Setting up ECP in shibboleth SP

Anand Somani meatforums at gmail.com
Wed Dec 21 08:24:45 GMT 2011


Hi

I am struggling to get the SP ECP binding working. Have looked at the email
threads, but am not able to make out what I am doing wrong. The shibd
process crashes when I send the curl command (as indicated by ecp.sh).
Maybe I have misconfigured something here, but am not able to make out, any
help is appreciated.

Thanks
Anand

Here is the last log message

2011-12-21 08:10:45 INFO Shibboleth.Listener : registered remoted message
endpoint (default::getHeaders::Application)
2011-12-21 08:10:45 INFO Shibboleth.Listener : listener service starting
2011-12-21 08:10:57 DEBUG Shibboleth.Listener [1]: dispatching message
(default/Login::run::SAML2SI)
2011-12-21 08:10:57 DEBUG XMLTooling.StorageService [1]: inserted record
(3ebec2baae691f7e09b4ef2959d5870a) in context (RelayState) with expiration
(1324455657)
2011-12-21 08:10:57 DEBUG OpenSAML.MessageEncoder.SAML2ECP [1]: validating
input
2011-12-21 08:10:57 DEBUG OpenSAML.MessageEncoder.SAML2ECP [1]: marshalling
the envelope

+++++++++++++++++++++++++++++++++
output from curl command
++++++++++++++++++++++++++++++++
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
    PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
    <link rel="stylesheet" type="text/css" href="/shibboleth-sp/main.css" />
    <title>shibsp&#58;&#58;ListenerException</title>
</head>

<body>

<img src="/shibboleth-sp/logo.jpg" alt="Logo" />
<h1>shibsp&#58;&#58;ListenerException</h1>

<p>The system encountered an error at Wed Dec 21 08&#58;10&#58;57 2011
</p>

<p>To report this problem, please contact the site administrator at
<a href="mailto:root at localhost">root at localhost</a>.
</p>

<p>Please include the following message in any email:</p>
<p class="error">shibsp&#58;&#58;ListenerException at (https&#58;//
m1234.lab.ppops.net/secure)</p>

<p>Failure receiving response to remoted message
&#40;default/Login&#58;&#58;run&#58;&#58;SAML2SI&#41;.</p>


+++++++++++++++++++++++++++++++++
my shibboleth2.xml =>
+++++++++++++++++++++++++++++++++
<ApplicationDefaults entityID="https://m1234.lab.ppops.net/shibboleth"
                         REMOTE_USER="eppn persistent-id targeted-id">
<Sessions lifetime="28800" timeout="3600" checkAddress="false"
relayState="ss:mem" handlerSSL="false" cookieProps="; path=/; secure">

<SessionInitiator type="Chaining" Location="/Login" isDefault="true"
id="Intranet"
        entityID="https://obelix.obelix.com/idp/shibboleth">
        <SessionInitiator type="SAML2" ECP="true"
template="bindingTemplate.html"
                ascIndex="3" acsByIndex="false" />
    </SessionInitiator>
    <LogoutInitiator type="Chaining" Location="/Logout">
        <LogoutInitiator type="Local" />
    </LogoutInitiator>
    <md:AssertionConsumerService Location="/SAML2/POST" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
    <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign"
index="2"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
    <md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
    <md:AssertionConsumerService Location="/SAML2/ECP" index="4"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
    <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session"
showAttributeValues="false"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

        <!--
        Allows overriding of error template information/filenames. You can
        also add attributes with values that can be plugged into the
templates.
        -->
        <Errors supportContact="root at localhost"
            logoLocation="/shibboleth-sp/logo.jpg"
            styleSheet="/shibboleth-sp/main.css"/>

        <!-- Example of remotely supplied batch of signed metadata. -->
        <MetadataProvider type="XML" uri="
https://obelix.obelix.com/idp/profile/Metadata/SAML"
              backingFilePath="federation-metadata.xml"
reloadInterval="7200">
<!--
            <MetadataFilter type="RequireValidUntil"
maxValidityInterval="2419200"/>
-->
            <!--<MetadataFilter type="Signature"
certificate="fedsigner.pem"/> -->
        </MetadataProvider>
<AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>

        <!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>

        <!-- Default filtering policy for recognized attributes, lets other
data pass. -->
        <AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/>

        <!-- Simple file-based resolver for using a single keypair. -->
        <CredentialResolver type="File" key="sp-key.pem"
certificate="sp-cert.pem"/>

        <!--
        The default settings can be overridden by creating
ApplicationOverride elements (see
        the
https://spaces.internet2.edu/display/SHIB2/NativeSPApplicationOverridetopic).
        Resource requests are mapped by web server commands, or the
RequestMapper, to an
        applicationId setting.

        Example of a second application (for a second vhost) that has a
different entityID.
        Resources on the vhost would map to an applicationId of "admin":
        -->
        <!--
        <ApplicationOverride id="admin" entityID="
https://admin.example.org/shibboleth"/>
        -->
    </ApplicationDefaults>

    <!-- Policies that determine how to process and authenticate runtime
messages. -->
    <SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for
use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>

</SPConfig>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111221/a878a60f/attachment.html 


More information about the users mailing list