Shibboleth: "Metadata root element was unsigned and signatures are required" - shibboleth

Question

I set up a Shibboleth IdP and I am testing it with samltest.id
Everything works fine if i do not enable signature verification. If I uncomment the relevant lines in my metadata-providers.xml the IdP won't start. The message is:
ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:537] - Metadata Resolver FileBackedHTTPMetadataResolver SAMLtest: Error filtering metadata from https://samltest.id/saml/sp
org.opensaml.saml.metadata.resolver.filter.FilterException: Metadata root element was unsigned and signatures are required.
my metadata_provider.xml looks like this:
<MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"
xmlns:resource="urn:mace:shibboleth:2.0:resource"
xmlns:security="urn:mace:shibboleth:2.0:security"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
urn:mace:shibboleth:2.0:resource http://shibboleth.net/schema/idp/shibboleth-resource.xsd
urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd
urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd">
<MetadataProvider id="SAMLtest"
xsi:type="FileBackedHTTPMetadataProvider"
backingFile="%{idp.home}/metadata/SAMLtest.xml"
metadataURL="https://samltest.id/saml/sp">
<!-- You should always check the signature and freshness of remote
metadata. It's commented out until you get the basics working.-->
<MetadataFilter xsi:type="SignatureValidation"
certificateFile="%{idp.home}/credentials/signet.crt" />
<MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D"/>
</MetadataProvider>
</MetadataProvider>
I'm using the latest version of Shibboleth 3.
I suspect this is something trivial, but I cannot figure it out. Is it that samltest.id does not sign their metadata and so SignatureValidation cannot be enabled? Why did they write that it should be enabled then?

Answer 1

If you want test your IDP my first approach to this problem is to comment MetadataFilter tags so your metadata provider service (MetadataResolverService) can import metadata from https://samltest.id/saml/sp.
You can call metadata provider service (MetadataResolverService) manually.
bash /opt/shibboleth-idp/bin/reload-service.sh -id shibboleth.MetadataResolverService
Another reason for the problem may be that you do not add the samltest certificate to the IDP. As you indicated in your metadata_provider.xml, your IDP expect signet.crt file in credentials directory.
certificateFile="%{idp.home}/credentials/signet.crt"
You can find certificate on the link below. You should create a signet.crt file with Encryption Certificate value.
https://samltest.id/download/