did some
research on the error and see a forum back in 2013 but at that
provided some thoughts on what it may be from (exception when
SP has multiple certs that have different lengths) but at the
time was determined a bug that was fixed shortly after. Link
to forum:
<a
href="http://shibboleth.1660669.n2.nabble.com/Signature-verification-exception-on-Java-7-td7584343.html"
moz-do-not-send="true">
http://shibboleth.1660669.n2.nabble.com/Signature-verification-exception-on-Java-7-td7584343.html</a>.
</p>
</div>
</blockquote>
<br>
That was similar in its root nature, but very different in end
behavior, in that we weren't catching the error and allowing other
credentials could be tried. So if the first cred's cert key length
was not equal to that of the signing key, the thrown exception was
being propagated out and preventing the trust engine from trying the
next cred with the "good" key. That was fixed so that the exception
is caught and the other credentials tried. In this case, one would
still see the ERROR level logging from SigningUtil b/c we can't
distinguish this case from a "real" error.<br>
<br>
So if you're just seeing the ERROR logging but otherwise everything
is working fine, then that's what we would expect at this point.
It's not ideal but since we can't distinguish the exception cause,
there's probably not much else we can do.<br>
<br>
What would make this log output go away is either removing the "bad"
credential from the SP's metadata, or re-ordering them so that the
"good" cred appears in document order before the "bad" one. If
you're not in control of the SP's metadata then obviously you can't
do that. But if there are 2 SP signing certs because of an
in-progress key rollover, then hopefully eventually the older "bad"
one will be removed at some point by the metadata publisher.<br>
<br>
Thanks,<br>
(not the same) Brent<br>
</body>
</html>