<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?avatarId=10202" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="rbasch@mit.edu" id="email_rbasch@mit.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=rbasch%40mit.edu" style="color:#326ca6;">Robert A Basch</a>
created <img src="https://issues.shibboleth.net/jira/images/icons/issuetypes/bug.png" height="16" width="16" border="0" align="absmiddle" alt="Bug"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/SIDP-606'>SIDP-606</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/SIDP-606'><strong>IdP delegation extension problem using CryptoTransient principal connector</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Issue Type:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<img src="https://issues.shibboleth.net/jira/images/icons/issuetypes/bug.png" height="16" width="16" border="0" align="absmiddle" alt="Bug"> Bug
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Affects Versions:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
2.4.0 </td>
</tr>
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Assignee:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<a class="user-hover" rel="cantor.2@osu.edu" id="email_cantor.2@osu.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=cantor.2%40osu.edu" style="color:#326ca6;">Scott Cantor</a>
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Components:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
Authentication, SAML 2 </td>
</tr>
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Created:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
21/Apr/14 10:25 PM
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Description:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<p style='margin-top:0;margin-bottom:10px;'>We are testing the IdP delegation extension, and ran into an issue<br/>
when the IdP (version 2.4.0) is also configured to use the CryptoTransient<br/>
principal connector. In that scenario, the IdP gets an error on the ECP<br/>
client's delegation request, because it cannot resolve the principal name<br/>
in the request:</p>
<p style='margin-top:0;margin-bottom:10px;'>08:49:27.355 - DEBUG <span class="error">[edu.internet2.middleware.shibboleth.idp.ext.delegation.profile.LibertyIDWSFSSOSProfileHandler:410]</span> - Token did not have delegation chain, this must be initial delegation request<br/>
08:49:27.355 - DEBUG <span class="error">[edu.internet2.middleware.shibboleth.idp.ext.delegation.profile.LibertyIDWSFSSOSProfileHandler:898]</span> - Attempting to resolve principal name from assertion token presented by '<ECP client SP entity ID>', with NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' and value 'F3HX25IOP7PSJOURM6VQEIN3IBKRS5UZLC7ZG6EAVT5XXAPWJLKIGYMNJQVFKG3MAUMUO4BZFBWFIOR45ABHM2POIOBOG7IYXFBRLE5WNQJ5AMCPL2VSMHDWWUI6KG7UHDWVF2YWI6JRDIPTN6RXZTRM34S6MKRMDSH4TQN43I5KK2AWAC2WVBKKQSFZXDSYCBVYKOFK2HIBIKDKQQCRBKDYJ7BN2WOUO5LUNRI'<br/>
08:49:27.359 - WARN <span class="error">[edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:555]</span> - Error resolving principal name for SAML request 'null' from relying party '<ECP client SP entity ID>'. Cause: Decoded NameQualifier (<IdP entity ID>) does not match issuer (null).<br/>
08:49:27.359 - WARN <span class="error">[edu.internet2.middleware.shibboleth.idp.ext.delegation.profile.LibertyIDWSFSSOSProfileHandler:911]</span> - Error resolving principal name from assertion token presented by '<ECP client SP entity ID>', with NameID format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' and value 'F3HX25IOP7PSJOURM6VQEIN3IBKRS5UZLC7ZG6EAVT5XXAPWJLKIGYMNJQVFKG3MAUMUO4BZFBWFIOR45ABHM2POIOBOG7IYXFBRLE5WNQJ5AMCPL2VSMHDWWUI6KG7UHDWVF2YWI6JRDIPTN6RXZTRM34S6MKRMDSH4TQN43I5KK2AWAC2WVBKKQSFZXDSYCBVYKOFK2HIBIKDKQQCRBKDYJ7BN2WOUO5LUNRI'</p>
<p style='margin-top:0;margin-bottom:10px;'>From looking at the code, apparently the profile handler fails to set the<br/>
outbound message issuer in the resolution context, and the connector code<br/>
does not like that. I have managed to work around the problem by using<br/>
this patch to the delegation extension, which just copies the outbound<br/>
message issuer from the request context:</p>
<p style='margin-top:0;margin-bottom:10px;'>Index: src/main/java/edu/internet2/middleware/shibboleth/idp/ext/delegation/profile/LibertyIDWSFSSOSProfileHandler.java<br/>
===================================================================<br/>
— src/main/java/edu/internet2/middleware/shibboleth/idp/ext/delegation/profile/LibertyIDWSFSSOSProfileHandler.java (revision 360)<br/>
+++ src/main/java/edu/internet2/middleware/shibboleth/idp/ext/delegation/profile/LibertyIDWSFSSOSProfileHandler.java (working copy)<br/>
@@ -902,6 +902,7 @@</p>
<p style='margin-top:0;margin-bottom:10px;'> LibertySSOSRequestContext principalResolutionContext = new LibertySSOSRequestContext();<br/>
principalResolutionContext.setInboundMessageIssuer(relyingPartyId);<br/>
+ principalResolutionContext.setOutboundMessageIssuer(requestContext.getOutboundMessageIssuer());<br/>
principalResolutionContext.setSubjectNameIdentifier(tokenNameID);<br/>
principalResolutionContext.setProfileConfiguration((SSOConfiguration) profileConfiguration);</p>
<p style='margin-top:0;margin-bottom:10px;'>But I am not familiar enough with the code to know if this is correct.</p>
</td>
</tr>
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Environment:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<p style='margin-top:0;margin-bottom:10px;'>IdP version 2.4.0, with the delegation extension, and configured to use the CryptoTransient principal connector</p>
</td>
</tr>
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Project:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<a style="color:#326ca6;" href="https://issues.shibboleth.net/jira/browse/SIDP">Shibboleth IdP 2 - Java</a>
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Priority:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<img src="https://issues.shibboleth.net/jira/images/icons/priorities/major.png" height="16" width="16" border="0" align="absmiddle" alt="Major"> Major
</td>
</tr>
<tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Reporter:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
<a class="user-hover" rel="rbasch@mit.edu" id="email_rbasch@mit.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=rbasch%40mit.edu" style="color:#326ca6;">Robert A Basch</a>
</td>
</tr> <tr valign="top">
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 10px 10px 0;white-space:nowrap;">
<strong style="font-weight:normal;color:#505050;">Security Level:</strong>
</td>
<td style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 10px 0;width:100%;">
Standard (Standard bug, may impact functionality but does not represent a security vulnerability ) </td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->