Multiple SPs do not benefit from SSO
Kevin P. Foote
kpfoote at iup.edu
Thu Feb 2 14:27:25 GMT 2012
In handler.xml do you have the the "ph:PrevousSession" LoginHandler
commented out?
You could have already checked this .. I didn't look back in the thread..
apologies if that's the case.
------
thanks
kevin.foote
On Thu, 2 Feb 2012, MA Lanxin wrote:
->
-> Hello,
->
-> My IDP version is 2.3.5 now. My SP version is 2.4.3.
->
-> I tried with the two SPs which are in different hosts.
->
-> https://sp-test.ihep.ac.cn/secure
-> https://sp-wr.ihep.ac.cn/wreport
->
-> Here is the log in my IDP log file when I access my first SP https://sp-test.ihep.ac.cn/secure
->
-> 17:42:06.281 - INFO [Shibboleth-Access:74] - 20120202T094206Z|202.122.32.43|idp.ihep.ac.cn:443|/profile/SAML2/Redirect/SSO|
-> 17:42:06.281 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO
-> 17:42:06.281 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
-> 17:42:06.282 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:323] - LoginContext key cookie was not present in request
-> 17:42:06.282 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:160] - Incoming request does not contain a login context, processing as first leg of request
-> 17:42:06.282 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:312] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
-> 17:42:06.283 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] - Looking up relying party configuration for https://sp-test.ihep.ac.cn/shibboleth
-> 17:42:06.284 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:133] - No custom relying party configuration found for https://sp-test.ihep.ac.cn/shibboleth, looking up configuration based on metadata groups.
-> 17:42:06.284 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:156] - No custom or group-based relying party configuration found for https://sp-test.ihep.ac.cn/shibboleth. Using default relying party configuration.
-> 17:42:06.284 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:333] - Decoded request from relying party 'https://sp-test.ihep.ac.cn/shibboleth'
-> 17:42:06.285 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] - Looking up relying party configuration for https://sp-test.ihep.ac.cn/shibboleth
-> 17:42:06.285 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:133] - No custom relying party configuration found for https://sp-test.ihep.ac.cn/shibboleth, looking up configuration based on metadata groups.
-> 17:42:06.285 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:156] - No custom or group-based relying party configuration found for https://sp-test.ihep.ac.cn/shibboleth. Using default relying party configuration.
-> 17:42:06.285 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:203] - Creating login context and transferring control to authentication engine
-> 17:42:06.287 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] - Storing LoginContext to StorageService partition loginContexts, key d11dc427-8005-4933-bda0-962ddb8bf4ea
-> 17:42:06.287 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:216] - Redirecting user to authentication engine at https://idp.ihep.ac.cn:443/idp/AuthnEngine
-> 17:42:06.289 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:202] - Processing incoming request
-> 17:42:06.290 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:233] - Beginning user authentication process.
-> 17:42:06.290 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:279] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler at 29a046}
-> 17:42:06.290 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:460] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler at 29a046}
-> 17:42:06.290 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:493] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler
-> 17:42:06.291 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] - Storing LoginContext to StorageService partition loginContexts, key 47358ac3-6401-4758-962b-3d259aa35fad
-> 17:42:06.291 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler:66] - Redirecting to https://idp.ihep.ac.cn:443/idp/Authn/UserPassword
-> 17:42:06.294 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:134] - Redirecting to login page /login.jsp
->
->
->
->
->
-> --------------------------------------------------------------------------------------------
->
->
->
-> After I passed the first SP authentication, I accessed my second SP https://sp-wr.ihep.ac.cn/wreport at the same browser. It redicted to the login page. Here is the log in my IDP logfile for my second SP.
->
->
-> 17:51:25.862 - INFO [Shibboleth-Access:74] - 20120202T095125Z|202.122.32.43|idp.ihep.ac.cn:443|/profile/SAML2/Redirect/SSO|
-> 17:51:25.862 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO
-> 17:51:25.863 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
-> 17:51:25.863 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:323] - LoginContext key cookie was not present in request
-> 17:51:25.863 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:160] - Incoming request does not contain a login context, processing as first leg of request
-> 17:51:25.863 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:312] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
-> 17:51:25.864 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] - Looking up relying party configuration for https://sp-wr.ihep.ac.cn/shibboleth
-> 17:51:25.865 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:133] - No custom relying party configuration found for https://sp-wr.ihep.ac.cn/shibboleth, looking up configuration based on metadata groups.
-> 17:51:25.865 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:156] - No custom or group-based relying party configuration found for https://sp-wr.ihep.ac.cn/shibboleth. Using default relying party configuration.
-> 17:51:25.865 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:333] - Decoded request from relying party 'https://sp-wr.ihep.ac.cn/shibboleth'
-> 17:51:25.866 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] - Looking up relying party configuration for https://sp-wr.ihep.ac.cn/shibboleth
-> 17:51:25.866 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:133] - No custom relying party configuration found for https://sp-wr.ihep.ac.cn/shibboleth, looking up configuration based on metadata groups.
