java - Spring SAML handshake failure - Failed to validate untrusted credential against trusted key -

java - Spring SAML handshake failure - Failed to validate untrusted credential against trusted key -

i'm using spring security saml extension integrating aca healthcare (aka obamacare) website. uses idp initiated sso. saml handshake fails next output

org.opensaml.xml.security.keyinfo.provider.inlinex509dataprovider] single certificate present, treating end-entity certificate org.opensaml.xml.security.keyinfo.basicproviderkeyinfocredentialresolver] credentials extracted kid {http://www.w3.org/2000/09/xmldsig#}x509data provider org.opensaml.xml.security.keyinfo.provider.inlinex509dataprovider org.opensaml.xml.security.keyinfo.basicproviderkeyinfocredentialresolver] total of 1 credentials resolved org.opensaml.xml.security.credential.criteria.evaluablecredentialcriteriaregistry] registry not locate evaluable criteria criteria class org.opensaml.xml.security.keyinfo.keyinfocriteria org.opensaml.xml.signature.signaturevalidator] attempting validate signature using key supplied credential org.opensaml.xml.signature.signaturevalidator] creating xmlsignature object org.opensaml.xml.signature.signaturevalidator] validating signature signature algorithm uri: http://www.w3.org/2000/09/xmldsig#rsa-sha1 org.opensaml.xml.signature.signaturevalidator] validation credential key algorithm 'rsa', key instance class 'sun.security.rsa.rsapublickeyimpl' org.opensaml.xml.signature.signaturevalidator] signature validated key supplied credential org.opensaml.xml.signature.impl.basesignaturetrustengine] signature validation using candidate credential successful org.opensaml.xml.signature.impl.basesignaturetrustengine] verified signature using keyinfo-derived credential org.opensaml.xml.signature.impl.basesignaturetrustengine] attempting found trust of keyinfo-derived credential org.opensaml.xml.security.trust.explicitkeytrustevaluator] failed validate untrusted credential against trusted key org.opensaml.xml.signature.impl.basesignaturetrustengine] failed found trust of keyinfo-derived credential org.opensaml.xml.signature.impl.basesignaturetrustengine] failed verify signature and/or found trust using keyinfo-derived credentials org.opensaml.xml.signature.impl.explicitkeysignaturetrustengine] attempting verify signature using trusted credentials org.opensaml.xml.signature.signaturevalidator] attempting validate signature using key supplied credential org.opensaml.xml.signature.signaturevalidator] creating xmlsignature object org.opensaml.xml.signature.signaturevalidator] validating signature signature algorithm uri: http://www.w3.org/2000/09/xmldsig#rsa-sha1 org.opensaml.xml.signature.signaturevalidator] validation credential key algorithm 'rsa', key instance class 'sun.security.rsa.rsapublickeyimpl' org.apache.xml.security.signature.xmlsignature] signature verification failed. org.opensaml.xml.signature.signaturevalidator] signature did not validate against credential's key org.opensaml.xml.signature.impl.basesignaturetrustengine] signature validation using candidate validation credential failed org.opensaml.xml.validation.validationexception: signature did not validate against credential's key @ org.opensaml.xml.signature.signaturevalidator.validate(signaturevalidator.java:79)

my securitycontext has following:

<bean id="metadata" class="org.springframework.security.saml.metadata.cachingmetadatamanager"> <constructor-arg> <list> <bean class="org.springframework.security.saml.metadata.extendedmetadatadelegate"> <constructor-arg> <bean class="org.opensaml.saml2.metadata.provider.filesystemmetadataprovider"> <constructor-arg> <value type="java.io.file">classpath:${mc_metadata}</value> </constructor-arg> <property name="parserpool" ref="parserpool" /> </bean> </constructor-arg> <constructor-arg> <map> <entry key="${mc_alias_1}"> <bean class="org.springframework.security.saml.metadata.extendedmetadata"> <property name="local" value="true" /> <property name="alias" value="${mc_alias_1}" /> <property name="securityprofile" value="metaiop" /> <property name="requireartifactresolvesigned" value="false" /> <property name="requirelogoutrequestsigned" value="false" /> <property name="requirelogoutresponsesigned" value="false" /> <property name="idpdiscoveryenabled" value="false" /> </bean> </entry> </map> </constructor-arg> </bean> </list> </constructor-arg> <property name="defaultextendedmetadata"> <bean class="org.springframework.security.saml.metadata.extendedmetadata"> <property name="local" value="true" /> <property name="alias" value="${mc_alias_1}" /> <property name="securityprofile" value="metaiop" /> <property name="requireartifactresolvesigned" value="false" /> <property name="requirelogoutrequestsigned" value="false" /> <property name="requirelogoutresponsesigned" value="false" /> <property name="idpdiscoveryenabled" value="false" /> </bean> </property> <property name="hostedspname" value="${mc_alias_1}" /> </bean>

the incoming saml contains x509certificate , have copied metadata file under signing. tried adding 'metadatatrustcheck' false still same error. communication happens on https , test server (receiving saml) uses self-signed certs.

any ideas may missing/wrong?

generally, adding certificate idp's metadata create trusted spring saml, approach correct. 1 of next causing problem you're facing:

the ${mc_alias_1} metadata might idp metadata, you're importing if sp metadata - using metadata generator, or pre-configured sp metadata? you have imported certificate found in idp's message sp metadata, while needs imported idp metadata in order trusted

posting saml message you're receiving , finish configuration xml, not snippet, create troubleshooting easier.

java spring spring-security spring-saml