Brakeline: Hull rehearsal fails, 'signature is invalid'
Description
Rehearsal for Saturday: Doncaster, Sheffield, Grimsby and Immingham test accounts get in. Hull's test account gets past Microsoft and then your page says:
The sign-in response signature is invalid.
Same app settings as the others as far as I can see.
Linked issues
- relates to SUP-388 Brakeline rollout of single sign-on Done
- relates to ENG-1348 Depot SAML config shows the certificate's subject and fingerprint, and warns on a reused one Done
Comments (5)
My mistake: Hull's depot config has Grimsby's certificate. Both files came through as FederationMetadata.xml and I loaded them in the wrong order. Reloaded Hull from its own file; Grimsby checked, it's right. ENG-1348: show each config's certificate fingerprint and warn when one is reused.
Found it, and it was us: we loaded Grimsby's certificate for Hull, because both metadata files had the same name. Hull has its own now. Could your test account try again?
Hull test account gets in. All five done.
Confirmed on our side. Closing; from now on we ask for one test account per depot, which is what caught this.
Thanks Priya, looking now with Marek.