[JIRA] Commented: (SIDP-538) xmltooling::ValidationException at (https://FQDN/path/Shibboleth.sso/SAML2/POST) StatusResponseType must have Status.

sdwarfs@idp.protectnetwork.org (JIRA) noreply at shibboleth.net
Tue Feb 21 17:35:37 GMT 2012 

    [ https://issues.shibboleth.net/jira/browse/SIDP-538?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13874#comment-13874 ] 

sdwarfs at idp.protectnetwork.org commented on SIDP-538:
-----------------------------------------------------

What I wonder is.... Does the IdP really need the metadata and relying party defintion for handling this kind of request?

The SP issues the following AuthnRequest (or equivalent):
---
<?xml version="1.0" encoding="UTF-8"?>
<samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST"
Destination="https://idefix.worldtalk.de/idp/profile/SAML2/Redirect/SSO"
ID="_3e3e35716f396695533a686a8d8e370e" IssueInstant="2012-02-21T16:04:47Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0">
   <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idefix.worldtalk.de/sp</saml:Issuer>
   <samlp:NameIDPolicy AllowCreate="1"/>
</samlp:AuthnRequest>
---

It gets a AssertionConsumerServiceURL="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST", thats where to send the response to.
It gets a Destination="https://idefix.worldtalk.de/idp/profile/SAML2/Redirect/SSO", so it knows the Profile Binding to be used for receiption (from it's own metadata, as defined in C:/opt/shibboleth-idp/metadata/idp-metadata.xml):
---
[...]
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" entityID="https://idefix.worldtalk.de/idp">

    <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">idefix.worldtalk.de</shibmd:Scope>
        </Extensions>

[...]


        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idefix.worldtalk.de/idp/profile/SAML2/Redirect/SSO"/>
    </IDPSSODescriptor>

[...]
---

It even gets the ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", so it knows how to communicatio with the Service at the "AssertionConsumerServiceURL" to send back the Response.


While just reading again the IdPRelyingParty-Page of the Wiki (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty) I found:
>> Before attempting to change relying party configurations be sure you understand the concept of a relying party. Also, note, changing these configuration is an intermediate-level configuration task, is not generally needed in most deployments, and should only by done by deployers with a good understanding of how shibboleth and federated identity management works.

So the question is, weather I should (or better: need) to change something in the relying-party.xml at all.

The problem: When I comment out everything I added to the relying-party.xml I'm getting the error message:
---
Error Message: SAML 2 SSO profile is not configured for relying party https://idefix.worldtalk.de/sp
---

Details from the idp-processing.log:

The following is according to what the wiki states... Its using the default relying party configuration. That's what we want...
---
18:18:10.124 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for https://idefix.worldtalk.de/sp. Using default relying party configuration.
---

But later there's those warnings:
---
18:18:10.126 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID 'https://idefix.worldtalk.de/sp' could not be resolved

18:18:10.128 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:287] - No metadata for relying party https://idefix.worldtalk.de/sp, treating party as anonymous
18:18:10.129 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:199] - SAML 2 SSO profile is not configured for relying party https://idefix.worldtalk.de/sp
---

This at least states, that the IdP wants the access the service provider's metadata. The only way to give it that metadata reference was for me to add the definitions in relying-party.xml. Or I could try to add the SAML 2 SSO profile to the anonymous relying party definition (which seems not to make so much sense to me).
Just adding the Service Provider Metadata-Definition to the idp-metadata.xml doesn't work, since the XMLs root node <EntityDescriptor> has entityID="https://idefix.worldtalk.de/idp"; This one seems to be the relevant one for the IdP when looking for a matching <SPSSODescriptor>-Definition. As two root nodes are not permitted in XML, I can't add another EntityDescriptor...

BUT: It's always interesting to find the solution myself while explaining the problem.... I just remembered there is a <EntitiesDescriptor>-Tag, which can have multiple <EntityDescriptor>-Tags as child nodes. Let me try this...

