<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Dear all, <div class=""><br class=""></div><div class="">I’m running an IdP (using Satosa <a href="https://github.com/IdentityPython/SATOSA" class="">https://github.com/IdentityPython/SATOSA</a>) whose encrypted assertions are being rejected by Shibboleth SPs. </div><div class=""><br class=""></div><div class="">The sample encrypted SAML Response attached is parsed correctly by a Mellon SP, and validated by the tool at <a href="https://www.samltool.com/validate_response.php" class="">https://www.samltool.com/validate_response.php</a>, but fails for Shibboleth SPs. I’m pasting the logs from a shibboleth SP below. </div><div class=""><br class=""></div><div class="">Has anyone hit this problem? </div><div class="">Many thanks in advance for your help!</div><div class="">Hannah</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">————————</div><div class=""><br class=""></div><div class=""><pre style="font-variant-ligatures: normal; orphans: 2; widows: 2; overflow-wrap: break-word; white-space: pre-wrap;" class="">2020-10-15 12:31:45 DEBUG OpenSAML.MessageDecoder.SAML2 [455] [default]: extracting issuer from SAML 2.0 protocol message
2020-10-15 12:31:45 DEBUG OpenSAML.MessageDecoder.SAML2 [455] [default]: message from (<a href="https://fim-idp-dev.cern.ch/proxysamlfrontend" class="">https://fim-idp-dev.cern.ch/proxysamlfrontend</a>)
2020-10-15 12:31:45 DEBUG OpenSAML.MessageDecoder.SAML2 [455] [default]: searching metadata for message issuer...
2020-10-15 12:31:45 DEBUG OpenSAML.MessageDecoder.SAML2 [455] [default]: recovered request/response correlation value (_124d9af9245230f37b5c32e6bcbb48a5)
2020-10-15 12:31:45 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [455] [default]: evaluating message flow policy (correlation off, replay checking on, expiration 60)
2020-10-15 12:31:45 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [455] [default]: ignoring InResponseTo, correlation checking is disabled
2020-10-15 12:31:45 DEBUG XMLTooling.StorageService [455] [default]: inserted record (id-BhpDbKTNNiXIuyE2X) in context (MessageFlow) with expiration (1602765345)
2020-10-15 12:31:45 DEBUG Shibboleth.SSO.SAML2 [455] [default]: processing message against SAML 2.0 SSO profile
2020-10-15 12:31:45 DEBUG XMLTooling.KeyInfoResolver.Inline [455] [default]: resolved 0 certificate(s)
2020-10-15 12:31:45 DEBUG XMLTooling.KeyInfoResolver.Inline [455] [default]: resolved 0 certificate(s)
2020-10-15 12:31:45 ERROR Shibboleth.SSO.SAML2 [455] [default]: failed to decrypt assertion: Unable to resolve any key decryption keys.
2020-10-15 12:31:45 WARN Shibboleth.SSO.SAML2 [455] [default]: error processing incoming assertion: A valid authentication statement was not found in the incoming message.</pre><div class=""><br class=""></div></div><div class=""><br class=""></div><div class=""> </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""></div></body></html>