Multiple SPs do not benefit from SSO
MA Lanxin
ma at ihep.ac.cn
Thu Feb 2 14:22:06 GMT 2012
Hello,
My IDP version is 2.3.5 now. My SP version is 2.4.3.
I tried with the two SPs which are in different hosts.
https://sp-test.ihep.ac.cn/secure
https://sp-wr.ihep.ac.cn/wreport
Here is the log in my IDP log file when I access my first SP https://sp-test.ihep.ac.cn/secure
17:42:06.281 - INFO [Shibboleth-Access:74] - 20120202T094206Z|202.122.32.43|idp.ihep.ac.cn:443|/profile/SAML2/Redirect/SSO|
17:42:06.281 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO
17:42:06.281 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
17:42:06.282 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:323] - LoginContext key cookie was not present in request
17:42:06.282 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:160] - Incoming request does not contain a login context, processing as first leg of request
17:42:06.282 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:312] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
17:42:06.283 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] - Looking up relying party configuration for https://sp-test.ihep.ac.cn/shibboleth
17:42:06.284 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:133] - No custom relying party configuration found for https://sp-test.ihep.ac.cn/shibboleth, looking up configuration based on metadata groups.
17:42:06.284 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:156] - No custom or group-based relying party configuration found for https://sp-test.ihep.ac.cn/shibboleth. Using default relying party configuration.
17:42:06.284 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:333] - Decoded request from relying party 'https://sp-test.ihep.ac.cn/shibboleth'
17:42:06.285 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] - Looking up relying party configuration for https://sp-test.ihep.ac.cn/shibboleth
17:42:06.285 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:133] - No custom relying party configuration found for https://sp-test.ihep.ac.cn/shibboleth, looking up configuration based on metadata groups.
17:42:06.285 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:156] - No custom or group-based relying party configuration found for https://sp-test.ihep.ac.cn/shibboleth. Using default relying party configuration.
17:42:06.285 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:203] - Creating login context and transferring control to authentication engine
17:42:06.287 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] - Storing LoginContext to StorageService partition loginContexts, key d11dc427-8005-4933-bda0-962ddb8bf4ea
17:42:06.287 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:216] - Redirecting user to authentication engine at https://idp.ihep.ac.cn:443/idp/AuthnEngine
17:42:06.289 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:202] - Processing incoming request
17:42:06.290 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:233] - Beginning user authentication process.
17:42:06.290 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:279] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler at 29a046}
17:42:06.290 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:460] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler at 29a046}
17:42:06.290 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:493] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler
17:42:06.291 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] - Storing LoginContext to StorageService partition loginContexts, key 47358ac3-6401-4758-962b-3d259aa35fad
17:42:06.291 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler:66] - Redirecting to https://idp.ihep.ac.cn:443/idp/Authn/UserPassword
17:42:06.294 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:134] - Redirecting to login page /login.jsp
--------------------------------------------------------------------------------------------
After I passed the first SP authentication, I accessed my second SP https://sp-wr.ihep.ac.cn/wreport at the same browser. It redicted to the login page. Here is the log in my IDP logfile for my second SP.
17:51:25.862 - INFO [Shibboleth-Access:74] - 20120202T095125Z|202.122.32.43|idp.ihep.ac.cn:443|/profile/SAML2/Redirect/SSO|
17:51:25.862 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO
17:51:25.863 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
17:51:25.863 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:323] - LoginContext key cookie was not present in request
17:51:25.863 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:160] - Incoming request does not contain a login context, processing as first leg of request
17:51:25.863 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:312] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
17:51:25.864 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] - Looking up relying party configuration for https://sp-wr.ihep.ac.cn/shibboleth
17:51:25.865 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:133] - No custom relying party configuration found for https://sp-wr.ihep.ac.cn/shibboleth, looking up configuration based on metadata groups.
17:51:25.865 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:156] - No custom or group-based relying party configuration found for https://sp-wr.ihep.ac.cn/shibboleth. Using default relying party configuration.
17:51:25.865 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:333] - Decoded request from relying party 'https://sp-wr.ihep.ac.cn/shibboleth'
17:51:25.866 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] - Looking up relying party configuration for https://sp-wr.ihep.ac.cn/shibboleth
17:51:25.866 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:133] - No custom relying party configuration found for https://sp-wr.ihep.ac.cn/shibboleth, looking up configuration based on metadata groups.
