<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link=blue vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hi,</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you for the input. I have the deduced the same from my analysis. </p><p class=MsoNormal>When I compare (digest, signature, certificate) the assertion on the IDP before it is encrypted with the assertion after decryption in the Shibboleth logs, they are identical. Yet, Shibboleth fails to validate it.</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I tried below the setting which allows to pass unauthenticated messages, to confirm that encryption alone was not the problem. It is when the assertion is signed + encrypted.</p><p class=MsoNormal><span style='font-size:10.5pt;font-family:Consolas;border:none windowtext 1.0pt;padding:0in;background:white'><PolicyRule</span><span style='font-size:10.5pt;font-family:Consolas;color:#333333;background:white'> </span><span style='font-size:10.5pt;font-family:Consolas;border:none windowtext 1.0pt;padding:0in;background:white'>type="NullSecurity"/><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is there any detailed log level or any other way that I can work with to understand the steps Shibboleth is performing during validation of assertion?</p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,</p><p class=MsoNormal>Pavan.</p><p class=MsoNormal><o:p> </o:p></p><div style='mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='border:none;padding:0in'><b>From: </b><a href="mailto:cab@umn.edu">Christopher Bongaarts</a><br><b>Sent: </b>Friday, July 3, 2020 3:55 AM<br><b>To: </b><a href="mailto:users@shibboleth.net">Shib Users</a>; <a href="mailto:pavankishore.vuppada@broadcom.com">Pavan Kishore Vuppada</a><br><b>Cc: </b><a href="mailto:sreenivas.somavarapu@broadcom.com">sreenivas.somavarapu@broadcom.com</a>; <a href="mailto:bondili.spathi@broadcom.com">Sapthapathi Bondili</a><br><b>Subject: </b>Re: error processing incoming assertion: Message was signed, butsignature could not be verified.</p></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On 7/2/2020 6:10 AM, Pavan Kishore Vuppada wrote:<o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I have configured Siteminder as IDP & Shibboleth as SP. </p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I am trying to sign and encrypt the assertion. On the shibboleth side, it is not able to verify the signature. But if we individually either sign or encrypt assertion, it is working fine without any problems.</p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The error in the logs are very generic (Error - error processing incoming assertion: Message was signed, but signature could not be verified).</p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Is there a way to know what exactly has caused the failure? I have enabled DEBUG logging, but there is not much info. there. Can we check the part of XML / signature which is causing the problem ? <br><br></p></blockquote><p>Based on the log messages, it looks like it is successfully validating the SAML Response, successfully extracting and decrypting the Authentication Assertion, but failing to validate the Authentication Assertion.<o:p></o:p></p><pre>-- </pre><pre>%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu">cab@umn.edu</a> %%</pre><pre>%% OIT - Identity Management %% <a href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%</pre><pre>%% University of Minnesota %% +1 (612) 625-1809 %%</pre><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></p></div></body></html>