> xmltooling::ValidationException at (https://FQDN/path/Shibboleth.sso/SAML2/POST) StatusResponseType must have Status.
> ---------------------------------------------------------------------------------------------------------------------
>
>                 Key: SIDP-538
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-538
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>          Components: SAML 2
>    Affects Versions: 2.3.5
>         Environment: Service-Provider: https://idefix.worldtalk.de/sp
> Identity-Provider: https://idefix.worldtalk.de/idp
> Note: Ports 80/443 are unfortunately protected firefall; URLs can't be accessed from public internet.
> OS: Windows 7 (64 bit)
> Installation Paths:
> * C:/opt/shibboleth-sp/
> * C:/opt/shibboleth-idp/
> Versions:
> * shibboleth-identityprovider-2.3.5-bin.zip (used install.bat; *.msi-Installer had problems, didn't find an excutable or sth. like that)
> * shibboleth-sp-2.4.3-win64.msi
> Supporting/Additional Software (on same computer):
> * Apache Server 2.2.21 (WAMP under Windows)
> * Tomcat 1.6 bound via AJP-Proxy-Pass to let Apache do HTTPS
> * OpenLDAP 2.4.26 Standalone
> ---------- APACHE-Config for Service-Provider Alias: /sp -------
> Include "C:/opt/shibboleth-sp/etc/shibboleth/apache22.config"
> Alias /sp/ "c:/opt/" 
> <Location /sp>
>     ShibRequestSetting applicationId sp
>     Options Indexes FollowSymLinks MultiViews
>     AllowOverride all
>         Order allow,deny
>     Allow from all
> </Location>
> ---------- APACHE-Config for IdP Alias: /idp -------
> <Location "/idp">
>     Order allow,deny
>     Allow from all
>     ProxyPass ajp://idefix.worldtalk.de:8009/idp
> </Location>
> ---------- Tomcat AJP-Entry in server.xml ----------------------
> [...]
>     <!-- Define an AJP 1.3 Connector on port 8009 -->
>     <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
> [...]
>            Reporter: sdwarfs at idp.protectnetwork.org
>            Assignee: Chad La Joie
>         Attachments: idp-processing.log.part.txt, shibboleth-idp-bug-report.zip
>
>
> ======================================
> Adaptions to sample config (informal):
> ======================================
> The following difference descriptions have been collected by comparisions of the template files to the changed versions using diff.
> Template-Placeholders:
> $IDP_SCOPE$="idefix.worldtalk.de" (note: adapted since installed because I used my IP instead the FQDN; which resulted in the last two numbers of the IP as scope)
> $IDP_HOME$="C:\opt\shibboleth-idp"
> $IDP_ENTITY_ID$="https://idefix.worldtalk.de/idp"
> $IDP_HOSTNAME$="idefix.worldtalk.de"
> [#### shibboleth-idp/conf/ ####]
> Unchanged files: attribute-filter.xml, internal.xml, service.xml
> --- attribute-resolver.xml ---
> identical to template except <resolver:AttributeDefinition>-scope was adapted to "idefix.worldtalk.de"
> --- handler.xml ---
> commented out <ph:LoginHandler xsi:type="ph:RemoteUser">
> activated <ph:LoginHandler xsi:type="ph:UsernamePassword" ...> as following:
>     <!--  Username/password login handler -->
>     <ph:LoginHandler xsi:type="ph:UsernamePassword" 
>                   jaasConfigurationLocation="file://C:\opt\shibboleth-idp/conf/login.config">
>         <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
>     </ph:LoginHandler>
> --- logging.xml ---
> log-level set to DEBUG for:
> <logger name="edu.internet2.middleware.shibboleth" level="DEBUG"/>
> <logger name="org.opensaml" level="DEBUG"/>
> actived logging of protocol messages:
> <logger name="PROTOCOL_MESSAGE" level="DEBUG" />
> Rest: Accoring to template (just $IDP_HOME$ replacements)
> --- login.config ---
> Block complete "ShibUserPassAuth" replaced by:
> ShibUserPassAuth {
> // Example LDAP authentication
> // See: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
>    
>   edu.vt.middleware.ldap.jaas.LdapLoginModule required
>     ldapUrl="ldap://idefix.worldtalk.de"
>     bindDn="cn=Manager,dc=worldtalk,dc=de"
