<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Helvetica;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:Helvetica">Make sure the SP metadata is listing the correct encryption pub cert.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">Your SP might actually be using a different encryption key pair, which is why it's reporting that the decryption is failing to find an assertion.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">Double check your shibboleth2.xml and make sure the files line up and restart shibd to make sure it's actually using that config.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica">The IdP is not doing anything wrong, it's given an encryption pub cert and encrypts with it and sends it along and it's up to the private key owner to decrypt it. If there's a failure to decrypt it probably
means the IdP was given the wrong encryption pub cert.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Raymond DeCampo <ray@decampo.org><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Thursday, July 30, 2020 at 08:24<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Encryption works against samltest.id but not local Shibboleth IdP<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">I have Shibboleth 4.0.1 IdP installed locally and have verified it using
<a href="http://samltest.id">samltest.id</a> as the SP.<br>
<br>
I also have mod_auth_mellon on Apache httpd on another server which I would like to use as the SP. I have verified that it works with
<a href="http://samltest.id">samltest.id</a> as the IdP either with a both encryption and signing <KeyDescriptor> elements or only with a signing <KeyDescriptor>.<br>
<br>
When I configure my SP to use my local Shibboleth installation as the IdP, it will work successfully if I only have the signing key. But it does not work if I include the encryption key.<br>
<br>
When using the encryption key in my SP metadata, it appears to login successfully but when redirected back to the AssertionConsumerService URL, I get a 400 Bad Request response from the SP with the following message in the logs:<o:p></o:p></p>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<p class="MsoNormal">[Thu Jul 30 07:04:45.374462 2020] [auth_mellon:error] [pid 29013] [client
<a href="http://10.0.2.2:60010">10.0.2.2:60010</a>] Error processing authn response. Lasso error: [-427] When looking for an assertion we did not found it., SAML Response: StatusCode1="urn:oasis:names:tc:SAML:2.0:status:Success", StatusCode2="(null)", StatusMessage="(null)",
referer: <a href="https://samldev.promergent.com:8443/idp/profile/SAML2/Redirect/SSO?execution=e2s3">
https://samldev.promergent.com:8443/idp/profile/SAML2/Redirect/SSO?execution=e2s3</a><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">The SP metadata:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<blockquote style="margin-left:30.0pt;margin-right:0in">
<div>
<p class="MsoNormal"><EntityDescriptor entityID="<a href="https://localhost/rayDevEntityID">https://localhost/rayDevEntityID</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig">http://www.w3.org/2000/09/xmldsig#</a>"><br>
<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
<KeyDescriptor use="signing"><br>
<ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig">http://www.w3.org/2000/09/xmldsig#</a>"><br>
<ds:X509Data><br>
<ds:X509Certificate>MIICpDCCAYwCCQDKXGOSlGjvKTANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls<br>
b2NhbGhvc3QwHhcNMjAwNzI4MTgwNTU5WhcNMzAwNzI4MTgwNTU5WjAUMRIwEAYD<br>
VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDf<br>
cl7EEjxKo+ymMGKhQqnR9SBHdAriRcJf3Kl7prO8D1jjPtHjEopYhPyVntLVJWZs<br>
ayZG5Y2R9gf9FQzMH/c1pe1lE5aci3lSCV0yhhkN3CHdecmazGfCXzAslMHMIIHc<br>
y81MTRHTPE4LK6uXuEp1v9+X8ih4ep1Cb6Cp+5zPY8HqcfKxyEpdTr0I/L4L5azC<br>
CLsRQtTc9I9MDzRz2dVkJCpd9gTz1r35PZbP/AdJvmVvz6Ie9yEJ1IOoY1kzFWGD<br>
Yoat9KkVNkUDWkBuoghDgK1sRtrjbiwI6X1FJA/DpIc3H8he9u7gH5jPsLOptzTE<br>
gybgUMC/wwoqpFM8quYdAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAKeGvDpHoJK/<br>
k+tTmy5bB/qwPQr9LgTt8xjzgpE95iteiVcMEJ2+YZogna1380kny6srNpSk0419<br>
+Coyw3R1FgtS6v6NzlCTQoVlIJpsPILg5EDkacusieHOmtUD+4Bg4TEPZLde/YH/<br>
zPQFUpli5oE2kQkHeKXc3IjYKDE4HVaKsSyGnDA+KjZ4aHtNObs8tYLmWENJuDER<br>
yZRm9e1xqTISRxDV6RX1oxJxs36nuaKCA8gqnkxkn1kFneEjuAHk1f2n/mVhyFnj<br>
KpfI8aH2fu3uLR8cH5OFFhIPr//7wxn/yeWwwS1RjqvMbRbIFQaME3uq80SP+4Vk<br>
ab0lp8OoAXY=</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
</KeyDescriptor><br>
<KeyDescriptor use="encryption"><br>
<ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig">http://www.w3.org/2000/09/xmldsig#</a>"><br>
<ds:X509Data><br>
<ds:X509Certificate>MIICpDCCAYwCCQDKXGOSlGjvKTANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAls<br>
b2NhbGhvc3QwHhcNMjAwNzI4MTgwNTU5WhcNMzAwNzI4MTgwNTU5WjAUMRIwEAYD<br>
VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDf<br>
cl7EEjxKo+ymMGKhQqnR9SBHdAriRcJf3Kl7prO8D1jjPtHjEopYhPyVntLVJWZs<br>
ayZG5Y2R9gf9FQzMH/c1pe1lE5aci3lSCV0yhhkN3CHdecmazGfCXzAslMHMIIHc<br>
y81MTRHTPE4LK6uXuEp1v9+X8ih4ep1Cb6Cp+5zPY8HqcfKxyEpdTr0I/L4L5azC<br>
CLsRQtTc9I9MDzRz2dVkJCpd9gTz1r35PZbP/AdJvmVvz6Ie9yEJ1IOoY1kzFWGD<br>
Yoat9KkVNkUDWkBuoghDgK1sRtrjbiwI6X1FJA/DpIc3H8he9u7gH5jPsLOptzTE<br>
gybgUMC/wwoqpFM8quYdAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAKeGvDpHoJK/<br>
k+tTmy5bB/qwPQr9LgTt8xjzgpE95iteiVcMEJ2+YZogna1380kny6srNpSk0419<br>
+Coyw3R1FgtS6v6NzlCTQoVlIJpsPILg5EDkacusieHOmtUD+4Bg4TEPZLde/YH/<br>
zPQFUpli5oE2kQkHeKXc3IjYKDE4HVaKsSyGnDA+KjZ4aHtNObs8tYLmWENJuDER<br>
yZRm9e1xqTISRxDV6RX1oxJxs36nuaKCA8gqnkxkn1kFneEjuAHk1f2n/mVhyFnj<br>
KpfI8aH2fu3uLR8cH5OFFhIPr//7wxn/yeWwwS1RjqvMbRbIFQaME3uq80SP+4Vk<br>
ab0lp8OoAXY=</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
</KeyDescriptor><br>
<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://localhost/mellon/logout">https://localhost/mellon/logout</a>"/><br>
<AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://localhost/mellon/postResponse">https://localhost/mellon/postResponse</a>" index="0"/><br>
</SPSSODescriptor><br>
</EntityDescriptor><o:p></o:p></p>
</div>
</blockquote>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The Shibboleth IdP metadata is the sample which comes with the install, updated for the expiration date and adding the port to the URLs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I cranked up the logging on the IdP and have attached the results.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks again,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Ray<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>