Digital signature does not validate with the given key

We are switching our single-signon provider from openssl to Weblogic's SAML. I am trying to create a test application that will send mock SAML assertions to our test Weblogic SAML server before we begin integration with the client that will send real SAML assertions.
I have configured a Weblogic 10.3.5 instance to be a SAML Service Provider as well as created an application that creates test SAML assertions to post to the SAML server. I'm currently using a self-signed certificate to sign the SAML assertion. I've imported the self-signed cert into both the DemoIdentiy.jks and cacerts on the Weblogic SAML server.
The Weblogic SAML server is giving the following error when trying to validate the signature of the assertion:
<SAML2Assert: Start verify assertion signature>
<SAML2Assert: The assertion is signed.>
<SAML2Assert: Digital signature does not validate with the given key
org.opensaml.xml.validation.ValidationException: Digital signature does not validate with the given key
at org.opensaml.xml.signature.SignatureValidator.validate(SignatureValidator.java:68)
at com.bea.security.saml2.util.SAML2Utils.verifySamlObjectSignature(SAML2Utils.java:229)
at com.bea.security.saml2.providers.SAML2Assert.verifySignature(SAML2Assert.java:285)
>
I get this error when the SAML assertion includes both the cert and the public key, just the cert, just the public key or neither.
I'm pretty sure I've configured the SAML instance correctly since I followed the steps provided by another group who got this working with a different client. The only difference is they are using a real signed certificate (Verisign i believe) instead of a self signed cert.
I'm looking for any help to track down which step in the process I've missed or implemented incorrectly.
Thanks!
Edited by: 911967 on Feb 6, 2012 12:26 PM

So I found my own answer to the issue. The error was being caused by an the following xml in the assertion:
<ds:Reference URI="">
The value of URI attribute must have a '#' followed by the same value of the ID attribute in the parent 'Assertion' element (in our case a random string):
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="a5k42vnhsywezqzyufq15c4bb9xuzeozrmbppj38xe" IssueInstant="2012-03-12T14:33:25.986Z" Version="2.0">
<saml:Issuer>ISSUER_NAME</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
*<ds:Reference URI="#a5k42vnhsywezqzyufq15c4bb9xuzeozrmbppj38xe">*
How this is related to the digital signature is beyond me, though I admit I'm very new to saml and digital signing. However I spent a great deal of time investigating my certs and how I was creating the signature, which it seems is unrelated to the actual issue. I also wasn't able to find any docs specifying that this attribute was required, though I might have just missed it.

Similar Messages

InvalidKeyException: Could not initialize for signing with the given key

InvalidKeyException: Could not initialize for signing with the given key
What does this caused? And how can I make following code to work? Is it bug, or is it supposed to do so?
X509CertImpl newCert = new X509CertImpl(certInfo);
newCert.sign(caPrivateKey, SIG_ALG_NAME);

Your key is probably using a different algorithm:
Signature signature =
Signature.getInstance( SIGNATURE_ALGORITHM );
PrivateKey privKey =
( PrivateKey ) this.store.getKey( alias, pwd );
Make sure the SIGNATURE_ALGORITHM (SHA1WithRSA, SHA1WithDSA)
matches the algoright of the keystore.
your will see it when casting the private key into a concrete
key instance:
RSAPrivateKey privKey =
( RSAPrivateKey ) this.store.getKey( alias, pwd );

UPGRADED 10.4.11 ON MACBOOK PRO TO 10.5, NOW UPDATES TO 10.5.8 WILL NOT SAVE, "DIGITAL SIGNATURE DOES NOT MATCH". ANY IDEAS.

UPGRADED 10.4.11 ON MACBOOK PRO INTEL TO 10.5.1 (FAMILY PACK VERSION), UPDATES TO 10.5.8 WILL NOT SAVE DUE TO, "DIGITAL SIGNATURE DOES NOT MATCH". ANY IDEAS? CAN I UPGRADE TO 10.6.1 WITHOUT SAME ISSUE.