>     bindCredential="secretword"
>     baseDn="ou=people,dc=worldtalk,dc=de"
>     ssl="false"
>     userFilter="uid={0}";
> };
> --- relying-party.xml ---
> Added RelyingParty (as child node of <rp:RelyingPartyGroup>) and a reference to the service provider metadata (child node of <metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider"> just below the metadata tag of the Idp):
> ----- CUT HERE ----
>     <rp:RelyingParty id="https://idefix.worldtalk.de/sp"
>                               provider="https://idefix.worldtalk.de/idp"
>                               defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" >
>         <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" />
>         <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" />
>         <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" />
>         <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" />
>     </rp:RelyingParty>
> ----- CUT HERE ----
> ----- CUT HERE ----
>         <metadata:MetadataProvider id="IdefixSP" xsi:type="metadata:ResourceBackedMetadataProvider">
>             <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="C:\opt\shibboleth-sp\etc\shibboleth\sp-metadata.xml"/>
>         </metadata:MetadataProvider>		
> ----- CUT HERE ----
> [#### shibboleth-idp/metadata/ ####]
> --- idp-metadata.xml ---
> <IDPSSODescriptor> - All Location-URLs changed to "https://idefix.worldtalk.de/idp/..." instead of templated "https://idefix.worldtalk.de:8433/idp/..."
> <AttributeAuthorityDescriptor> --- Same here for <AttributeService>-Tags...
> Reason: Don't like to expose that port / tomcat to public for security reasons later (see AJP-Forwaring Apache/Tomcat above).
> Added the following Organization/Contact-Information:
> ---- CUT HERE ----
>   <Organization xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>     <OrganizationName xml:lang="en" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>       WorldTalk.de SP
>     </OrganizationName>
>     <OrganizationDisplayName xml:lang="en" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>       idefix.worldtalk.de
>     </OrganizationDisplayName>
>     <OrganizationURL xml:lang="en" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>       https://idefix.worldtalk.de/sp/
>     </OrganizationURL>
>   </Organization>
>   <ContactPerson contactType="technical" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>     <GivenName xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">Admin</GivenName>
>     <SurName xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">Admin</SurName>
>     <EmailAddress xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">webmaster at idefix.worldtalk.de</EmailAddress>
>   </ContactPerson>
> ---- CUT HERE ----
> [#### shibboleth-sp/etc/shibboleth/ ####]
> --- apache22.config ---
> Changed <Location /secure> to <Location /sp>
> --- native.logger ----
> Activated Logging for SAML/security policies:
> ---- CUT HERE ----
> log4j.category.OpenSAML.MessageDecoder=DEBUG
> log4j.category.OpenSAML.MessageEncoder=DEBUG
> log4j.category.OpenSAML.SecurityPolicyRule=DEBUG
> ---- CUT HERE ----
> --- shibboleth2.xml ---
> Removed <InProcess logger="native.logger">-block for IIS / ISAPI, as I don't use IIS/ISAPI.
> <Host>-Tag in <RequestMap> changed to:
> ---- CUT HERE ----
>   <Host name="idefix.worldtalk.de" applicationId="sp">
>     <Path name="sp" authType="shibboleth" requireSession="true"/>
>   </Host>
> ---- CUT HERE ----
> For <ApplicationDefaults>-Tag:
> modified the EntityID from "https://sp.example.org/shibboleth" to "https://idefix.worldtalk.de/sp"
> ---- CUT HERE ----
>   <SSO entityID="https://idp.example.org/shibboleth"
>                  discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
>     SAML2 SAML1
>   </SSO>
> ---- CUT HERE ----
> changed to:
> ---- CUT HERE ----
>   <SSO entityID="https://idefix.worldtalk.de/idp"
>                  discoveryProtocol="SAMLDS" discoveryURL="https://idefix.worldtalk.de/idp/DS/WAYF">
