Cannot verify SAML2 (Shibboleth) response signature

[lmoren]

I try to build Shibboleth SP using Picketlink SPFilter v. 2.1.3. To test an implementation I use testshib.org identity provider.

Everything works fine, however when PicketLink tries to verify signature of incoming Shibboleth response I get the following error:

https://gist.github.com/3358846

Is it maybe connected with: https://issues.jboss.org/browse/PLFED-284

Also can you confirm that the public key that is used to verify signature on the assertion is obtained from the keystore and not from the SAML2 assertion?

Thanks in advance for any help.

Cheers, Lukasz

[jirutka]

Hi Lukasz,

could you please share your configuration how to use PicketLink as Shibboleth SP? I can’t figure out how to get it work and find any information that can help me with it.

[lmoren]

Hi Jakub,

I used org.picketlink.identity.federation.web.filters.SPFilter in my application, and follow this tutorial: https://docs.jboss.org/author/display/PLINK/Picketlink+as+SP,+Salesforce+as+IDP.

It works quite well with Shibboleth. As I remember I've used version 2.0.3.Final - there were some problems with newer releases.

Just out of curiosity, what you are trying to build:)?

Cheers, Lukasz Moren