Fwd: Federated Single Logout issue.

[Vijitha Ekanayake]

Hi all,

I am using Shibboleth IDP to provide authentication to access a web
application.
 I was able configure SSO via Shibboleth IDP and SSO works without any
issue. But when it comes to SLO, it requires a profile handler to handle
SLO request. According to [1] I have configured profile handler
relying-party.xml as following.

<rp:RelyingParty id="wso2is" provider="
https://idp.example.org/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential"
defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
signResponses="always" signAssertions="always" encryptAssertions="never"
encryptNameIds="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile"
signResponses="always" signAssertions="always" encryptAssertions="never"
encryptNameIds="never" />
</rp:RelyingParty>

But I'm getting Error Message: Message did not meet security requirements
error when tying to SLO. Following exception[2] can be observed in
idp-process log file of Shibboleth IDP. Can someone help me to figure out
what am I missing when configuring SLO with Shibboleth IDP?



[1].
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2LogoutRequestProfileConfig
[2]. 07:04:54.313 - DEBUG
[org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder:112] -
Extracting ID, issuer and issue instant from request
07:04:54.313 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
wso2is
07:04:54.313 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of wso2is
07:04:54.313 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] -
Metadata document does not contain an EntityDescriptor with the ID wso2is
07:04:54.314 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
wso2is
07:04:54.314 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] -
Searching for entity descriptor with an entity ID of wso2is
07:04:54.314 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128]
- Looking up relying party configuration for wso2is
07:04:54.314 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:130]
- Custom relying party configuration found for wso2is
07:04:54.315 - DEBUG
[org.opensaml.ws.message.decoder.BaseMessageDecoder:130] - Evaluating
security policy of type
'edu.internet2.middleware.shibboleth.common.security.ShibbolethSecurityPolicy'
for decoded message
07:04:54.315 - DEBUG [org.opensaml.util.storage.ReplayCache:92] -
Attempting to acquire lock for replay cache check
07:04:54.315 - DEBUG [org.opensaml.util.storage.ReplayCache:94] - Lock
acquired
07:04:54.315 - DEBUG [org.opensaml.util.storage.ReplayCache:105] - Message
ID lkncbaghebkbojimmgjiapapmamolpipdbnngfgc was not a replay
07:04:54.315 - DEBUG [org.opensaml.util.storage.ReplayCache:132] - Writing
message ID wso2islkncbaghebkbojimmgjiapapmamolpipdbnngfgc to replay cache
with expiration time 2015-07-13T07:09:54.315+05:30
07:04:54.316 - INFO
[org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:100]
- SAML protocol message was not signed, skipping XML signature processing
07:04:54.316 - DEBUG
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:64]
- Evaluating simple signature rule of type:
org.opensaml.saml2.binding.security.SAML2HTTPRedirectDeflateSignatureRule
07:04:54.316 - DEBUG
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:87]
- HTTP request was not signed via simple signature mechanism, skipping
07:04:54.316 - DEBUG
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:64]
- Evaluating simple signature rule of type:
org.opensaml.saml2.binding.security.SAML2HTTPPostSimpleSignRule
07:04:54.316 - DEBUG
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:81]
- Rule can not handle this request, skipping processing
07:04:54.317 - INFO
[org.opensaml.ws.transport.http.HttpServletRequestAdapter:130] - Wrapped
HTTP servlet request did not contain a client certificate
07:04:54.317 - INFO
[org.opensaml.ws.security.provider.ClientCertAuthRule:104] - Inbound
message transport did not contain a peer credential, skipping client
certificate authentication
07:04:54.318 - ERROR
[org.opensaml.ws.security.provider.MandatoryAuthenticatedMessageRule:37] -
Inbound message issuer was not authenticated.
07:04:54.319 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:563]
- Message did not meet security requirements
org.opensaml.ws.security.SecurityPolicyException: Inbound message issuer
was not authenticated.
at
org.opensaml.ws.security.provider.MandatoryAuthenticatedMessageRule.evaluate(MandatoryAuthenticatedMessageRule.java:38)
~[openws-1.5.5.jar:na]
at
org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51)
~[openws-1.5.5.jar:na]
at
org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132)
~[openws-1.5.5.jar:na]
at
org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83)
~[openws-1.5.5.jar:na]
at
org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70)
~[opensaml-2.6.5.jar:na]
at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.decodeRequest(SLOProfileHandler.java:535)
[shibboleth-identityprovider-2.4.4.jar:na]
at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processLogoutRequest(SLOProfileHandler.java:260)
[shibboleth-identityprovider-2.4.4.jar:na]
at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processRequest(SLOProfileHandler.java:161)
[shibboleth-identityprovider-2.4.4.jar:na]
at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processRequest(SLOProfileHandler.java:72)
[shibboleth-identityprovider-2.4.4.jar:na]
at
edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
[shibboleth-common-1.4.4.jar:na]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
[servlet-api.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
[catalina.jar:7.0.55]
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
[tomcat7-websocket.jar:7.0.55]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
[catalina.jar:7.0.55]
at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
[shibboleth-identityprovider-2.4.4.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
[catalina.jar:7.0.55]
at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87)
[shibboleth-identityprovider-2.4.4.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
[catalina.jar:7.0.55]
at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
[shibboleth-common-1.4.4.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
[catalina.jar:7.0.55]
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
[catalina.jar:7.0.55]
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
[catalina.jar:7.0.55]
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
[catalina.jar:7.0.55]
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
[catalina.jar:7.0.55]
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
[catalina.jar:7.0.55]
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070)
[tomcat-coyote.jar:7.0.55]
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
[tomcat-coyote.jar:7.0.55]
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
[tomcat-coyote.jar:7.0.55]
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
[na:1.7.0_71]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
[na:1.7.0_71]
at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
[tomcat-coyote.jar:7.0.55]
at java.lang.Thread.run(Thread.java:745) [na:1.7.0_71]


Thank you.

-- 


*Best Regards, Vijitha Ekanayake*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150713/987123af/attachment.html>