<div dir="ltr">We are running Ubuntu 16.04 and shibboleth 3.4.4. We just recently installed the OpenIDconnect extension. The issue we are having is our vendor not being able to validate our signature. Here are the logs from the vendor:<div><br></div><div>Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX10503: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.RsaSecurityKey , KeyId: defaultRSASign<br>'.<br>Exceptions caught:<br> ''.<br>token: '{"alg":"RS256"}.{"at_hash":"MQ9mmGD21TGUZoi7upGWsA","sub":"QRTJVALNIMC5DD6AUN5UY5524AROJ6QT","aud":"tada_rp","auth_time":1591204281,"iss":"<a href="https://logon.bradley.edu/idp/shibboleth" target="_blank">https://logon.bradley.edu/idp/shibboleth</a>","exp":1591207882,"iat":1591204282,"nonce":"637268010769333171.MmVmNDFhNzgtY2I0OS00ZGMyLWE4NTQtNjRjNWJhNmI0NDMyNzU1Njg0NWEtMjlhNy00YTMyLWFiZTYtMDU3NjVlOTI0YTk1"}'.<br>   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters) in C:\agent2\_work\15\s\src\System.IdentityModel.Tokens.Jwt\JwtSecurityTokenHandler.cs:line 1009<br>   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken) in C:\agent2\_work\15\s\src\System.IdentityModel.Tokens.Jwt\JwtSecurityTokenHandler.cs:line 746<br>   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.ValidateToken(String idToken, AuthenticationProperties properties, TokenValidationParameters validationParameters, JwtSecurityToken& jwt)<br>   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()<br><br>   System.Exception: An error was encountered while handling the remote login. ---> Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX10503: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.RsaSecurityKey , KeyId: defaultRSASign<br>'.<br>Exceptions caught:<br> ''.<br>token: '{"alg":"RS256"}.{"at_hash":"MQ9mmGD21TGUZoi7upGWsA","sub":"QRTJVALNIMC5DD6AUN5UY5524AROJ6QT","aud":"tada_rp","auth_time":1591204281,"iss":"<a href="https://logon.bradley.edu/idp/shibboleth" target="_blank">https://logon.bradley.edu/idp/shibboleth</a>","exp":1591207882,"iat":1591204282,"nonce":"637268010769333171.MmVmNDFhNzgtY2I0OS00ZGMyLWE4NTQtNjRjNWJhNmI0NDMyNzU1Njg0NWEtMjlhNy00YTMyLWFiZTYtMDU3NjVlOTI0YTk1"}'.<br>   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters) in C:\agent2\_work\15\s\src\System.IdentityModel.Tokens.Jwt\JwtSecurityTokenHandler.cs:line 1009<br>   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken) in C:\agent2\_work\15\s\src\System.IdentityModel.Tokens.Jwt\JwtSecurityTokenHandler.cs:line 746<br>   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.ValidateToken(String idToken, AuthenticationProperties properties, TokenValidationParameters validationParameters, JwtSecurityToken& jwt)<br>   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()<br>   --- End of inner exception stack trace ---<br>   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()<br>   at IdentityServer4.Hosting.FederatedSignOut.AuthenticationRequestHandlerWrapper.HandleRequestAsync() in C:\local\identity\server4\IdentityServer4\src\Hosting\FederatedSignOut\AuthenticationRequestHandlerWrapper.cs:line 38<br>   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)<br>   at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context)<br>   at IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context) in C:\local\identity\server4\IdentityServer4\src\Hosting\BaseUrlMiddleware.cs:line 36<br>   at Microsoft.AspNetCore.Builder.Extensions.MapMiddleware.Invoke(HttpContext context)<br>   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)</div><div><br></div><div><br></div><div><br></div><div>Our IDP Configuration:</div><div>Aside from the installation instructions, we added this into the relying-party.xml:</div><div><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">        </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><bean </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(47,180,29)">parent</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">=</span><span style="font-variant-ligatures:no-common-ligatures">"RelyingPartyByName"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"> </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(47,180,29)">c</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(64,11,217)">:</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(47,180,29)">relyingPartyIds</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">=</span><span style="font-variant-ligatures:no-common-ligatures">"tada_rp"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"> ></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">            </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><property </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(47,180,29)">name</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">=</span><span style="font-variant-ligatures:no-common-ligatures">"profileConfigurations"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)">></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">                </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><list></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(47,180,29)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">                    </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><bean </span><span style="font-variant-ligatures:no-common-ligatures">parent</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">=</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)">"OIDC.SSO"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"> </span><span style="font-variant-ligatures:no-common-ligatures">p</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(64,11,217)">:</span><span style="font-variant-ligatures:no-common-ligatures">tokenEndpointAuthMethods</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">=</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)">"none"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"> /></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">                    </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><bean </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(47,180,29)">parent</span><span style="font-variant-ligatures:no-common-ligatures">=</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)">"OIDC.UserInfo"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)">/></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">                    </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><bean </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(47,180,29)">parent</span><span style="font-variant-ligatures:no-common-ligatures">=</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)">"OAUTH2.Revocation"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)">/></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">                </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"></list></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">            </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"></property></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">        </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"></bean></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(46,174,187)"><br></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;color:rgb(0,0,0)"><font face="arial, sans-serif">For the metadata file we have: </font><br><br></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)">    <span style="font-variant-ligatures:no-common-ligatures">"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(193,101,28)">scope</span><span style="font-variant-ligatures:no-common-ligatures">":"</span><span style="color:rgb(180,36,25);font-variant-ligatures:no-common-ligatures">openid tadaprofile</span><span style="font-variant-ligatures:no-common-ligatures">",</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">    "</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(193,101,28)">redirect_uris</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">":</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(200,20,201)">[</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">"</span><span style="font-variant-ligatures:no-common-ligatures">Redacted</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(200,20,201)">]</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">,</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">    "</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(193,101,28)">client_id</span><span style="font-variant-ligatures:no-common-ligatures">":"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)">tada_rp</span><span style="font-variant-ligatures:no-common-ligatures">",</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">    "</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(193,101,28)">client_secret</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">":"</span><span style="font-variant-ligatures:no-common-ligatures">Redacted</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">",</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(193,101,28)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">    "</span><span style="font-variant-ligatures:no-common-ligatures">response_types</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">":</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(200,20,201)">[</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)">id_token token</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(200,20,201)">]</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">,</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(193,101,28)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">    "</span><span style="font-variant-ligatures:no-common-ligatures">token_endpoint_auth_method</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">":"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(180,36,25)">none</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">",</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">    "</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(193,101,28)">grant_types</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">":</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(200,20,201)">[</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">"</span><span style="font-variant-ligatures:no-common-ligatures">authorization_code</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)">"</span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(200,20,201)">]</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><br></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span style="color:rgb(0,0,0);font-family:arial,sans-serif;font-size:small">I did not see any errors in our logs. I do see the release of attributes to the SP. I've read through the install instructions again, checked permissions. Is there a setting that I need to turn on that I missed? </span><br></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span style="color:rgb(0,0,0);font-family:arial,sans-serif;font-size:small"><br></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(180,36,25)"><span style="color:rgb(0,0,0);font-family:arial,sans-serif;font-size:small">Thank you.</span></p></div></div>