IDP Failure

[Ogunleye, Philip]

Hi All,

Please ignore, I have investigated and resolved the issue.

Thanks for all your help.

-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Ogunleye, Philip
Sent: 15 January 2013 16:26
To: Shib Dev
Subject: RE: IDP Failure

Hi Scott,

Thanks for your response.

I have understood totally that the IDP does the authentication and sends the response which I unmarshall and process on the service provider.  However, for some reason, the client requires that we send an identifier with our requests, I've stopped sending it to my shibboleth IDP but now get the message below:

16:21:50.058 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:923] - Could not resolve a key encryption credential for peer entity: https://snaponglobal.com/SAML
16:21:50.058 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter
org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:924) ~[shibboleth-identityprovider-2.3.8.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:286) ~[shibboleth-identityprovider-2.3.8.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:308) [shibboleth-identityprovider-2.3.8.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:171) [shibboleth-identityprovider-2.3.8.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) [shibboleth-identityprovider-2.3.8.jar:na]
	at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) [shibboleth-common-1.3.7.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.29]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]
	at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.8.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.29]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]
	at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.8.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.29]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]
	at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.7.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.29]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:96) [spring-web-2.5.6.SEC03.jar:2.5.6.SEC03]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76) [spring-web-2.5.6.SEC03.jar:2.5.6.SEC03]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.29]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.29]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) [catalina.jar:6.0.29]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.29]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.29]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.29]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.29]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298) [catalina.jar:6.0.29]
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:857) [tomcat-coyote.jar:6.0.29]
	at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588) [tomcat-coyote.jar:6.0.29]
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.29]
	at java.lang.Thread.run(Unknown Source) [na:1.7.0_09]

Considering my metadata does not indicate that encryption is necessary I'm not sure as to why this is occurring.

I have understood how SAML works, I have been trying to work as close to the requested implementation from the client but this is obviously causing problems so I will inform them that they need to confirm to the guidelines I've read and understood.

Thanks in advance.

-----Original Message-----
From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 15 January 2013 16:06
To: Shib Dev
Subject: Re: IDP Failure

On 1/15/13 10:53 AM, "Ogunleye, Philip" <Philip.Ogunleye at snapon.com> wrote:

>Forgive my naivety but I did not know that I couldn¹t use a transientID 
>to send the username.

You don't send anything in a request, that's a very specialized case. The IdP tells you who the user is after they login and it responds.

You certainly can't send a transient ID, because you don't know any. The transient would be created after login time by the IdP and used to mask the user identity. Yours is bogus and the IdP is failing to reverse it and then simply gives up.

>  I am working off of an example provided by the company who will be 
>the identity provider going forward.  I have setup all areas to use 
>transient  ids.  I simply want the value sent over to be verified in 
>the directory service and reported back successfully.

That's not how SAML works. You don't verify the user's identity, you get it in the response. Your request is to identify who you are and other inputs to the process. You need to read the standard, basically.

> 
>However I am getting a failure response below.  I haven¹t seen any 
>indication on the shibboleth wiki to tell me otherwise so assumed it 
>was ok to send in this format.  I have amended the service provider to 
>send the request as a WindowDomainQualifiedName  value.  However the 
>same response is sent back.  The name ID format in both the IDP and SP 
>metadata has been modified to go in the same format too.  I will also 
>amend the attribute-resolver.xml and the attribute-filter.xml likewise.
> 
>Please let me know what else should be changed.

I did. Stop sending a NameID in the request so the IdP doesn't have to try and reverse it during processing.

-- Scott


--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net