-> 17:51:25.866 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:156] - No custom or group-based relying party configuration found for https://sp-wr.ihep.ac.cn/shibboleth. Using default relying party configuration.
-> 17:51:25.866 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:203] - Creating login context and transferring control to authentication engine
-> 17:51:25.868 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] - Storing LoginContext to StorageService partition loginContexts, key 9a3286fb-13c4-41d8-8939-44d07b30ba45
-> 17:51:25.868 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:216] - Redirecting user to authentication engine at https://idp.ihep.ac.cn:443/idp/AuthnEngine
-> 17:51:25.870 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:202] - Processing incoming request
-> 17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:233] - Beginning user authentication process.
-> 17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:237] - Existing IdP session available for principal ma
-> 17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:279] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler at 29a046}
-> 17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:460] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler at 29a046}
-> 17:51:25.871 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:493] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler
-> 17:51:25.872 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] - Storing LoginContext to StorageService partition loginContexts, key b6c7dca0-c736-4312-95ff-81ddddb6103e
-> 17:51:25.872 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginHandler:66] - Redirecting to https://idp.ihep.ac.cn:443/idp/Authn/UserPassword
-> 17:51:25.875 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:134] - Redirecting to login page /login.jsp
-> 17:52:35.472 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:154] - Attempting to authenticate user ma
->
->
->
-> The relying party config in my IDP relying-party.xml
->
-> <!-- ========================================== -->
-> <!-- Relying Party Configurations -->
-> <!-- ========================================== -->
->
-> <rp:AnonymousRelyingParty provider="https://idp.ihep.ac.cn/idp/shibboleth" defaultSigningCredentialRef="IdPCredent
-> ial"/>
->
-> <rp:DefaultRelyingParty provider="https://idp.ihep.ac.cn/idp/shibboleth" defaultSigningCredentialRef="IdPCredentia
-> l"
-> defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
-> <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" />
->
-> <rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile" />
->
-> <rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile" />
->
-> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" />
->
-> <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" />
->
-> <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" signResponses="always"/>
->
-> <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" />
->
-> </rp:DefaultRelyingParty>
->
->
-> As I do not really understand the log, could you please give some clue what I should check ?
->
-> Thank you very much!!
->
-> Regards,
-> Lanxin
->
->
-> > -----原始邮件-----
-> > 发件人: "Chad La Joie" <lajoie at itumi.biz>
-> > 发送时间: 2012年2月1日 星期三
-> > 收件人: "Shib Users" <users at shibboleth.net>
-> > 抄送:
-> > 主题: Re: Multiple SPs do not benefit from SSO
-> >
-> > Well, first, your IdP need to be upgraded.
-> >
-> > Then, turn on debugging for the IdP and look at your logs. It should
-> > tell you why it not using the existing authentication method in order
-> > to respond to your second SP.
-> >
-> > On Wed, Feb 1, 2012 at 04:20, MA Lanxin <ma at ihep.ac.cn> wrote:
-> > > Dear all,
-> > >
-> > > I encountered a problem when I deploy shibboleth. Could anybody help me?
-> > >
-> > > I have one IDP(version 2.1) with UserPassword mothed against LDAP.
-> > > I have several web contents that I want to protect in different hosts,
-> > > and integrated SP 2.4.3 with Apache at each host. I have no DS currently.
-> > >
-> > > for example:
-> > >
-> > > https://sp1.ihep.ac.cn/secure
-> > > https://sp2.ihep.ac.cn/app
-> > >
-> > >
-> > > I passed the SSO authentication when I access
-> > >
-> > > https://sp1.ihep.ac.cn/secure
-> > >
-> > > I could get user's information(username,email,telephone,......) from apache header.
-> > > After this,I access another one at the same browser
-> > >
-> > > https://sp2.ihep.ac.cn/app
-> > >
-> > > It redirected to the authentication page requesting to type username/password.
-> > > It seems that it do not benefit from SSO when I access sp2. If I understood correctly,
-> > > it should not re-authenticate.
-> > >
-> > > I do not configure "forceAuthn" on my SPs.
-> > > Here is the configure in shibboleth2.xml on SP1 and SP2
-> > >
-> > > <SSO entityID="https://idp.ihep.ac.cn/idp/shibboleth">
-> > > SAML2 SAML1
-> > > </SSO>
-> > >
-> > > Here is the configuration in apache on sp1
-> > > <Location /secure>
-> > > AuthType shibboleth
-> > > ShibRequestSetting requireSession 1
-> > > require valid-user
-> > > </Location>
-> > >
-> > >
-> > > This is the configuration in apche on sp2
-> > > <Location /app>
-> > > AuthType shibboleth
-> > > ShibRequestSetting requireSession 1
-> > > require valid-user
-> > > </Location>
-> > >
-> > > DO I miss some configuration on IDP or SP?
-> > >
-> > > THank you very much!!
-> > >
-> > > REgards,
-> > > Lanxin
-> > >
-> > >
-> > >
-> > > --
-> > > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-> >
-> >
-> >
-> > --
-> > Chad La Joie
-> > www.itumi.biz
-> > trusted identities, delivered
-> > --
-> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
->
-> --
-> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list