Well, not sure if having the disk in a firewire case or over a network would have made a difference.
The solution of making a disk image as in article http://support.apple.com/kb/TS2664 was what worked for me.
After, mounting the disk image the Migration Assistant completed without errors. So far everything seems to be working like it did on 10.4.11.

Signature does not match. The request signature we calculated does not match the signature you provided.

re: ipad printing from safari
I have routinely transferred pdf files to Safari and printed them from there. I now get the following message: “Signature does not match. The request signature we calculated does not match the signature you provided.” The only change that I have made since the last thing I printed is to install the ios update.

Hello,
There is a possibility that you have activate line item display for some of the accounts at a later stage. Meaning that earlier postings were not be shown for the earlier postings but only totals will be made available. Therefore, obviously there is bound to be difference between line item report and totals report.
You need to identify which accounts are being changed with line item display at a later stage.
In case if you forget to keep GL Line item display for an account, but the posting are already made the following steps you would required to get the line item display retrospectively.
1. Note that you are NOT required to make the balance of that GL account to ZERO. Please do not confuse with Open Item Management.
2. Put the check box line item display for the account in FS00. Make sure you are entering right company code.
3. Block the account for posting in COA Segment and Company Code Segment in FS00
4. Go to SA38 and run program RFSEPA01 (Give correct GL Account and Company Code)
5. Now, remove the block you kept on the GL Account in FS00.
This will reset the line item display retrospectively.
Hope this will solve your problem.
Regards,
Ravi

Numbers does not open with the main user after installing mountain lion. It works flawlessly when I use the second account on my mac. What got corrupted in the admin-account, something in the user-library? How can I fix it? I´m kinda desperate...

Numbers does not open with the main user after installing mountain lion. It works flawlessly when I use the second account on my mac. What got corrupted in the admin-account, something in the user-library? How can I fix it? I´m kinda desperate... (the same happens with the other iWork-Apps!)
Looking forward to hearing from somebody with a littlemore expertise than me, Chris

you can remove preferences files by navigating to the Preferences folder for your user as follows:
0) Quit ALL iWork apps (Keynote, Pages and Numbers)
1) from the Finder select the menu item "Go > Go To Folder…". This will bring up a dialog:
2) enter the path "~/Library/Preferences" (no double quotes)
3) find the files:
com.apple.iWork.Keynote.plist
com.apple.iWork.Numbers.plist
com.apple.iWork.Pages.plist
and move these to the trash. I would NOT empty until later.
4) restart Numbers

The value in flexfield context reference web bean does not match with the value in the context of the Descriptive flexfield web bean BranchDescFlex. If this in not intended, please go back to correct the data or contact your Systems Administrator for assi

Hi ,
We have enabled context sensitive DFF in Bank Branch Page for HZ_PARTIES DFF , We have created Flex Map so that only bank branch context fields are only displayed in the bank branch page and as we know party information DFF is shared by supplier and Customer Page so we dint want to see any Bank Branch fields or context information in those pages.
We have achieved the requirement but when open existing branches bank branch update is throwing below error message :
"The value in flexfield context reference web bean does not match with the value in the context of the Descriptive flexfield web bean BranchDescFlex. If this in not intended, please go back to correct the data or contact your Systems Administrator for assistance."
this error is thrown only when we open existing branches, if we save existing branch and open then it is not throwing any error message.
Please let us know reason behind this error message.
Thanks,
Mruduala

You are kidding? It took me about 3 minutes to scroll down on my tab to get to the triplex button!
Habe you read the error message?
Quote:
java.sql.SQLSyntaxErrorException: ORA-04098: trigger 'PMS.PROJECT_SEQ' is invalid and failed re-validation
Check the trigger and it should work again.
Timo

I used Roxio VHS to DVD for Mac (have iMac with Snow Leopard) and the audio does not synch with the video when playing in iMovie. Any suggestions to fix?

I used Roxio VHS to DVD for Mac (have iMac with Snow Leopard) and the audio does not synch with the video when playing in iMovie. Any suggestions to fix?