>     SAML2 SAML1
>   </SSO>
> ---- CUT HERE ----
> Set <Errors>-Tag parameter supportContact from "root at localhost" to "webmaster at idefix.worldtalk.de"
> Removed comments for MetadataProvider-Example and changed file path to idp-metadata.xml:
> ---- CUT HERE ----
> <!-- Example of locally maintained metadata. -->
> <MetadataProvider type="XML" file="C:/opt/shibboleth-idp/metadata/idp-metadata.xml" validate="false" />
> ---- CUT HERE ----
> Set Applications-Override for id "sp" (as defined in <Host>-Tag [see above]) to allow "/sp/Shibboleth.sso" to be used instead of "/Shibboleth.sso", since this host is used for idp and sp at the same time. Else AssertionConsumerServiceURL would be set to "https://idefix.worldtalk.de/Shibboleth.sso" in the <samlp:AuthnRequest>.
> ---- CUT HERE ----
> <ApplicationOverride id="sp">
>   <Sessions lifetime="28800" timeout="3600" checkAddress="false" handlerURL="https://idefix.worldtalk.de/sp/Shibboleth.sso" />
> </ApplicationOverride>
> ---- CUT HERE ----
> --- sp-metadata.xml ---
> Modified version of example-metadata.xml with the following adaptions:
> * The entityID of <EntityDescriptor>-Tag changed from "https://idp.example.org/shibboleth" to "https://idefix.worldtalk.de/sp". The idp-EntityID doesn't make sense (does it) as we describe the ServiceProvider here.
> * Removed the <IDPSSODescriptor>-Tag and <AttributeAuthorityDescriptor>-Tag.
> * Adapted Organization/ContactPerson-Tags (changed values and new Tags!)
> * Added <SPSSODescriptor>-Tag with Credentials (<ds:KeyName>https://idefix.worldtalk.de/sp</ds:KeyName>), <NameIDFormat xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat> and some <md:AssertionConsumerService> tags AS:
> ---- CUT HERE ----
>     <md:AssertionConsumerService Location="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST" index="1"
>       Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
>     <md:AssertionConsumerService Location="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"
>       Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
>     <md:AssertionConsumerService Location="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/Artifact" index="3"
>       Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
>     <md:AssertionConsumerService Location="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/ECP" index="4"
>       Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
>     <md:AssertionConsumerService Location="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML/POST" index="5"
>       Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
>     <md:AssertionConsumerService Location="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML/Artifact" index="6"
>       Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
> ---- CUT HERE ----
> Note: This Metadata was added later. Maybe the <Session>-Tag with handlerURL in the shibboleth2.xml is not needed anymore, as these Location-Definitions may override them.
> ========================
> Index of attached files:
> ========================
> C:\opt\shibboleth-idp\conf
> -> attribute-filter.xml
> -> attribute-resolver.xml
> -> handler.xml
> -> internal.xml
> -> logging.xml
> -> login.config
> -> relying-party.xml
> -> service.xml
> C:\opt\shibboleth-idp\metadata
> -> idp-metadata.xml
> C:\opt\shibboleth-sp\etc\shibboleth
> -> apache22.config
> -> native.logger
> -> shibd.logger
> -> shibboleth2.xml
> -> sp-metadata.xml
> C:\opt\shibboleth-idp\logs
> -> idp-process.log
> -> idp-access.log
> -> idp-audit.log
> C:\opt\shibboleth-sp\var\log\shibboleth
> -> native.log
> -> shibd.log
> -> native_warn.log
> -> shibd_warn.log
> -> signature.log
> -> transaction.log
> Anything missing? Let me know... and I'll post it.
> NOTE: As this is only a test setup, there is no need to keep stuff (as the selfsigned / autogenerated certificates confidential).

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira

More information about the commits mailing list