Hi,
After (soo) many hours looking for the answer and many tests, I'd like to expose my issue and have an answer to fix it.
I have to setup a SAML connexion. Requests must be signed.

I have configured this module + installed saml-php library. I think all is correct on that side.

I mentionned in the module configuration pages:
- for the IDP :
* IDP Login URL
* IDP Logout URL
* x.509 Certificate 0 (copy/paste of the certificate without break lines and spaces)
and I checked "X.509 certificate)

- for the SP:
* I checked " Authn Requests Signed " and "Sign Meta Data "
* I copy/paste the .cer and .key files I have in the directory "php-saml/certs"
* I filled the "Certificate Location" and "Key Location" fields with the url to these files (/home/...)
=> I first had an issue at that moment. Then I renamed .cer -> .crt (this file has BEGIN and END lines)

* the .key file first lines are :
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,1939A4DF72B836A4

* and configured $passphrase in xmlseclibs.php

To be complete, I tested with putty.gen : passphrase + key are corrects

-----------------------

Now, I have the message :

Warning: openssl_sign(): supplied key param cannot be coerced into a private key in XMLSecurityKey->signOpenSSL() (line 368 of /home/sandrine/dev-foundry/leclerc-recettes/www/sites/all/libraries/php-saml/extlib/xmlseclibs/xmlseclibs.php).
Attempt to create metadata failed: Failure Signing Data: error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header - 1.

Is there something wrong in what I did?
The formats I use are not the right ones? Do I have to convert to P7b, DER or else?

Thanks for your help

Comments

SandrineCC created an issue. See original summary.

jrglasgow’s picture

PEM format should be sufficient, the file extension doesn't matter.
In my use case I am not using a passphrase with my key, I looked into it and found this issue for the PHP-SAML library from three years ago https://github.com/onelogin/php-saml/issues/69 stating that they don't support passphrases at the moment but they added it to their list.

Sandrine Zac’s picture

Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.