Thanks for the reply. I tried playing with detaching the audio in iMovie, but with 20+ hours of video to correct, it would take too long. After 28 hours, Corel/Roxio tech support replied that it is a known bitrate mismatch problem and they have no real fix. I strongly suggest not to buy this product.

Fast dial (visual bookmarks) does not work with the new 5.0 upgrade. How do I correct this issue

fast dial (visual bookmarks) does not work with the new 5.0 upgrade. How do I correct this issue Asked this question yesterday. I desperately need info, will I ever be able to use fast dial again?

I tried it and it WORKED....I even tried the other version BEFORE this one and it didn't work so I tried yours and it worked like a charm so THANKS brother....

SCCM issue - "LANG_LIST has some locales which does not match with the locale of serial number"

I have a problem with the error "LANG_LIST has some locales which does not match with the locale of serial number" recurring.
I am trying to install Acrobat XI Std silently by SCCM.
I've used the Adobe Customisation Wizard to create a mst which include the volume serial number we have with our licence purchases. Note that I am in Australia. I use the command line in SCCM for the install as "msiexec /i "AcroStan.msi" TRANSFORMS="D&B_AcroStd.mst" /qn" which fails silently. If I install on a local machine using an admin command prompt and changing to /qb at the end, I get the aforementioned error.
I have a few things to try and resolve, having searched the adobe forums and other forums for the solution. The mst is only trying to install US English & I have even gone so far as to use the direct editor in the customisation wizard and change some values in the property table to resolve this. In the property table I can confirm that LANG_SEL_DEFAULT = ENU, REGIONAL_LIST = ENU, LANG_LIST = en_US, ProductLanguage = 1033
Is there a way to check the language specified for ym serial number?
Bryndon

Update on a couple of details:
@Sabian,
Thanks for the location, I've downloaded and then when I tried an install of the newly extracted msi (admittedly on the same computer) I got exactly the same issue. Of note though is that running /qf automatically brought up the same serial number and the same incorrectly spelled company name. Installing on another computer (freshly imaged) doesn't have those inputs already present under /qf. Next when I try using the transfrom (a new one) with /qr it gives an error of the serial number, displaying the entire serial.
@Sebastian
I've had a look through yours and it seems our issues could have the same origin. Looks like I may have to call customer support regarding the serial number as Sabian suggested in your thread.
The bit that gets me is when the same serial number is used in a manual install (or /qf) then it installs ok without any errors.

Setup.exe gives a "LANG_LIST has some locales which does not match with the locale of serial number"

I ran the Adobe Customization Wizard XI to create a transform file and now when run setup.exe it always come with the error "LANG_LIST has some locales which does not match with the locale of serial number".
It does the same thing when using msi with the command : msiexec /i AcroPro.msi TRANSFORMS=AcroPro.mst /qb!
Here is my setup.ini file
[Startup]
RequireOS=Windows XP
RequireMSI=3.1
RequireIE=7.0.0000.0
Require64BitVC10RT=1
CmdLine=/spb /rs /sl"1036"
[Product]
msi=AcroPro.msi
vcrtMsi=vc_red.msi
vcrtDir=VC10RT_x64
Languages=1033;1036
2052=Chinese Simplified
1028=Chinese Traditional
1029=Czech
1030=Danish
1043=Dutch (Netherlands)
1033=English (United States)
1035=Finnish
1036=French (France)
1031=German (Germany)
1038=Hungarian
1040=Italian (Italy)
1041=Japanese
1042=Korean
1044=Norwegian (Bokmal)
1045=Polish
1046=Portuguese (Brazil)
1049=Russian
1051=Slovak
1060=Slovenian
1034=Spanish (Traditional Sort)
1053=Swedish
1055=Turkish
1058=Ukrainian
1025=English with Arabic support
1037=English with Hebrew support
6156=French (Morocco)
CmdLine=TRANSFORMS="AcroPro.mst"
[Windows XP]
PlatformID=2
MajorVersion=5
MinorVersion=1
ServicePackMajor=3
[MSI Updater]
Path=WindowsInstaller-KB893803-v2-x86.exe
I don't know what goes wrong as took my serial number on my profile from the adobe web site, same thing for the download of the software.
Does it means that the serial number provided was invalid for deploying ?
NB.: My goal is to deploy our Acrobat XI through SCCM in silent mode and I don't know if there is extra consideration for that. For now it's only not working at the command line.
Another important point is that the install works great without customization ! If I just run the setup.exe from freshly extracted files and I use my serial number, everything is working fine.
So what goes wrong ?

