<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.html-attribute
{mso-style-name:html-attribute;}
span.html-attribute-name
{mso-style-name:html-attribute-name;}
span.html-attribute-value
{mso-style-name:html-attribute-value;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1908370635;
mso-list-template-ids:-368288394;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Thanks for the clarification, David.<o:p></o:p></p>
<p class="MsoNormal">I see a certificate at <o:p></o:p></p>
<p class="MsoNormal">IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></p>
<p class="MsoNormal"> <KeyDescriptor use="signing"><o:p></o:p></p>
<p class="MsoNormal"> <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><o:p></o:p></p>
<p class="MsoNormal"> <X509Data><o:p></o:p></p>
<p class="MsoNormal"> <X509Certificate>...<o:p></o:p></p>
<p class="MsoNormal">which is close to your location.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Arthur<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">IAM David Bantz <dabantz@alaska.edu><br>
<b>Date: </b>Monday, July 11, 2022 at 1:57 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>"Goldberg, Arthur P" <arthur.p.goldberg@mssm.edu><br>
<b>Subject: </b>Re: Message was signed, but signature could not be verified.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div align="center">
<table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" width="202" style="width:151.6pt;background:yellow">
<tbody>
<tr>
<td nowrap="" style="padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal">USE CAUTION: External Message.<o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:black">I expect the certificate public key for signed assertions from the IdP to be in (using same . convention):</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-family:"Courier New";color:#881280">EntityDescriptor.IDPSSODescriptor.KeyDescriptor<span class="html-attribute"> </span><span class="html-attribute-name">use</span><span class="html-attribute">="</span><span class="html-attribute-value">signing</span><span class="html-attribute">”</span>.X509
certificate</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Signing key and signature at the EntityDescriptor level may be signing the IdP’s metadata.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On 11Jul2022 at 09:09:04, "Goldberg, Arthur P via users" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
...<o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>AzureIdPMetadata.xml contains a certificate, identified by the nested elements EntityDescriptor.Signature.KeyInfo.X509Data.X509Certificate (where the dot notation indicates nesting).<o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<p class="MsoNormal" style="margin-left:.5in"><br>
<br>
<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
I’m simultaneously verifying with the IdP managers that this certificate in AzureIdPMetadata.xml is the IdP’s certificate which is used to communicate with my SP.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
Running shibboleth 3.2.2.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
Thanks<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
Arthur<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:10.5pt;color:black">Arthur Goldberg, PhD</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:10.5pt;color:black"><a href="https://labs.icahn.mssm.edu/msdw/"><span style="color:#0563C1">Mount Sinai Data Warehouse</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:10.5pt;color:black"><a href="https://labs.icahn.mssm.edu/minervalab/scientific-computing-and-data"><span style="color:#0563C1">Scientific Computing and Data</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:10.5pt;color:black">Associate Professor of Genetics and Genomic Sciences<br>
Institute for Data Science and Genomic Technology<br>
Mount Sinai School of Medicine</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:10.5pt;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:10.5pt;color:black"><a href="mailto:Arthur.Goldberg@mssm.edu"><span style="color:#0563C1">Arthur.Goldberg@mssm.edu</span></a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="color:black">646 526 5020<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mssm.zoom.us_my_arthur.goldberg-3Fpwd-3DLzByMGJOZC9wM3A2aHV6OU94eUtSQT09&d=DwMFaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=Str7Z_PpQQue4GjHUXFDazpMS5_QMki7umi4qnm5WLI&s=Pdup8VTlJJfocgnjk11VB2p2dOn1_NTTXJSnrO4II2I&e="><span style="color:#0563C1">Zoom</span></a>
</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwMFaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=Str7Z_PpQQue4GjHUXFDazpMS5_QMki7umi4qnm5WLI&s=kexg70s9xsVxRoul-6cwtjMLdMzH6XLLvkCuKEfWoFU&e=">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>