<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>Hi,</p>
<p>I was downloading a fresh copy of the metadata from their
application after certificate rollover but I suppose it's possible
that if the application wasn't being fully restarted and was
presenting the "old" key from memory rather than the one in our
updated local copy of the metadata. However this normally results
in a different error?</p>
<p>As this is our Live IdP we weren't logging at DEBUG level
unfortunately.</p>
<p>The mystery continues I guess!</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 07/04/2022 15:09, Mak, Steven wrote:<br>
</div>
<blockquote type="cite" cite="mid:BL0PR10MB2802F07DC37A5BCFEE0FE20BA0E69@BL0PR10MB2802.namprd10.prod.outlook.com">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}</style>
<div style="background-color:#fff2e6; border:2px dotted #ff884d"><span style="font-size:12pt; font-family: sans-serif; color:black;
font-weight:bold; padding:.2em">This email was sent to you by
someone outside the University.</span>
<div style="font-size:10pt; font-family: sans-serif;
font-style:normal; padding:.2em">
You should only click on links or attachments if you are
certain that the email is genuine and the content is safe.</div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Based on
my experience with vendors saying one thing and doing
another, it's likely it's just using the old pub cert
still. The name check failure is likely unrelated. It is
also an INFO line.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">From my
experience the CN of the cert doesn't tend to matter. If
you're not sure, you could simply add both pub certs to
the SP metadata in parallel until the vendor assures you
that they removed the old one.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">But
vendors often don't understand SAML well enough to do this
well.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- Steve<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">users
<a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.net"><users-bounces@shibboleth.net></a> on behalf of Mark
Cairney via users <a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a><br>
<b>Date: </b>Thursday, April 7, 2022 at 9:37 AM<br>
<b>To: </b><a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a>
<a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a><br>
<b>Cc: </b>Mark Cairney <a class="moz-txt-link-rfc2396E" href="mailto:Mark.Cairney@ed.ac.uk"><Mark.Cairney@ed.ac.uk></a><br>
<b>Subject: </b>Credential failed name check error upon
updating SP certificate<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">Hi,<br>
<br>
We've recently been working with a vendor who are
upgrading the<br>
certificate in their metadata from an old SHA1 cert to a
SHA256 cert.<br>
<br>
However we got the following error when logging in using
the new cert:<br>
<br>
2022-04-06 17:57:55,973 - INFO<br>
[org.opensaml.security.x509.impl.BasicX509Credent<br>
ialNameEvaluator:297] - [129.215.16.48]|Credential
failed name check:<br>
[subjectNa<br>
me='CN=careerhub.ed']<br>
2022-04-06 17:57:55,974 - WARN<br>
[net.shibboleth.idp.profile.impl.WebFlowMessageHa<br>
ndlerAdaptor:197] - [129.215.16.48]|Profile Action<br>
WebFlowMessageHandlerAdaptor:<br>
Exception handling message<br>
org.opensaml.messaging.handler.MessageHandlerException:
Validation of<br>
protocol m<br>
essage signature failed<br>
at
org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXML<br>
SignatureSecurityHandler.doEvaluate(SAMLProtocolMessageXMLSignatureSecurityHandl<br>
er.java:147)<br>
<br>
We reverted back to the old certificate and the SP
started working again<br>
however we're a bit confused as to why the IdP doesn't
like the new<br>
certificate.<br>
<br>
The details of the new cert are:<br>
<br>
<br>
