<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4275">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: Error using Testshib as IdP - SPSSODescriptor role metadata for entityID [REDACTED] could not be resolved</title>
</head>
<body>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Matthew,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Several people have reported that on the list over a similar timeframe and I suppose that TestShib is probably gummed up on some metadata that someone else uploaded, causing the entire batch to go bad. Until someone roots out the bad metadata, it's unlikely that TestShib will be functional, and I don't know if anyone has been enlisted to do that.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">SAMLtest at <a href="https://samltest.id" _src="https://samltest.id">https://samltest.id</a> offers a modern alternative using the latest releases of Shibboleth, and it was built by the people who originally built TestShib. I invite anyone on the list to give it a try and it is being very actively supported by Signet.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Internet2 has decided to take TestShib in another direction, so they would be the authority on the current situation and future plans. Kevin Foote of the University of Colorado at Boulder and I had been the volunteer maintainers of TestShib and were not made aware of those plans, so we wouldn't be able to speak to them.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Best,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Nate.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Matthew Ray<br /><strong>Sent:</strong> Monday, October 22 2018, 10:43 am<br /><strong>To:</strong> Shib Users<br /><strong>Subject:</strong> Error using Testshib as IdP - SPSSODescriptor role metadata for entityID [REDACTED] could not be resolved<br /><br /><!-- begin sanitized html --><style type="text/css"><-- P {margin-top:0;margin-bottom:0;} --></style><div class="bodyclass"><div id="divtagdefaultwrapper" dir="ltr" style="color:#000000; font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><div id="divtagdefaultwrapper" dir="ltr" style="color:#000000; font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:12pt"><div>Hello all,</div><div> </div><div>We have a number of test environments that use Testshib for an IdP as a kind of sanity check, just to make sure that our SSO functionality isn't completely broken. As of ~2 weeks ago, we started get errors across multiple test environments when sending a SAML request to Testshib. I tried re-registering the SP metadata files in case those expired, but it made no difference. <span>I don't think anything major changed on our end (though I could be wrong, of course), so I</span>'m beginning to think that the problem might be on the Testshib end. Could anyone explain what is happening? A typical error log from Testshib and a copy of one of our SP metadata files are below.</div><div> </div><div>ERROR LOG:</div><div>18:22:01.453 - INFO [Shibboleth-Access:73] - 20181019T222201Z|[REDACTED IP ADDRESS]|idp.testshib.org:443|/profile/SAML2/Redirect/SSO|<br />18:22:01.454 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO<br />18:22:01.454 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler<br />18:22:01.454 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:339] - LoginContext key cookie was not present in request<br />18:22:01.454 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:188] - Incoming request does not contain a login context, processing as first leg of request<br />18:22:01.455 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:366] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'<br />18:22:01.466 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for [REDACTED ID]<br />18:22:01.467 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for [REDACTED ID], looking up configuration based on metadata groups.<br />18:22:01.467 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for [REDACTED ID]. Using default relying party configuration.<br />18:22:01.469 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID '[REDACTED ID]' could not be resolved<br />18:22:01.469 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195] - Simple signature validation (with no request-derived credentials) failed<br />18:22:01.470 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer: [REDACTED ID]<br />18:22:01.471 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements<br />org.opensaml.ws.security.SecurityPolicyException: Validation of request simple signature failed for context issuer<br /> at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.doEvaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:139) ~[opensaml-2.6.0.jar:na]<br /> at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.evaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:103) ~[opensaml-2.6.0.jar:na]<br /> at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51) ~[openws-1.5.0.jar:na]<br /> at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132) ~[openws-1.5.0.jar:na]<br /> at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83) ~[openws-1.5.0.jar:na]<br /> at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) ~[opensaml-2.6.0.jar:na]<br /> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.0.jar:na]<br /> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]<br /> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]<br /> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]<br /> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]<br /> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]<br /> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.36]<br /> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<br /> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]<br /> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<br /> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<br /> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.0.jar:na]<br /> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<br /> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<br /> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]<br /> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<br /> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<br /> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.36]<br /> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.36]<br /> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:470) [catalina.jar:6.0.36]<br /> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.36]<br /> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) [catalina.jar:6.0.36]<br /> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.36]<br /> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:6.0.36]<br /> at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote.jar:6.0.36]<br /> at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:311) [tomcat-coyote.jar:6.0.36]<br /> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:776) [tomcat-coyote.jar:6.0.36]<br /> at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:705) [tomcat-coyote.jar:6.0.36]<br /> at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:898) [tomcat-coyote.jar:6.0.36]<br /> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote.jar:6.0.36]<br /> at java.lang.Thread.run(Thread.java:745) [na:1.7.0_55]<br /><br />SP METADATA:<br /><?xml version="1.0" encoding="UTF-8"?><br /><md:EntityDescriptor entityID="[REDACTED]" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"><br /> <md:SPSSODescriptor AuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br /> <md:KeyDescriptor><br /> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><br /> <ds:KeyName>[REDACTED]</ds:KeyName><br /> <ds:X509Data><br /> <ds:X509Certificate>[REDACTED]</ds:X509Certificate><br /> </ds:X509Data><br /> </ds:KeyInfo><br /> </md:KeyDescriptor><br /> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://localhost:8080/sso/response" index="0" isDefault="true"/><br /> <md:AttributeConsumingService index="0" isDefault="true"><br /> <md:ServiceName xml:lang="en">Service Attributes</md:ServiceName><br /> <md:RequestedAttribute FriendlyName="urn:oid:0.9.2342.19200300.100.1.1" Name="uid" isRequired="true"/><br /> </md:AttributeConsumingService><br /> </md:SPSSODescriptor><br /></md:EntityDescriptor></div></div><div dir="ltr" style="color:#000000; font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:12pt"> </div><div dir="ltr" style="color:#000000; font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:12pt">Thanks,</div><div dir="ltr" style="color:#000000; font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:12pt">Matthew Ray<p> </p></div></div></div><pre>--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre> <!-- end sanitized html --></blockquote>
</body>
</html>