<html>
<head>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I'm messing around with the new NativeSPBackDoor functionality in
Shib 2.5. I am calling the ExternalAuth handler
(<a class="moz-txt-link-freetext" href="https://localhost/Shibboleth.sso/ExternalAuth">https://localhost/Shibboleth.sso/ExternalAuth</a>) of the SP from the
same host with a curl call. I am shoveling some attributes into the
POST request and the SP is seeing them according to the logs below.
These are the same attributes I send from the actual IDP that is my
OpenID-SAML gateway, and I set the
<meta charset="utf-8">
<span style="color: rgb(51, 51, 51); font-family: monospace;
font-size: 13px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height: 17px;
orphans: 2; text-align: left; text-indent: 0px; text-transform:
none; white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); display: inline !important;
float: none; ">issuer variable to be the same as that IDP (</span><a class="moz-txt-link-freetext" href="https://openid.et-test.psu.edu/idp/shibboleth">https://openid.et-test.psu.edu/idp/shibboleth</a>).
The SP return me an XML block which I parse and pluck out the shib
session cookie , <cookie>_shibsession_64656661756c7468747470733a2f2f636f6e666c75656e63652e65742d746573742e7073752e6564752f73686962626f6c657468=_8b757555222f8a1774afd3f006b50057;
path=/; HttpOnly</cookie> in this particular case, and I send a
header to the client to set that cookie. So, everything looks good
until I try to come into the SP directly with that cookie. <br>
<br>
<br>
Here is the SP logs from my call to the ExternalAuth handler:<br>
2012-08-02 14:06:43 DEBUG Shibboleth.Listener [2]: dispatching
message (default::getHeaders::Application)<br>
2012-08-02 14:06:43 DEBUG Shibboleth.Listener [1]: dispatching
message (run::ExternalAuth)<br>
2012-08-02 14:06:43 DEBUG Shibboleth.ExternalAuth [1]: extracting
pushed attributes...<br>
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeExtractor.XML [1]:
skipping unmapped NameID with format
(urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress)<br>
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: filtering
4 attribute(s) from (<a class="moz-txt-link-freetext" href="https://openid.et-test.psu.edu/idp/shibboleth">https://openid.et-test.psu.edu/idp/shibboleth</a>)<br>
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: applying
filtering rule(s) for attribute (openid-id) from
(<a class="moz-txt-link-freetext" href="https://openid.et-test.psu.edu/idp/shibboleth">https://openid.et-test.psu.edu/idp/shibboleth</a>)<br>
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: applying
filtering rule(s) for attribute (edupersonprincipalname) from
(<a class="moz-txt-link-freetext" href="https://openid.et-test.psu.edu/idp/shibboleth">https://openid.et-test.psu.edu/idp/shibboleth</a>)<br>
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: applying
filtering rule(s) for attribute (uid) from
(<a class="moz-txt-link-freetext" href="https://openid.et-test.psu.edu/idp/shibboleth">https://openid.et-test.psu.edu/idp/shibboleth</a>)<br>
2012-08-02 14:06:43 DEBUG Shibboleth.AttributeFilter [1]: applying
filtering rule(s) for attribute (displayname) from
(<a class="moz-txt-link-freetext" href="https://openid.et-test.psu.edu/idp/shibboleth">https://openid.et-test.psu.edu/idp/shibboleth</a>)<br>
2012-08-02 14:06:43 DEBUG Shibboleth.ExternalAuth [1]: resolving
attributes...<br>
2012-08-02 14:06:43 INFO Shibboleth.AttributeResolver.Query [1]: SSO
protocol does not allow for attribute query<br>
2012-08-02 14:06:43 DEBUG Shibboleth.SessionCache [1]: creating new
session<br>
2012-08-02 14:06:43 DEBUG Shibboleth.SessionCache [1]: storing new
session...<br>
2012-08-02 14:06:43 DEBUG XMLTooling.StorageService [1]: inserted
record (session) in context (_8b757555222f8a1774afd3f006b50057) with
expiration (1343934403)<br>
2012-08-02 14:06:43 DEBUG XMLTooling.StorageService [1]: updated
record (<a class="moz-txt-link-abbreviated" href="mailto:testppp@gmail.com">testppp@gmail.com</a>) in context (NameID) with expiration
(1343984803)<br>
2012-08-02 14:06:43 INFO Shibboleth.SessionCache [1]: new session
created: ID (_8b757555222f8a1774afd3f006b50057) IdP
(<a class="moz-txt-link-freetext" href="https://openid.et-test.psu.edu/idp/shibboleth">https://openid.et-test.psu.edu/idp/shibboleth</a>) Protocol(none)
Address (127.0.0.1)<br>
<br>
<br>
<br>
<br>
Here is the log when I try to come in from the web browser with that
session. As you can see the session ID matches the one set above.
But, why does it remove the session right away and redirect me back
to the discovery service? The session hasn't expired as the
expiration timestamp above is 8 hours in the future. <br>
<pre>2012-08-02 14:08:41 DEBUG Shibboleth.Listener [4]: dispatching message (default::getHeaders::Application)
2012-08-02 14:08:41 DEBUG Shibboleth.Listener [4]: dispatching message (find::StorageService::SessionCache)
2012-08-02 14:08:41 DEBUG Shibboleth.Listener [4]: dispatching message (remove::StorageService::SessionCache)
2012-08-02 14:08:41 INFO Shibboleth.SessionCache [4]: removed session (_8b757555222f8a1774afd3f006b50057)
Any ideas on why it is not honoring the session would be greatly appreciated.
Thanks
-c
</pre>
<meta charset="utf-8">
<pre id="title-heading" class="pagetitle" style="line-height: 2; font-weight: bold; padding: 2px 2px 2px 0px; font-size: 24px; margin: 0px 0px 10px; color: rgb(0, 0, 0); width: 1233px; font-family: Arial, Helvetica, FreeSans, sans-serif; font-style: normal; font-variant: normal; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); "><span id="title-text" style="color: rgb(0, 0, 0); ">
</span></pre>
</body>
</html>