Certificate:<br>
Data:<br>
Version: 3 (0x2)<br>
Serial Number:<br>
1d:15:be:5e:b3:f5:0f:94:46:f8:27:a7:86:30:59:76<br>
Signature Algorithm: sha256WithRSAEncryption<br>
Issuer: CN = careerhub-ed<br>
Validity<br>
Not Before: Oct 11 14:31:16 2021 GMT<br>
Not After : Oct 11 14:41:16 2041 GMT<br>
Subject: CN = careerhub-ed<br>
Subject Public Key Info:<br>
Public Key Algorithm: rsaEncryption<br>
RSA Public-Key: (2048 bit)<br>
Modulus:<br>
00:ab:38:08:1a:06:f6:c5:da:b5:46:17:9e:c1:85:<br>
4f:e5:80:99:6e:f8:79:c1:ae:83:29:09:d0:b8:4c:<br>
a6:65:a9:f1:cc:54:2e:ab:66:88:43:a3:8f:11:23:<br>
6e:ab:68:90:2a:2e:48:24:f7:eb:9e:67:7f:cc:c7:<br>
d9:1c:f1:49:83:0e:bc:88:6f:69:41:1e:e2:95:ec:<br>
8a:68:86:3e:60:d9:67:ba:73:5c:af:f3:a8:de:f6:<br>
76:2a:70:48:3a:bf:b1:3d:4c:c2:35:84:f1:57:f8:<br>
92:29:22:47:20:09:a1:a6:52:b4:d1:41:31:a1:1a:<br>
0b:61:f0:2d:b7:cc:cc:a5:60:54:48:38:20:83:91:<br>
e0:88:2c:91:a5:e3:ef:5e:cf:7d:e8:05:f1:ff:26:<br>
35:e9:2f:be:9f:23:89:03:97:e4:b5:6c:84:07:d0:<br>
d6:a5:04:ef:cc:f9:68:0f:69:f1:13:87:9d:09:ae:<br>
8c:42:24:75:7d:fb:51:98:7e:fa:34:56:47:38:d9:<br>
41:34:7b:48:9f:c5:65:56:e4:55:05:e4:dc:6d:2c:<br>
e1:5a:3c:1a:d2:d8:03:60:53:58:d4:17:c9:a5:84:<br>
dc:15:3f:f7:d9:17:25:46:75:50:ac:67:cd:d2:13:<br>
c6:32:22:f8:39:13:73:f5:88:fb:62:02:fc:ef:c8:<br>
f7:15<br>
Exponent: 65537 (0x10001)<br>
X509v3 extensions:<br>
X509v3 Key Usage: critical<br>
Digital Signature, Key Encipherment<br>
X509v3 Extended Key Usage:<br>
TLS Web Client Authentication, TLS Web Server
Authentication<br>
X509v3 Subject Alternative Name:<br>
DNS:careerhub-ed<br>
X509v3 Subject Key Identifier:<br>
95:98:29:82:36:42:53:C6:E3:28:15:94:1B:EF:01:7E:D9:0E:EA:96<br>
Signature Algorithm: sha256WithRSAEncryption<br>
78:ad:a1:13:1f:80:4e:23:cb:79:77:78:c5:4e:be:07:0f:1b:<br>
bf:b5:2e:e7:da:38:37:9f:3c:45:15:31:8a:37:4e:77:ee:ea:<br>
34:7d:0e:a1:26:7e:b0:27:43:dc:bf:cc:9b:2d:ae:fc:6c:86:<br>
f9:af:85:ac:97:a7:f4:27:92:ea:ec:aa:20:9d:6d:73:12:9f:<br>
de:aa:46:a4:52:7c:ed:93:50:1c:32:c0:62:af:43:55:dc:93:<br>
7a:57:66:d0:6d:8f:ae:31:a6:3b:85:2f:f9:60:95:f0:fb:06:<br>
a6:c0:37:3c:d7:a7:ff:ad:a0:ff:51:82:32:ef:97:02:97:60:<br>
b6:b0:47:f7:e4:a3:47:1a:6e:dd:b8:66:53:11:bd:fd:0b:98:<br>
06:1b:2c:46:e9:e1:bc:b7:76:40:0b:4a:a3:3f:67:65:11:fa:<br>
15:7f:48:f6:df:29:c3:e4:95:1b:57:09:6e:ac:53:a2:86:5a:<br>
0a:c4:66:a9:45:2c:fe:e2:19:c0:41:24:58:d5:6f:a4:9a:8d:<br>
27:59:54:e3:d4:92:18:fe:67:50:9e:d0:89:ce:2f:8f:5b:e8:<br>
78:7c:c9:24:07:a3:a4:90:24:48:32:64:02:29:31:b4:7a:77:<br>
ef:01:a3:0a:0c:d6:2b:b1:28:5a:f0:74:07:66:37:25:d8:60:<br>
57:e9:7a:9c<br>
<br>
<br>
The only thing we could think of is that the IdP is
being picky about<br>
the CN being a FQDN and having a matching Subject
AltName in place<br>
having had a quick look at the OpenSAML<br>
"BasicX509CredentialNameEvaluator" class but it would be
good to know<br>
what triggers a failure in this and if there are
differing requirements<br>
in place for signing and encryption keys. We've got this
working on Dev<br>
now using a fully-qualified domain name as the CN and
DNS<br>
SubjectAltName. We did try a new cert with the same
Subject as the old<br>
one i.e. "CN= careerhub-ed" but this also failed.<br>
<br>
The University of Edinburgh is a charitable body,
registered in Scotland, with registration number
SC005336. Is e buidheann carthannais a th’ ann an
Oilthigh Dhùn Èideann, clàraichte an Alba, àireamh
clàraidh SC005336.<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https:/shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!AEMvSFvC2yJH01EA9-9DkAfhAwna7llTJyk4LV2cpky9iqFQDV8ukZ6ntb6AJA$" moz-do-not-send="true">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!AEMvSFvC2yJH01EA9-9DkAfhAwna7llTJyk4LV2cpky9iqFQDV8ukZ6ntb6AJA$</a>
<br>
To unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
</body>
</html>