Thanks for the reply brogers_1 and Vinod Dbhal, you gave good hint.
I retried installing the initial package in French on a Windows 7 English and the software installed properly in French.
As I used to work with virtuals for those tests, I rolled back my virtual and redo my test installation with chosing to install it in English on my Windows 7 English and again the installation finished properly but I was surprised when I realized that even if I chose English as language, the software was running in French !
Of course I can change the language settings (in the edit-preferences-language) to follow the operating system witch is nice.
That gave me the cue I needed to know. I started from scratch my customization with choosing only the French language in the "Application Languages" and I left the MUI Languages blank and saved the .mst
I ran again the same command : msiexec /i AcroPro.msi TRANSFORMS=AcroPro.mst /qb!
And everything works fine.
NB.: As I used the .msi directly, of course I had to install the prerequirement Visual C++ 2010 first. Otherwise the installation failed without any error message.
Thanks again to you for your good hint,
Bob

Recovery scenario - Voting disk does not match with the cluster guid

Hi all,
Think of you can not start your guest VMs just because it has a corrupted system.img root image. And assume it contains 5 physical disk( which are all created by the RAC template) hence ASM on them.
What is the simplest recovery scneario of the guest vms (RAC)?
Can it be a feasible scenario for recover of the availablity? (Assume both of the RAC system images are corrupted and we prefer not a system level recovery rather than backup / restore)
1. Create 2 RAC instances using the same networking and hostname details as the ones that are corrupted. - Use 5 different new disks.
2 Shutdown the newly created instances. Drop the disks from the newly created instances using VM manager.
3. Add the old disks whose system image is failing to be recoverd but ASM disks are still in use (from the newly created instances using VM manager.) to the newly created instances.
4. Open the newly created instances
Can we expect the ASM and CRS could be initialized and be opened without a problem?
When I try this scenario I get the folllowing error from the cssd/crsd .
- Cluster guid 9112ddc0824fefd5ff2b7f9f7be8f048 found in voting disk does not match with the cluster guid a3eec66a2854ff0bffe784260856f92a obtained from the GPnP profile.
- Found 0 configured voting files but 1 voting files are required, terminating to ensure data integrity.
What could be the simplest way of recovery of a virtual machine that has healthy ASM disks but corrupted system image?
Thank you

Hi,
you have a similar problem, when trying to clone databases with 11.2.
The problem is that a cluster is uniquely identified, and this information is hold in the OCR and the Voting disks. So exactly these 2 are not to be cloned.
To achieve what you want, simply setup your system in that way, that you have a separate diskgroup for OCR and Voting (and ASM spfile), which is not to be restored in this case of szeanrio.
Only all database files in ASM will then be exchanged later.
Then what you want can be achieved.
However I am not sure that the RAC templates have the option to install OCR and Voting into a separated diskgroup.
Regards
Sebastian

I would like to create the a swatch, add it to the library and import to the swatch panel. The help pages available relate to earlier versions of Muse, which does not work with the 2014.2 release version that I have. I have created a library folder, imp

I would like to create the a swatch, add it to the library and import to the swatch panel. The help pages available relate to earlier versions of Muse, which does not work with the 2014.2 release version that I have. I have created a library folder, imported the colour swatch as just 4 colours as a mulib file. I drag the four colours on to the muse page in design view but that is as far as I get. Can anyone help? Thanks

I don't know since I don't share anything. You'll have to peruse the help files and check the permissions and ACLs on the Shared folder. According to the permissions on the Shared folder everyone can R&W. If you want those to be inherited by everything dropped into the folder, add an ACL for
everyone allow read, write
Details in the manpage for chmod. The actual steps are left as an exercise.

