Here's the contents of my catalina.out, with log4j logging set to DEBUG for com.springframework.security.saml:
I also verified that the shibboleth IDP's private key matches the cert with alias shib-idp in samlKeystore.jk and in the jre keystore.
Code:
- Checking server trust
- Attempting to validate untrusted credential
- Forcing on-demand metadata provider refresh if necessary
- Attempting to retrieve credentials from cache using index: [https://dev148.mycompany.com:8443/idp/shibboleth,{urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,UNSPECIFIED]
- Unable to retrieve credentials from cache using index: [https://dev148.mycompany.com:8443/idp/shibboleth,{urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,UNSPECIFIED]
- Using customized TLS key null from extended metadata for entityID https://dev148.mycompany.com:8443/idp/shibboleth
- Building credential from keystore entry for entityID shib-idp, usage type UNSPECIFIED
- Processing TrustedCertificateEntry from keystore
- Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria for criteria class org.opensaml.xml.security.criteria.EntityIDCriteria
- No customized signature or encryption keys configured for entityID https://dev148.mycompany.com:8443/idp/shibboleth, using metadata
- Attempting to retrieve credentials from metadata for entity: https://dev148.mycompany.com:8443/idp/shibboleth
- Retrieving metadata for entity 'https://dev148.mycompany.com:8443/idp/shibboleth' in role '{urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor' for protocol 'urn:oasis:names:tc:SAML:2.0:protocol'
- Checking child metadata provider for entity descriptor with entity ID: https://dev148.mycompany.com:8443/idp/shibboleth
- Searching for entity descriptor with an entity ID of https://dev148.mycompany.com:8443/idp/shibboleth
- Found 0 key names: []
- Processing KeyInfo child with qname: {http://www.w3.org/2000/09/xmldsig#}X509Data
- Provider org.opensaml.xml.security.keyinfo.provider.RSAKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
- Provider org.opensaml.xml.security.keyinfo.provider.DSAKeyValueProvider doesn't handle objects of type {http://www.w3.org/2000/09/xmldsig#}X509Data, skipping
- Processing KeyInfo child {http://www.w3.org/2000/09/xmldsig#}X509Data with provider org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider
- Attempting to extract credential from an X509Data
- Found 1 X509Certificates
- Found 0 X509CRLs
- Single certificate was present, treating as end-entity certificate
- Credentials successfully extracted from child {http://www.w3.org/2000/09/xmldsig#}X509Data by provider org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider
- A total of 1 credentials were resolved
- Registry could not locate evaluable criteria for criteria class org.opensaml.xml.security.keyinfo.KeyInfoCriteria
- Added new credential collection to cache with key: [https://dev148.mycompany.com:8443/idp/shibboleth,{urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,UNSPECIFIED]
- Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableEntityIDCredentialCriteria for criteria class org.opensaml.xml.security.criteria.EntityIDCriteria
- Registry could not locate evaluable criteria for criteria class org.opensaml.security.MetadataCriteria
- Registry located evaluable criteria class org.opensaml.xml.security.credential.criteria.EvaluableUsageCredentialCriteria for criteria class org.opensaml.xml.security.criteria.UsageCriteria
- Failed to validate untrusted credential against trusted certificate
- Failed to validate untrusted credential against trusted certificate
- Closing the connection.
- Method retry handler returned false. Automatic recovery will not be attempted
- Releasing connection back to connection manager.
- Error when sending request to artifact resolution service.
javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Peer SSL/TLS certificate is not trusted, add the certificate to your trust store and update tlsKey in extended metadata with the certificate alias
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1649)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:632)
at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)
Trust problem
Reply With Quote
Originally Posted by Flyhard