17:51:25.866 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:156] - No custom or group-based relying party configuration found for https://sp-wr.ihep.ac.cn/shibboleth. Using default relying party configuration.
17:51:25.866 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:203] - Creating login context and transferring control to authentication engine
17:51:25.868 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] - Storing LoginContext to StorageService partition loginContexts, key 9a3286fb-13c4-41d8-8939-44d07b30ba45
17:51:25.868 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:216] - Redirecting user to authentication engine at https://idp.ihep.ac.cn:443/idp/AuthnEngine
17:51:25.870 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:202] - Processing incoming request
17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:233] - Beginning user authentication process.
17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:237] - Existing IdP session available for principal ma
17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:279] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler at 29a046}
17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:460] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler at 29a046}
17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:493] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler
17:51:25.872 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] - Storing LoginContext to StorageService partition loginContexts, key b6c7dca0-c736-4312-95ff-81ddddb6103e
17:51:25.872 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler:66] - Redirecting to https://idp.ihep.ac.cn:443/idp/Authn/UserPassword
17:51:25.875 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:134] - Redirecting to login page /login.jsp
17:52:35.472 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:154] - Attempting to authenticate user ma
The relying party config in my IDP relying-party.xml
<!-- ========================================== -->
<!-- Relying Party Configurations -->
<!-- ========================================== -->
<rp:AnonymousRelyingParty provider="https://idp.ihep.ac.cn/idp/shibboleth" defaultSigningCredentialRef="IdPCredent
ial"/>
<rp:DefaultRelyingParty provider="https://idp.ihep.ac.cn/idp/shibboleth" defaultSigningCredentialRef="IdPCredentia
l"
defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
<rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" />
<rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile" />
<rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile" />
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" />
<rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" />
<rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" signResponses="always"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" />
</rp:DefaultRelyingParty>
As I do not really understand the log, could you please give some clue what I should check ?
Thank you very much!!
Regards,
Lanxin
> -----原始邮件-----
> 发件人: "Chad La Joie" <lajoie at itumi.biz>
> 发送时间: 2012年2月1日 星期三
> 收件人: "Shib Users" <users at shibboleth.net>
> 抄送:
> 主题: Re: Multiple SPs do not benefit from SSO
>
> Well, first, your IdP need to be upgraded.
>
> Then, turn on debugging for the IdP and look at your logs. It should
> tell you why it not using the existing authentication method in order
> to respond to your second SP.
>
> On Wed, Feb 1, 2012 at 04:20, MA Lanxin <ma at ihep.ac.cn> wrote:
> > Dear all,
> >
> > I encountered a problem when I deploy shibboleth. Could anybody help me?
> >
> > I have one IDP(version 2.1) with UserPassword mothed against LDAP.
> > I have several web contents that I want to protect in different hosts,
> > and integrated SP 2.4.3 with Apache at each host. I have no DS currently.
> >
> > for example:
> >
> > https://sp1.ihep.ac.cn/secure
> > https://sp2.ihep.ac.cn/app
> >
> >
> > I passed the SSO authentication when I access
> >
> > https://sp1.ihep.ac.cn/secure
> >
> > I could get user's information(username,email,telephone,......) from apache header.
> > After this,I access another one at the same browser
> >
> > https://sp2.ihep.ac.cn/app
> >
> > It redirected to the authentication page requesting to type username/password.
> > It seems that it do not benefit from SSO when I access sp2. If I understood correctly,
> > it should not re-authenticate.
> >
> > I do not configure "forceAuthn" on my SPs.
> > Here is the configure in shibboleth2.xml on SP1 and SP2
> >
> > <SSO entityID="https://idp.ihep.ac.cn/idp/shibboleth">
> > SAML2 SAML1
> > </SSO>
> >
> > Here is the configuration in apache on sp1
> > <Location /secure>
> > AuthType shibboleth
> > ShibRequestSetting requireSession 1
> > require valid-user
> > </Location>
> >
> >
> > This is the configuration in apche on sp2
> > <Location /app>
> > AuthType shibboleth
> > ShibRequestSetting requireSession 1
> > require valid-user
> > </Location>
> >
> > DO I miss some configuration on IDP or SP?
> >
> > THank you very much!!
> >
> > REgards,
> > Lanxin
> >
> >
> >
> > --
> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list