Chart size does not extend with the data

Hi,
One of my reports has a horizontal bar and the chart size does not grow with the data. The chart displays fine if I have minimal amount of data. If the data grows, the display is bizarre, it's just messed up. Is there an option I need to set? Please provide your inputs.
Thanks
Arch

Hi,
I tried with all these options, but no success. I remember I used to get full visible charts initially. Not sure what has happened charts are getting chopped off by at least 50px right and bottom. Interestingly When I export the chart to Excel it looks perfect.
Any suggestion. Has anyone faced this issues. I am using 11.1.1.5 version.

Menu Bar - Sound Volume icon does not move with the press of the F key

So I normally press the F keys to control the Sound Volume, right, just like everyone else does -
but the Sound Volume icon in the Menu Bar at the top right does not respond to the F key at all!
Isn't it supposed to react simultaneous with the press of the F key?
I have to actually use my mouse click to make that volume go up and down.
The actual volume does work with the F key, it goes up and down.
But to make the 2 work in sync, I have to point the mouse to the one at the Menu Bar, fiddle with it, and then I can use the F key and both work together at the same time.
If I haven't touched the Menu Bar one for a while and I only use the F key, the Menu Bar one doesn't move at all.
It's weird. Any ideas?

I see what Al is seeing. Normally I just use one method or the other. The Volume Adjustment keys provide visual feedback, so it's unnecessary to check the menu extra, i.e. the Volume menu bar icon, to see the same feedback.
The slight delay in the reaction of the Volume menu extra, when open and while adjusting the volume with the Volume keys is normal.
They're independent methods for adjusting the Volume setting. The Volume menu extra takes a moment to refresh when the slider is displayed and you're changing the setting via the Volume keys.
Good luck!
Dr. Smoke
Author: Troubleshooting Mac® OS X

ITunes randomly stops playing purchases that have previously viewed on the same hardware. It has an error message about HD. How can this issue be resolved? What information is available besides the "learn more" option that does not deal with the problem?

iTunes randomly stops playing purchases that have previously viewed on the same hardware. It has an error message about HD. How can this issue be resolved? What information is available besides the "learn more" option that does not deal with the problem?
Many people have the same problem. However, there is little or nothing readily available to users. This problem has existed for two or more years. Does anyone have anything to offer about this disturbing problem?

Thanks for the suggestion kcell. I've tried both versions
9.0.115 and 9.0.124 and both fail with the policy permission error.
I also tried with and without your crossdomain.xml file but
with the same result. It looks like this file is intended for URL
policy, instead of socket policy. Recently Adobe separated the two.
When I run with the files installed on my dev PC, it does
work, which makes sense because the flash player isn't loaded from
an unknown domain.
I did get one step closer. If a crossdomain.xml in the server
root exists and the socketpolicy file is loaded from the app folder
then the first two warnings disappear. The logs now show:
OK: Root-level SWF loaded:
https://192.168.2.5/trunk/myapp.swf
OK: Policy file accepted: https://192.168.2.5/crossdomain.xml
OK: Policy file accepted:
https://192.168.2.5/trunk/socketpolicy.xml
Warning: Timeout on xmlsocket://192.168.2.5:843 (at 3
seconds) while waiting for socket policy file. This should not
cause any problems, but see
http://www.adobe.com/go/strict_policy_files
for an explanation.
Warning: [strict] Ignoring policy file with incorrect syntax:
xmlsocket://192.168.2.5:993
Error: Request for resource at xmlsocket://192.168.2.5:993 by
requestor from https://192.168.2.5/trunk/myapp.swf is denied due to
lack of policy file permissions.
Which basically says, everything is okay, but you stay out
anyway.
PS: I found the XML schema files here:
http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security_02.html
and the socket policy schema:
http://www.adobe.com/xml/schemas/PolicyFileSocket.xsd.
UPDATE: When serving up the policy file on port 843 using the
example perl script then the socket connection seems to be accepted
and the connect succeeds. After that flex hangs trying to logon to
the IMAP server.

Digital signature does not validate with the given key

Similar Messages

Maybe you are looking for