<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Has anyone run into a problem with configuring additional signing/encryption keys for IDP 3.4.6?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have a vendor who is complaining about a SHA1 signed RSA2048 self signed cert (not due to expire until 2032) and how they need to configure an exception to accept our signed responses (that they require) so we looked into creating a
new SHA256 MD/signed RSA2048 cert and added it as per:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration#SecurityConfiguration-SigningandEncryptionConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration#SecurityConfiguration-SigningandEncryptionConfiguration</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Creating a credentials.xml entry:<o:p></o:p></p>
<p class="MsoNormal"> <bean id="shibboleth.SHA256RSA2048SigningCredential"<o:p></o:p></p>
<p class="MsoNormal"> class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean"<o:p></o:p></p>
<p class="MsoNormal"> p:privateKeyResource="%{idp.signing.key.2}"<o:p></o:p></p>
<p class="MsoNormal"> p:certificateResource="%{idp.signing.cert.2}"<o:p></o:p></p>
<p class="MsoNormal"> p:entityId-ref="entityID" /><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">that references some new idp.properties values:<o:p></o:p></p>
<p class="MsoNormal">idp.signing.key.2 = %{idp.home}/credentials/idp-signing-new.key<o:p></o:p></p>
<p class="MsoNormal">idp.signing.cert.2 = %{idp.home}/credentials/idp-signing-new.crt<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">coupled with a relying-party configuration:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><bean id="SHA2SecurityConfig" parent="shibboleth.DefaultSecurityConfiguration"<o:p></o:p></p>
<p class="MsoNormal"> p:signatureSigningConfiguration-ref="shibboleth.SHA256RSA2048SigningCredential" /><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <bean parent="RelyingPartyByName"<o:p></o:p></p>
<p class="MsoNormal"> c:relyingPartyIds="#{{'http://fs.crisis24.com/adfs/services/trust'}}"><o:p></o:p></p>
<p class="MsoNormal"> <property name="profileConfigurations"><o:p></o:p></p>
<p class="MsoNormal"> <list> <o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.SSO" p:securityConfiguration-ref="SHA2SecurityConfig" /><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We get the following exception/error in our IDP process logs as pasted below, complaining about not being able to convert a property value of type 'org.opensaml.security.x509.BasicX509Credential' to required type 'org.opensaml.xmlsec.SignatureSigningConfiguration'
for property 'signatureSigningConfiguration'<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Digging further into the signatureSigningConfiguration, I don’t see other beans I could be referencing to configure these other than the ones documented here (the above is using the resources based bean vs the inline one):
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/CredentialBeanFactories">
<span style="color:blue">https://wiki.shibboleth.net/confluence/display/IDP30/CredentialBeanFactories</span></a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Error entry in log:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Caused by: org.springframework.beans.factory.BeanCreationException:<o:p></o:p></p>
<p class="MsoNormal"> Error creating bean with name 'SHA2SecurityConfig' defined in file [/idm/AuthenticationServices/shibboleth-idp/conf/relying-party.xml]:<o:p></o:p></p>
<p class="MsoNormal"> Initialization of bean failed; nested exception is org.springframework.beans.ConversionNotSupportedException:<o:p></o:p></p>
<p class="MsoNormal"> Failed to convert property value of type 'org.opensaml.security.x509.BasicX509Credential' to required type 'org.opensaml.xmlsec.SignatureSigningConfiguration' for property 'signatureSigningConfiguration'; nested exception is java.lang.IllegalStateException:
Cannot convert value of type 'org.opensaml.security.x509.BasicX509Credential' to required type 'org.opensaml.xmlsec.SignatureSigningConfiguration' for property 'signatureSigningConfiguration': no matching editors or conversion strategy found at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:562)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Caused by: org.springframework.beans.ConversionNotSupportedException:<o:p></o:p></p>
<p class="MsoNormal"> Failed to convert property value of type 'org.opensaml.security.x509.BasicX509Credential' to required type 'org.opensaml.xmlsec.SignatureSigningConfiguration' for property 'signatureSigningConfiguration'; nested exception is java.lang.IllegalStateException:
Cannot convert value of type 'org.opensaml.security.x509.BasicX509Credential' to required type 'org.opensaml.xmlsec.SignatureSigningConfiguration' for property 'signatureSigningConfiguration': no matching editors or conversion strategy found<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.AbstractNestablePropertyAccessor.convertIfNecessary(AbstractNestablePropertyAccessor.java:603)<o:p></o:p></p>
<p class="MsoNormal">Caused by: java.lang.IllegalStateException: Cannot convert value of type 'org.opensaml.security.x509.BasicX509Credential' to required type 'org.opensaml.xmlsec.SignatureSigningConfiguration' for property 'signatureSigningConfiguration':
no matching editors or conversion strategy found<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.TypeConverterDelegate.convertIfNecessary(TypeConverterDelegate.java:307)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#A00000">David Mak</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;color:#A00000">Identity Services Specialist</span></b><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Information Technology Services</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Northeastern University</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">360 Huntington Ave. Boston MA 02115-5000</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Mail Stop: 356-C2</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Office: 617-373-7836 <span style="background:#FFFEFE">Mobile: 617-840-7543</span></span><o:p></o:p></p>
</div>
</div>
</body>
</html>