Shibboleth 2.5 External Auth handler

[Chris Hubing]

I'm messing around with the new NativeSPBackDoor functionality in Shib 
2.5. I am calling the ExternalAuth handler 
(https://localhost/Shibboleth.sso/ExternalAuth) of the SP from the same 
host with a curl call. I am shoveling some attributes into the POST 
request and the SP is seeing them according to the logs below. These are 
the same attributes I send from the actual IDP that is my OpenID-SAML 
gateway, and I set the issuer variable to be the same as that IDP 
(https://openid.et-test.psu.edu/idp/shibboleth). The SP return me an XML 
block which I parse and pluck out the shib session cookie , 
_shibsession_64656661756c7468747470733a2f2f636f6e666c75656e63652e65742d746573742e7073752e6564752f73686962626f6c657468=_8b757555222f8a1774afd3f006b50057; 
path=/; HttpOnly in this particular case, and I send a header to the 
client to set that cookie. So, everything looks good until I try to come 
into the SP directly with that cookie.


Here is the SP logs from my call to the ExternalAuth handler:
2012-08-02 14:06:43 DEBUG Shibboleth.Listener [2]: dispatching message 
(default::getHeaders::Application)
2012-08-02 14:06:43 DEBUG Shibboleth.Listener [1]: dispatching message 
(run::ExternalAuth)
2012-08-02 14:06:43 DEBUG Shibboleth.ExternalAuth [1]: extracting pushed 
attributes...
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeExtractor.XML [1]: 
skipping unmapped NameID with format 
(urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress)
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: filtering 4 
attribute(s) from (https://openid.et-test.psu.edu/idp/shibboleth)
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: applying 
filtering rule(s) for attribute (openid-id) from 
(https://openid.et-test.psu.edu/idp/shibboleth)
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: applying 
filtering rule(s) for attribute (edupersonprincipalname) from 
(https://openid.et-test.psu.edu/idp/shibboleth)
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: applying 
filtering rule(s) for attribute (uid) from 
(https://openid.et-test.psu.edu/idp/shibboleth)
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: applying 
filtering rule(s) for attribute (displayname) from 
(https://openid.et-test.psu.edu/idp/shibboleth)
2012-08-02 14:06:43 DEBUG Shibboleth.ExternalAuth [1]: resolving 
attributes...
2012-08-02 14:06:43 INFO Shibboleth.AttributeResolver.Query [1]: SSO 
protocol does not allow for attribute query
2012-08-02 14:06:43 DEBUG Shibboleth.SessionCache [1]: creating new session
2012-08-02 14:06:43 DEBUG Shibboleth.SessionCache [1]: storing new 
session...
2012-08-02 14:06:43 DEBUG XMLTooling.StorageService [1]: inserted record 
(session) in context (_8b757555222f8a1774afd3f006b50057) with expiration 
(1343934403)
2012-08-02 14:06:43 DEBUG XMLTooling.StorageService [1]: updated record 
(testppp at gmail.com) in context (NameID) with expiration (1343984803)
2012-08-02 14:06:43 INFO Shibboleth.SessionCache [1]: new session 
created: ID (_8b757555222f8a1774afd3f006b50057) IdP 
(https://openid.et-test.psu.edu/idp/shibboleth) Protocol(none) Address 
(127.0.0.1)




Here is the log when I try to come in from the web browser with that 
session. As you can see the session ID matches the one set above. But, 
why does it remove the session right away and redirect me back to the 
discovery service? The session hasn't expired as the expiration 
timestamp above is 8 hours in the future.

2012-08-02 14:08:41 DEBUG Shibboleth.Listener [4]: dispatching message (default::getHeaders::Application)
2012-08-02 14:08:41 DEBUG Shibboleth.Listener [4]: dispatching message (find::StorageService::SessionCache)
2012-08-02 14:08:41 DEBUG Shibboleth.Listener [4]: dispatching message (remove::StorageService::SessionCache)
2012-08-02 14:08:41 INFO Shibboleth.SessionCache [4]: removed session (_8b757555222f8a1774afd3f006b50057)


Any ideas on why it is not honoring the session would be greatly appreciated.

Thanks

-c


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120802/95aa18dd/attachment-0001.html