<div dir="ltr"><div>Doug,</div><div><br></div><div>It looks like the vendor is signing authentication requests, which is of dubious value for most cases. The signature won't show up in the XML with the HTTP-Redirect binding; it should be present in the URL.</div><div><br></div><div>You have two options: get the vendor to stop signing authentication requests if it adds no value in your scenario, or make sure that the signature is calculated correctly and that the corresponding public key is present in their metadata with use="signing" or no use listed.</div><div><br></div><div>I would be a little suspicious if you're using their vouched-for metadata and signature validation is still failing. If they're doing everything right, that shouldn't be happening.<br></div><div><br></div><div>Hope this helps,</div><div>Nate<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Oct 28, 2022 at 1:00 PM Wismer, Doug via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-7202235887708682132">
<div style="overflow-wrap: break-word;" lang="EN-US">
<div class="m_-7202235887708682132WordSection1">
<p class="MsoNormal">Trying to find the reason for this error. “The request cannot be fulfilled because the message received does not meet the security requirements of the login service”<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The Metadata config has been checked and is per the vendor’s recommendation.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Not seeing errors, but warnings. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">2022-10-27 15:11:46,668 - DEBUG [PROTOCOL_MESSAGE:127] - 123.123.123.123 - node01ac1xhe309ceqenezc35zwf2k394828 -<u></u><u></u></p>
<p class="MsoNormal"><?xml version="1.0" encoding="UTF-8"?><u></u><u></u></p>
<p class="MsoNormal"><samlp:AuthnRequest<u></u><u></u></p>
<p class="MsoNormal"> AssertionConsumerServiceURL=<a href="https://somesp.somesp.com/saml-prodtest/token" target="_blank">https://somesp.somesp.com/saml-prodtest/token</a><u></u><u></u></p>
<p class="MsoNormal"> Destination=<a href="https://sso.it.utsa.edu/idp/profile/SAML2/Redirect/SSO" target="_blank">https://sso.it.utsa.edu/idp/profile/SAML2/Redirect/SSO</a><u></u><u></u></p>
<p class="MsoNormal"> ID="_d0fd17d8c3c271dd00e5" IssueInstant="2022-10-27T20:11:37.505Z"<u></u><u></u></p>
<p class="MsoNormal"> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<u></u><u></u></p>
<p class="MsoNormal"> Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><u></u><u></u></p>
<p class="MsoNormal"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://host.someissuer.com/%3c/saml:Issuer" target="_blank">https://host.someissuer.com/</saml:Issuer</a>><u></u><u></u></p>
<p class="MsoNormal"> <samlp:NameIDPolicy AllowCreate="true"<u></u><u></u></p>
<p class="MsoNormal"> Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"/><u></u><u></u></p>
<p class="MsoNormal"> <samlp:RequestedAuthnContext Comparison="exact" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><u></u><u></u></p>
<p class="MsoNormal"> <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef><u></u><u></u></p>
<p class="MsoNormal"> </samlp:RequestedAuthnContext><u></u><u></u></p>
<p class="MsoNormal"></samlp:AuthnRequest><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">2022-10-27 15:11:46,760 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:277] - 123.123.123.123 - node01ac1xhe309ceqenezc35zwf2k394828 - Message Handler: Simple signature validation (with no
request-derived credentials) failed<u></u><u></u></p>
<p class="MsoNormal">2022-10-27 15:11:46,761 - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:214] - 123.123.123.123 - node01ac1xhe309ceqenezc35zwf2k394828 - Message Handler: Validation of request simple signature
failed for context issuer: <a href="https://host.someissuer.com/" target="_blank">https://host.someissuer.com/</a><u></u><u></u></p>
<p class="MsoNormal">2022-10-27 15:11:46,762 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:202] - 123.123.123.123 - node01ac1xhe309ceqenezc35zwf2k394828 - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message<u></u><u></u></p>
<p class="MsoNormal">org.opensaml.messaging.handler.MessageHandlerException: Validation of request simple signature failed for context issuer<u></u><u></u></p>
<p class="MsoNormal"> at org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler.doEvaluate(BaseSAMLSimpleSignatureSecurityHandler.java:216)<u></u><u></u></p>
<p class="MsoNormal">2022-10-27 15:11:46,765 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - 123.123.123.123 - node01ac1xhe309ceqenezc35zwf2k394828 - A non-proceed event occurred while processing the request: MessageAuthenticationError<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Any help diagnosing is appreciated. Thanks.<u></u><u></u></p>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div>