<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";
mso-fareast-language:EN-GB;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang="EN-GB" link="#0563C1" vlink="#954F72"><div class="WordSection1"><p class="MsoNormal">Kevin – thanks for the swift response! I’ll give that a go.</p><p class="MsoNormal"> </p><div><div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm"><p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:EN-GB">From:</span></b><span lang="EN-US" style="mso-fareast-language:EN-GB"> users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> <b>On Behalf Of </b>Kevin Foote<br><b>Sent:</b> 26 October 2018 14:58<br><b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br><b>Subject:</b> Re: Our SP metadata uploaded but <a href="http://testshib.org">testshib.org</a> IdP reports can't find it</span></p></div></div><p class="MsoNormal"> </p><p class="MsoNormal">Stephen, <span style="mso-fareast-language:EN-GB"></span></p><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">See posts from earlier this month.</p></div><div><p class="MsoNormal">(Last week even)</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Use <a href="http://samltest.id">samltest.id</a> </p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt">Testshib is largely unmaintained at this point.</p><div id="AppleMailSignature"><p class="MsoNormal">- sent from mobile</p></div><div><p class="MsoNormal" style="margin-bottom:12.0pt"><br>On Oct 26, 2018, at 7:54 AM, Stephen Bayliss <<a href="mailto:stephen.bayliss@datum360.com">stephen.bayliss@datum360.com</a>> wrote:</p></div><blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"><div><p class="MsoNormal">Hi there</p><p class="MsoNormal"> </p><p class="MsoNormal">I’ve seen this issue reported by others and then resolved by some action at <a href="http://secure-web.cisco.com/1zFi549JPAynQdji-_suiV2Q0Q0nG83YEMIIon7L7UMZw-lQbioRDdz1dkvAJV_s7n69tSR1KZlv5I1aifqZQX1Xxm6zEwvxKE1MX-7CZKBUlxXLoto6NHl5xzubFQg20_bJ__iBKIRomWMET00ABTGungJWC_TiOozhJ0EWqaHa_V3q5SFIMdQi6eLjGxP30R4T-Xg2N_FOWzPpgNcuAWMi1OE2gha7yw2pQ3ti0_67RBh2vcPSgdFFTSWLGz9xmhlxlVhXIG_6YEJHGLoK_cFhrA1JZIwUYQBh_KYWDKBWHyJOJj_E2Jy2_dZ0uWswCdlfwJgWzO6a1z1xAERyAUSoYLRbyjrofQ9vheK1ZBDilAGEWPoyBdWNm_LcZKUHf_IhTdFA2CrCP-WuUhp0BjzRveElzBjFFIPGQfI9ZZfZ6h6IjbHYQHHr9DhaGYcMy9fjWv3MipM03CIVDBxojWg/http%3A%2F%2Ftestshib.org">testshib.org</a> so I’m hoping my issue is the same.</p><p class="MsoNormal"> </p><p class="MsoNormal">Some while ago I uploaded SP metadata, entityID <a href="https://secure-web.cisco.com/1pULrggO8Wp5uelPd6yhyIzyvlm-IuddB6XFcJg01uTsokMW0DleKIRQ_l5CXJQ2NZwJrU-SfDFDQFrOxT38kPWDPZ4x1P24VzmYgYWi_kWy35tVK4jJWqwQ6Ufg4UA2XBgNgsJ-6TXK8aEtcGKfSwp_loGRETMW3F_OPNzbm7oK26WdTmCKR2aa7xIUpyV0txH1ohzkJV5u-Ofw5ByuIkIQTjVM1u_Bp7xDsbpIZI4rD806q8zA3oY2io-4IqnA8kLhhP76iiaXRAToi-ydQGjB9PTBtL87TrMmzSlJAYR5_G_tK-eaPm9-SNtNp6qWJq4Fj_glZnqmAFtuNZgTAWuFos_pAyZ6qp03rL-1gTBpi-2dKWeUu2kDyLekCYggYKy5Y49EigO9vCsKZ3tZmp-c7PE_XYV8e1z4Qiwi2MFO5OFQQOTsqX0pw7R5sFMrQt_7_Gg8A004vU488XekCPA/https%3A%2F%2Fwww.datum360.com%2Fshibtest">https://www.datum360.com/shibtest</a> and I was happily able to use that – and can still use that today (though interestingly it isn’t listed at <a href="http://secure-web.cisco.com/1ottcJhk57A3uy582aY7V62O4GRp6acvpcRsFF00tO7yHlDeUHe-Vyo7HgQ7uRbXEx0TDhSLM4S4pc7i31svX_ttJinkkhibiYd7HFda7cdATJDT5GwWbiU_RP_YxuZl7ep10xY6ieEWhWOvxHaWXiOUyTpV_Uyn8s78RDR5XxZ0z2h4oC7vgRFq9vTvQRsifjEA66dRUEyUmsySL3_bRhPf3VaGxEHI22UqqoZuP5Gy2kjwfVOjdzrkwBMYzxom0TEcCtsfB-5CpIdgKwHtOrGlhvYvkQyNbVQMdMC_0CqApEVPWs7yjA1ty6ekNpFhu6cGvUGTQy2c_y8FNwUE2ul0lIwiJ94jnRUxGPw4iuFSp-J6uMssNEePDx7xdJ79yg4G5RensSiLC9LWfGKKUrNdUvn4YUZlc9-CB05i01CmN1S2drz9rQm7WaW46sslZWOA1yHD4MQeKipTe09Uv3A/http%3A%2F%2Fwww.testshib.org%2Fentities.html">http://www.testshib.org/entities.html</a> )</p><p class="MsoNormal"> </p><p class="MsoNormal">Today I uploaded a new SP metadata file, which is basically similar to the previous one but with a different entityID of <a href="https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io">https://dev-sb.acl360.io</a> and a different callback URL – that is listed at <a