<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Sans Typewriter";
panose-1:2 11 5 9 3 5 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Lucida Sans Typewriter";
color:#1F497D;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">Hi Joshua,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">This looks like a problem on the SP. It looks like the SP does not have the metadata for your IDP. Does the SP fetch it dynamically from a URL or does it
read it from a local file? Looks like you publish your IDP metadata with InCommon and that your IDP entityID is “urn:mace:incommon:ncsu.edu” However, I browsed
</span><a href="https://shib.ncsu.edu/idp/shibboleth">https://shib.ncsu.edu/idp/shibboleth</a>
<span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">
and got a metadata file that looks wrong because it has references to “localhost.localdomain” Not a problem unless the SP is fetching this file.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">I browsed the link to your SP and I immediately got an error. I was not redirected to your IDP to login. So the problem is likely on the SP, or at least that
is where to start looking.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D">If the SP has a local copy of the IDP metadata, look for an expiration date at the top: validUntil=”expiration-date” If this has expired then that could be
the problem. You can edit the file and remove the validUntil attribute.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Steve Losen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ITS – Enterprise Infrastructure</span><span style="font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">University of Virginia<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="mailto:scl@virginia.edu"><span style="color:#0563C1">scl@virginia.edu</span></a> 434-924-0640</span><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Lucida Sans Typewriter";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Joshua Snapp<br>
<b>Sent:</b> Friday, June 14, 2019 6:12 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> SAML response signature is missing.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">We could use help. Our primary system admin for our shibboleth IdP is unreachable while on vacation.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Here's a little version info about our IdP:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">IdP version: 3.4.4<br>
Java version: 1.8.0_212<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">One of our SPs suddenly started receiving the following messages:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Error when logging into <a href="https://www.ebenefitsnow.com/sso/saml">
https://www.ebenefitsnow.com/sso/saml</a>:<br>
SAML response signature is missing.<br>
<br>
Other error reported by SP:<br>
No inbound configuration found for issuer:<br>
<a href="https://shib.ncsu.edu/idp/shibboleth">https://shib.ncsu.edu/idp/shibboleth</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Can anyone provide insight into what may cause this behavior? We haven't made any changes to our configuration on the IdP. The configuration files are in version control. The last commit was April 16th. This problem just started on June
11th.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks for any help you can provide.<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<p><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#212121">Joshua Snapp<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#212121">Systems Programmer - Identity and Web Services Group<br>
North Carolina State University - Office of Information Technology<o:p></o:p></span></p>
<p><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#212121">1.919.513.0183
<a href="mailto:jksnapp@ncsu.edu" target="_blank">jksnapp@ncsu.edu</a><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>