Logging Untrusted Providers

Tue Jul 1 17:55:58 EDT 2014

I'm getting an unexpected error in the IdP logs when I issue a query from an untrusted SP.  Is there something else I should be logging?  The error returned to the browser makes a lot more sense to me.  idp-process.log with net.shibboleth.idp on DEBUG, the POST, and the error all below.

21:37:34.972 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:155] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler' on INBOUND message context
21:37:34.973 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:176] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
21:37:34.974 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:155] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml1.binding.impl.SAML1ArtifactRequestIssuerHandler' on INBOUND message context
21:37:34.974 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:176] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
21:37:34.976 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:155] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler' on INBOUND message context
21:37:34.976 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:176] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
21:37:34.978 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:155] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler' on INBOUND message context
21:37:34.979 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:176] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
21:37:34.980 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:155] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context
21:37:34.980 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:176] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
21:37:34.981 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer https://sp.testshib.org/shibboleth-sp
21:37:34.981 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:284] - Profile Request is anonymous: returning configuration shibboleth.AnonymousRelyingParty only
21:37:34.981 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.AnonymousRelyingParty for request
21:37:34.982 - DEBUG [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for relying party configuration shibboleth.AnonymousRelyingParty
21:37:35.000 - ERROR [org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder:91] - Request did not contain either a SAMLRequest or SAMLResponse paramter.  Invalid request for SAML 2 HTTP POST binding.
21:37:35.011 - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: No SAML message present in request
        at org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.getBase64DecodedMessage(HTTPPostDecoder.java:93) ~[opensaml-saml-impl-3.0.0-alpha1.jar:na]
        at org.opensaml.saml.saml2.binding.decoding.impl.HTTPPostDecoder.doDecode(HTTPPostDecoder.java:64) ~[opensaml-saml-impl-3.0.0-alpha1.jar:na]
        at org.opensaml.messaging.decoder.AbstractMessageDecoder.decode(AbstractMessageDecoder.java:58) ~[opensaml-messaging-api-3.0.0-alpha1.jar:na]
        at org.opensaml.messaging.decoder.servlet.AbstractHttpServletRequestMessageDecoder.decode(AbstractHttpServletRequestMessageDecoder.java:55) ~[opensaml-messaging-api-3.0.0-alpha1.jar:na]

7/1/14 9:43:17 PM (thread 0 run 0 test 2): Request content: 
<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceIndex="1" Destination="https://IdPv3LoadTestingELB-1265594674.us-west-2.elb.amazonaws.com:443/idp/profile/SAML2/POST/SSO" ID="3d94af4b-b472-4be8-adb6-121a7aefb57f" IssueInstant="2014-07-01T21:43:17Z" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest>
7/1/14 9:43:17 PM (thread 0 run 0 test 2): sending SSO request to: https://IdPv3LoadTestingELB-1265594674.us-west-2.elb.amazonaws.com:443/idp/profile/SAML2/POST/SSO
7/1/14 9:43:18 PM (thread 0 run 0 test 2): Response content: 

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
  	<head>
    	<meta charset="utf-8" />
    	<title>Web Login Service - Unsupported Request</title>
    	<link rel="stylesheet" type="text/css" href="/idp/css/main.css"/>
  	</head>

  	<body>
    <div class="wrapper">
    	<div class="container">
        	<header>
				<img src="/idp/images/dummylogo.png" alt="Replace or remove this logo"/>
				<h3>Web Login Service - Unsupported Request</h3>
			</header>

        	<div class="content">
            The application you have accessed is not registered for use with this service.            </div>
    	</div>

      	<footer>
        	<div class="container container-footer">
          		<p class="footer-text">Insert your footer text here.</p>
        	</div>
      	</footer>

    </div>
    </body>
</html>