href="http://secure-web.cisco.com/1ottcJhk57A3uy582aY7V62O4GRp6acvpcRsFF00tO7yHlDeUHe-Vyo7HgQ7uRbXEx0TDhSLM4S4pc7i31svX_ttJinkkhibiYd7HFda7cdATJDT5GwWbiU_RP_YxuZl7ep10xY6ieEWhWOvxHaWXiOUyTpV_Uyn8s78RDR5XxZ0z2h4oC7vgRFq9vTvQRsifjEA66dRUEyUmsySL3_bRhPf3VaGxEHI22UqqoZuP5Gy2kjwfVOjdzrkwBMYzxom0TEcCtsfB-5CpIdgKwHtOrGlhvYvkQyNbVQMdMC_0CqApEVPWs7yjA1ty6ekNpFhu6cGvUGTQy2c_y8FNwUE2ul0lIwiJ94jnRUxGPw4iuFSp-J6uMssNEePDx7xdJ79yg4G5RensSiLC9LWfGKKUrNdUvn4YUZlc9-CB05i01CmN1S2drz9rQm7WaW46sslZWOA1yHD4MQeKipTe09Uv3A/http%3A%2F%2Fwww.testshib.org%2Fentities.html">http://www.testshib.org/entities.html</a> but when I try and use it I am getting the error </p><p class="MsoNormal"> </p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">09:42:30.706 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for <a href="https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io">https://dev-sb.acl360.io</a></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">09:42:30.706 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for <a href="https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io">https://dev-sb.acl360.io</a>, looking up configuration based on metadata groups.</span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">09:42:30.706 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for <a href="https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io">https://dev-sb.acl360.io</a>. Using default relying party configuration.</span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">09:42:30.707 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID '<a href="https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io">https://dev-sb.acl360.io</a>' could not be resolved</span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">09:42:30.707 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195] - Simple signature validation (with no request-derived credentials) failed</span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">09:42:30.707 - WARN [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138] - Validation of request simple signature failed for context issuer: <a href="https://secure-web.cisco.com/1mvYR0Wlr3nmYVQuvmEWlEKgVYLLMb-5iqzQwOKCccMGdi-jMNf7u4gw5XhundsFmdnJFOlrl1nwVzV-bhQKcSBEpIAo8QLRKLiXzJ2l5ltbxT2TGfUMyXTAOY_CZ8yV0AfjFQP2OS26ONFHzlueBgfVE-zNOI-ROHRUQyFFOr-bHmoCRwyBZtD9CY6Oq9WBpXXEJL7B0DNvq4FhkMg9949oBqEyv2332QKmenhkj7q6wOwjH5V1f35ovchU0uEZoUSgn-AskGc_zs0Woj5i4yc15DT37-M_g-EFTbayt_tdaRrqGMMCAzIWuJqtTsmaWqeeyygsl7OxjlVt_jRlkhh-lQZmCHaQtHkvFrznA2eSPLcXBrlI9YSgtfVyTUMRfM1Qeszk60Fx6iDEVHcC9vtDgsfF1AgMupodq60U_BhAI2Psh_qXBoj_qkVnQX3Yt/https%3A%2F%2Fdev-sb.acl360.io">https://dev-sb.acl360.io</a></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">09:42:30.708 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements</span></p><pre>org.opensaml.ws.security.SecurityPolicyException: Validation of request simple signature failed for context issuer</pre><pre> at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.doEvaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:139) ~[opensaml-2.6.0.jar:na]</pre><pre> at org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule.evaluate(BaseSAMLSimpleSignatureSecurityPolicyRule.java:103) ~[opensaml-2.6.0.jar:na]</pre><pre> at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51) ~[openws-1.5.0.jar:na]</pre><pre> at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132) ~[openws-1.5.0.jar:na]</pre><pre> at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83) ~[openws-1.5.0.jar:na]</pre><pre> at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) ~[opensaml-2.6.0.jar:na]</pre><pre> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.0.jar:na]</pre><pre> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]</pre><pre> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]</pre><pre> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]</pre><pre> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]</pre><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""> </span></p><p class="MsoNormal"> </p><p class="MsoNormal">A recent similar report <a href="http://shibboleth.1660669.n2.nabble.com/TestShib-metadata-issues-td7638474.html">http://shibboleth.1660669.n2.nabble.com/TestShib-metadata-issues-td7638474.html</a></p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal"> </p><p class="MsoNormal">Regards</p><p class="MsoNormal">Steve</p></div></blockquote><blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"><div><p class="MsoNormal"><span style="mso-fareast-language:EN-GB">-- <br>For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></span></p></div></blockquote></div></div></body></html>