<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hello Shibboleth users<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">You may recall that I’m configuring a Shibboleth SO to authenticate via an Azure IdP.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Shibbolith has the browser issue this request:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">https://login.microsoftonline.com/77e89d61-570f-43b0-b9e4-634f462e34b8/saml2?SAMLRequest=fVLJbsIwE ..., which generates the response
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"> opensaml::FatalProfileException<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"> The system encountered an error at Mon May 24 18:16:24 2021<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"> To report this problem, please contact the site administrator at Arthur.p.Goldberg@mssm.edu.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"> Please include the following message in any email:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"> opensaml::FatalProfileException at (https://leaf.mssm.edu/Shibboleth.sso/SAML2/POST)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:Menlo"> Message was signed, but signature could not be verified.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The important Shibboleth configuration files for this issue are shibboleth2.xml, leaf.mssm.edu-metadata.xml -- a metadata file generated by executing "curl -o leaf.mssm.edu-metadata.xml -k https://leaf.mssm.edu/Shibboleth.sso/Metadata"
against the webapp, and AzureIdPMetadata.xml -- a metadata file that describes the Azure IdP metadata which was provided by an Azure admin. These three files are attached, with some non-essential data removed to make them easier to read and this email small
enough.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Certain configuration choices are not clear to me:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> In leaf.mssm.edu-metadata.xml, should the KeyName and the X509 CN which are "*.mssm.edu" because I'm using a wildcard certificate be changed to leaf.mssm.edu?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Does AzureIdPMetadata.xml have the proper format for an XML MetadataProvider in shibboleth2.xml?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Do you see problems with these configuration files?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Arthur<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>