<div dir="auto"><div>The SP has a portal where I submit the certificate and generate it's metadata. That's what I put in our IDP. There techs said that is the certificate used to sign the request. <br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Oct 12, 2022, 5:22 PM IAM David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div dir="ltr">
If I understand your description correctly, it kinda doubles down on the diagnosis that the signing cert in the SP’s metadata is not the cert with which they signed the request (hence preventing the use of that cert to validate the signed request). You substituted a cert of your own in the metadata to produce “Same result”: that substituted cert certainly wasn’t used by the SP to sign the request, and that condition triggers exactly the error you document.</div><div dir="ltr"><br></div><div dir="ltr">Apologies if I misread your description.</div><div dir="ltr"><br></div><div dir="ltr">David</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On 12Oct2022 at 13:57:13, Steve Herrera via users <<a href="mailto:users@shibboleth.net" target="_blank" rel="noreferrer">users@shibboleth.net</a>> wrote:<br></div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" type="cite">
<div dir="ltr">This is the first SP that we have come across error messages like this. <div><br><div>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">2022-10-12 16:42:06,582 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:275] - Message Handler:<span> </span>Simple signature validation (with no request-derived credentials) failed</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><br></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">
</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">2022-10-12 16:42:06,583 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:214] - Message Handler:<span> </span>Validation of request simple signature failed for context issuer:</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><br></span></p><p style="margin:0px;font:11px Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">2022-10-12 16:42:06,583 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">
</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures">org.opensaml.messaging.handler.MessageHandlerException: Validation of request simple signature failed for context issuer</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><br></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal">I have searched the forum and one explanation was the certificate the SP provided was incorrect from the metadata received. I reviewed that and it is the same. I have the ability to configure the certificate that this SP provides in their metadata and generated a new certificate. Same result. I worked with their SAML techs and they made some minor changes on their end. They said they are using OpenSAML 3.3.1 </span></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal"><br></span></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal">This is the error when going to the URL for the SP:</span></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(113,113,113);font-family:Verdana,Geneva,sans-serif;font-size:12px;font-variant-ligatures:normal">The request cannot be fulfilled because the message received does not meet the security requirements of the login service.</span><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal"> </span><br></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small;font-variant-ligatures:normal"><br></span></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;color:rgb(0,0,0)"><font face="arial, sans-serif">The logon page is never displayed. </font></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><br></span></p><div><div dir="ltr" data-smartmail="gmail_signature"><div dir="ltr"><br></div></div></div></div></div></div>
<div>
<div>
-- <br>For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" target="_blank" rel="noreferrer">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer">users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div></div>
</blockquote></div></div></div>