Testing a SAML connection to Shibboleth IdP

[andrewau]

I'm new to ServiceNow / SAML / Shibboleth so please go easy on me.

I have a Shibboleth IdP installed on my local PC.

I have tested it with TestShib, and all seems to functioning as expected:
I can use TestShib as SP, submitted a auth request, my IdP gets the request which then returns the user assertion. All is well in the world.

So my next step is to test my IdP with ServiceNow.

I've set up a dev instance, clicked on Multi Provider SSO, created an IdP, imported my Shibboleth metadata, generate ServiceNow SP metadata and install that in Shibboleth.

I attempt to 'Test Connection' and get this error:

        "Content was blocked because it was not signed by a valid security certificate."

Here is the log:

08/08/16 09:07:52 (101) Testing SSO: 456539e54fc5a200a4db44b18110c789

08/08/16 09:07:52 (106) Read from column : name, value: https://myidpidp/shibboleth

08/08/16 09:07:52 (107) Use the SSOHelper passed in.

08/08/16 09:07:52 (107) Read from column : service_url, value: https://dev<INSTANCE>.service-now.com/navpage.do

08/08/16 09:07:52 (108) Read from column : clock_skew, value: 60

08/08/16 09:07:52 (109) Read from column : idp_authnrequest_url, value: https://myidp/idp/profile/SAML2/Redirect/SSO

08/08/16 09:07:52 (110) Read from column : service_url, value: https://dev<INSTANCE>.service-now.com/navpage.do

08/08/16 09:07:52 (111) Read from column : force_authn, value: 0

08/08/16 09:07:52 (111) Read from column : is_passive, value: 0

08/08/16 09:07:52 (113) Read from column : issuer, value: https://dev<INSTANCE>.service-now.com

08/08/16 09:07:52 (113) Read from column : nameid_policy, value: urn:oasis:names:tc:SAML:2.0:nameid-format:transient

08/08/16 09:07:52 (114) Read from column : service_url, value: https://dev<INSTANCE>.service-now.com/navpage.do

08/08/16 09:07:52 (115) Read from column : idp_authnrequest_url, value: https://myidp/idp/profile/SAML2/Redirect/SSO

08/08/16 09:07:52 (116) Read from column : createrequestedauthncontext, value: 0

08/08/16 09:07:52 (121) SAML Request xml: <saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://dev<INSTANCE>.service-now.com/navpage.do" Destination="https://myidp/idp/profile/SAML2/Redirect/SSO" ForceAuthn="true" ID="SNC90bd818425f22910d30629ad62e23236" IsPassive="false" IssueInstant="2016-08-07T23:07:52.112Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ProviderName="https://dev<INSTANCE>.service-now.com/navpage.do" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://dev<INSTANCE>.service-now.com</saml2:Issuer><saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/></saml2p:AuthnRequest>

08/08/16 09:07:52 (124) Stripping down the serviceURL: https://dev<INSTANCE>.service-now.com/navpage.do to a base URL of: https://dev<INSTANCE>.service-now.com

08/08/16 09:07:52 (125) Generating a Test Connection Relay State of: https://dev<INSTANCE>.service-now.com/navpage.doSNCRSEPsysparm_saml_tc=true&glide_sso_id=456539e54fc5a200a4db44b18110c789&exit_name=MultiSSO

08/08/16 09:07:52 (126) Read from column : require_signed_authnrequest, value: 0

08/08/16 09:07:52 (126) Redirecting to: https://myidp/idp/profile/SAML2/Redirect/SSO?SAMLRequest=lVLLTsMwEPyVyPfEiUtDazWVSitEJR5RUzhwc%2BNNa...

08/08/16 09:07:52 (127) Generated request ID: SNC90bd818425f22910d30629ad62e23236

Can anyone help me get this working?

Your help is much appreciated,

Andrew.

[mohamadcharafed]

Hi Andrew,

Is this error you are seeing being shown on your IDP page after your redirected ?

There are issues in IE which can cause this. Are you using IE by any chance ? If you are try this :

Error: Content was blocked because it was not signed by a valid - Microsoft Community

Regards,

Mohamad

[andrewau]

I was using MS Edge browser, so I changed to chrome and it got past the above issue, but got the follow error:

SSO Login Test Results

SAML Login response received

SAML failed to login

- Status code is urn:oasis:names:tc:SAML:2.0:status:Responder. When it is supposed to be urn:oasis:names:tc:SAML:2.0:status:Success

- An error occurred.

- Ensure that the 'AuthContextClass' related properties are set correctly.

SSO Logout Test Results

Cannot logout of IDP's session

- IDP's Login connection failed. Session does not exist on IDP to test logout.

Shibboleth gives me these warnings:

2016-08-10 14:41:25,944 - WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:221] - Validation failure: Failed to resolve both a data and a key encryption credential

2016-08-10 14:41:25,945 - WARN [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:343] - Profile Action PopulateEncryptionParameters: Resolver returned no EncryptionParameters

2016-08-10 14:41:25,960 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: InvalidSecurityConfiguration

2016-08-10 14:41:26,203 - WARN [org.opensaml.saml.common.binding.SAMLBindingSupport:91] - Relay state exceeds 80 bytes, some peers may not support this.

Any ideas what is the cause of this error?

[mohamadcharafed · Accepted solution]

Hey Andrew,

What is your "AuthnContextClassRef Method" set to on the instance SSO configuration. Can you make this blank and test.

Please take a look at : Shibboleth - Users - Help getting started with idp v3, getting error " Validation failure: Failed to...

As they suggest, set idp.encryption.optional to true.

If this still doesnt work, your Shiboleth might still want a signed AuthRequest. But try the above first and see how it goes.

Regards,

Mohamad

[andrewau]

Mohamad Charafeddine previous comment fixed the issues I was having:

          Blank out "AuthContextClassRef Method"

and

        set idp.encryption.optional to true.