<div dir="ltr"><div class="gmail_quote">Hi all,<br><br>I am using Shibboleth IDP to provide authentication to access a web application. <br><div dir="ltr"><div> I was able configure SSO via Shibboleth IDP and SSO works without any issue. But when it comes to SLO, it requires a profile handler to handle SLO request. According to [1] I have configured profile handler relying-party.xml as following.</div><div><br></div><div><rp:RelyingParty id="wso2is" provider="<a href="https://idp.example.org/idp/shibboleth" target="_blank">https://idp.example.org/idp/shibboleth</a>" defaultSigningCredentialRef="IdPCredential" defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"></div><div><rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" signResponses="always" signAssertions="always" encryptAssertions="never" encryptNameIds="never"/></div><div><rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile" signResponses="always" signAssertions="always" encryptAssertions="never" encryptNameIds="never" /></div><div></rp:RelyingParty></div><div><br></div><div>But I'm getting Error Message: Message did not meet security requirements error when tying to SLO. Following exception[2] can be observed in idp-process log file of Shibboleth IDP. Can someone help me to figure out what am I missing when configuring SLO with Shibboleth IDP?</div><div><br></div><div><br></div><div><br></div><div>[1]. <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2LogoutRequestProfileConfig" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2LogoutRequestProfileConfig</a></div><div>[2]. 07:04:54.313 - DEBUG [org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder:112] - Extracting ID, issuer and issue instant from request</div><div>07:04:54.313 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID: wso2is</div><div>07:04:54.313 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of wso2is</div><div>07:04:54.313 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] - Metadata document does not contain an EntityDescriptor with the ID wso2is</div><div>07:04:54.314 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID: wso2is</div><div>07:04:54.314 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of wso2is</div><div>07:04:54.314 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for wso2is</div><div>07:04:54.314 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:130] - Custom relying party configuration found for wso2is</div><div>07:04:54.315 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:130] - Evaluating security policy of type 'edu.internet2.middleware.shibboleth.common.security.ShibbolethSecurityPolicy' for decoded message</div><div>07:04:54.315 - DEBUG [org.opensaml.util.storage.ReplayCache:92] - Attempting to acquire lock for replay cache check</div><div>07:04:54.315 - DEBUG [org.opensaml.util.storage.ReplayCache:94] - Lock acquired</div><div>07:04:54.315 - DEBUG [org.opensaml.util.storage.ReplayCache:105] - Message ID lkncbaghebkbojimmgjiapapmamolpipdbnngfgc was not a replay</div><div>07:04:54.315 - DEBUG [org.opensaml.util.storage.ReplayCache:132] - Writing message ID wso2islkncbaghebkbojimmgjiapapmamolpipdbnngfgc to replay cache with expiration time 2015-07-13T07:09:54.315+05:30</div><div>07:04:54.316 - INFO [org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:100] - SAML protocol message was not signed, skipping XML signature processing</div><div>07:04:54.316 - DEBUG [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:64] - Evaluating simple signature rule of type: org.opensaml.saml2.binding.security.SAML2HTTPRedirectDeflateSignatureRule</div><div>07:04:54.316 - DEBUG [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:87] - HTTP request was not signed via simple signature mechanism, skipping</div><div>07:04:54.316 - DEBUG [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:64] - Evaluating simple signature rule of type: org.opensaml.saml2.binding.security.SAML2HTTPPostSimpleSignRule</div><div>07:04:54.316 - DEBUG [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:81] - Rule can not handle this request, skipping processing</div><div>07:04:54.317 - INFO [org.opensaml.ws.transport.http.HttpServletRequestAdapter:130] - Wrapped HTTP servlet request did not contain a client certificate</div><div>07:04:54.317 - INFO [org.opensaml.ws.security.provider.ClientCertAuthRule:104] - Inbound message transport did not contain a peer credential, skipping client certificate authentication</div><div>07:04:54.318 - ERROR [org.opensaml.ws.security.provider.MandatoryAuthenticatedMessageRule:37] - Inbound message issuer was not authenticated.</div><div>07:04:54.319 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:563] - Message did not meet security requirements</div><div>org.opensaml.ws.security.SecurityPolicyException: Inbound message issuer was not authenticated.</div><div><span style="white-space:pre-wrap"> </span>at org.opensaml.ws.security.provider.MandatoryAuthenticatedMessageRule.evaluate(MandatoryAuthenticatedMessageRule.java:38) ~[openws-1.5.5.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51) ~[openws-1.5.5.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132) ~[openws-1.5.5.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83) ~[openws-1.5.5.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) ~[opensaml-2.6.5.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.decodeRequest(SLOProfileHandler.java:535) [shibboleth-identityprovider-2.4.4.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processLogoutRequest(SLOProfileHandler.java:260) [shibboleth-identityprovider-2.4.4.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processRequest(SLOProfileHandler.java:161) [shibboleth-identityprovider-2.4.4.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processRequest(SLOProfileHandler.java:72) [shibboleth-identityprovider-2.4.4.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.4.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) [servlet-api.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat7-websocket.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.4.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.4.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.4.jar:na]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) [catalina.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070) [tomcat-coyote.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) [tomcat-coyote.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) [tomcat-coyote.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [na:1.7.0_71]</div><div><span style="white-space:pre-wrap"> </span>at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [na:1.7.0_71]</div><div><span style="white-space:pre-wrap"> </span>at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-coyote.jar:7.0.55]</div><div><span style="white-space:pre-wrap"> </span>at java.lang.Thread.run(Thread.java:745) [na:1.7.0_71]</div><div><br></div><div><br></div><div>Thank you.</div><span class="HOEnZb"><font color="#888888"><div><br></div>-- <br><div><div dir="ltr"><font color="#888888"><span><font color="#999999"><font face="verdana,sans-serif"><b>Best Regards,<br><br><span><font color="#888888">
</font></span>Vijitha Ekanayake</b><br></font></font></span></font></div></div></font></span></div></div>
</div>