http://coldfusion.com logo
Join Slack
Powered by
not directly CFML related (apologies) but my head ...
# cfml-general
e
not directly CFML related (apologies) but my head is starting to hurt over this. anyone very familiar with SSO using Shibboleth (windows+iis) as the SP and Azure/Entra as the IDP? i've setup a handful of these, but latest client is giving me a headache. SHB correctly routes to AZ, login is ok, SHB receives the response but throws error (more details in thread)
Copy code
Message was signed, but signature could not be verified.
the SHB detailed log spits out the following
Copy code
OpenSAML.SecurityPolicyRule.XMLSigning [1] [default]: validating signature profile
XMLTooling.CredentialCriteria [1] [default]: keys didn't match
XMLTooling.CredentialCriteria [1] [default]: keys didn't match
XMLTooling.CredentialCriteria [1] [default]: keys didn't match
XMLTooling.CredentialCriteria [1] [default]: keys didn't match
XMLTooling.CredentialCriteria [1] [default]: keys didn't match
XMLTooling.CredentialCriteria [1] [default]: keys didn't match
XMLTooling.TrustEngine.ExplicitKey [1] [default]: unable to validate signature, no credentials available from peer
XMLTooling.TrustEngine.PKIX [1] [default]: validating signature using certificate from within the signature
XMLTooling.TrustEngine.PKIX [1] [default]: signature verified with key inside signature, attempting certificate validation...
XMLTooling.TrustEngine.PKIX [1] [default]: checking that the certificate name is acceptable
XMLTooling.TrustEngine.PKIX [1] [default]: adding to list of trusted names (<https://sts.windows.net/0c6009c7-3cb9-4fcb-9a5a-5cc6ae9054b2/>)
XMLTooling.TrustEngine.PKIX [1] [default]: certificate subject: CN=Microsoft Azure Federated SSO Certificate
XMLTooling.TrustEngine.PKIX [1] [default]: unable to match DN, trying TLS subjectAltName match
XMLTooling.TrustEngine.PKIX [1] [default]: unable to match subjectAltName, trying TLS CN match
XMLTooling.TrustEngine.PKIX [1] [default]: certificate name was not acceptable
penSAML.SecurityPolicyRule.XMLSigning [1] [default]: unable to verify message signature with supplied trust engine
hibboleth.SSO.SAML2 [1] [default]: detected a problem with assertion: Message was signed, but signature could not be verified.
hibboleth.SSO.SAML2 [1] [default]: error processing incoming assertion: Message was signed, but signature could not be verified.
i'm 99% confident that my SHB setup is the same as other clients that are working with AZ, so think its the client setup in Entra, but i'm not familiar with that side at all so its going to be a bear with this client to try and work through what might be wrong on their setup (assuming it is)
any tips appreciated, spent 8 hours on this yesterday and pretty much got nowhere
p
Using the same signing certs in both places? Sounds like that is the prob there
Also sso settings, are they using the correct signing alg
m
Do you have a shared certificate on the Entra App Registration? It may require a shared certificate to use for signing.
I have experience with both I am happy to help! Just let me know 😃
e
so part of the trick is i have no visibility into the Entra side, that is handled by the customer IT contact, so i have to ask him all this stuff, and i'm not sure how knowledge-able he really is about SSO quick question, in the SAML response i get from AZ, should the <X509Certificate> string exactly match the <X509Certificate> from the AZ federation-metadata.xml ?
thank you BTW!
(and i'm not super experienced with certs myself)
m
e
yes? in my shib2.xml config its the metadataprovider
m
I would remove your tenant id from that link fyi 😃.
But yes, I would presume that should match. I am doing some research for you right now. I will update you shortly
e
thanks, been a long night 😉
m
e
OMG, met with the client - even though i pointed out several times i thought there fed medata link needed an ?appId= value at the end they said it was fine. well that was the problem
m
Ha, well that is awesome! Glad you figured it out!
e
so SHB was getting the wrong metadata and thus the wrong cert
thank you for the help! its good to just write it out sometimes!
i'll be making lots of notes about this for future implementations ....
m
If you ever need any assistance with Entra or Shibboleth feel free to reach out to me direct! I work with both daily 😃 mbh@media3.net
e
thanks! i will definitely make note of that - i'm no SSO expert, so i kind of just stumble through the setup but something like this wastes a ton of my time to troubleshoot
Open in Slack
PreviousNext
Powered by