Hi,
After (soo) many hours looking for the answer and many tests, I'd like to expose my issue and have an answer to fix it.
I have to setup a SAML connexion. Requests must be signed.
I have configured this module + installed saml-php library. I think all is correct on that side.
I mentionned in the module configuration pages:
- for the IDP :
* IDP Login URL
* IDP Logout URL
* x.509 Certificate 0 (copy/paste of the certificate without break lines and spaces)
and I checked "X.509 certificate)
- for the SP:
* I checked " Authn Requests Signed " and "Sign Meta Data "
* I copy/paste the .cer and .key files I have in the directory "php-saml/certs"
* I filled the "Certificate Location" and "Key Location" fields with the url to these files (/home/...)
=> I first had an issue at that moment. Then I renamed .cer -> .crt (this file has BEGIN and END lines)
* the .key file first lines are :
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,1939A4DF72B836A4
* and configured $passphrase in xmlseclibs.php
To be complete, I tested with putty.gen : passphrase + key are corrects
-----------------------
Now, I have the message :
Warning: openssl_sign(): supplied key param cannot be coerced into a private key in XMLSecurityKey->signOpenSSL() (line 368 of /home/sandrine/dev-foundry/leclerc-recettes/www/sites/all/libraries/php-saml/extlib/xmlseclibs/xmlseclibs.php).
Attempt to create metadata failed: Failure Signing Data: error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header - 1.
Is there something wrong in what I did?
The formats I use are not the right ones? Do I have to convert to P7b, DER or else?
Thanks for your help
Comments
Comment #2
jrglasgow commentedPEM format should be sufficient, the file extension doesn't matter.
In my use case I am not using a passphrase with my key, I looked into it and found this issue for the PHP-SAML library from three years ago https://github.com/onelogin/php-saml/issues/69 stating that they don't support passphrases at the moment but they added it to their list.
Comment #3
Sandrine Zac commented