StatusResponseType must have Status. / xmltooling::ValidationException at (https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST)

Stefan König s.koenig at uni-tuebingen.de
Mon Feb 20 15:12:54 GMT 2012 

Chad La Joie:
 >> You don't have much choice, the IdP is producing an invalid response 
the SP isn't going to accept that.

Ok, thx.


Cantor, Scott:
>>  If it's a Shibboleth IdP, then I don't know of any scenario where it would produce such a message, but I guess you should file a bug.

Ok, I'm convinced. Will write a bug report.


Cantor, Scott:
>>  Whatever you were trying to say in the other thread about needing a RelyingParty definition did not make any sense to me, and isn't true, so my suspicion would be to start there.


For others following this thread, here is what is meant:

I had the problem, that my Shibboleth IdP tried to encrypt the Assertion, it generated.Final error message in my browser was: "Could not resolve a key encryption credential for peer entity: https://idefix.worldtalk.de/idp/shibboleth";
It looked for metadata for an SPSSODescriptor with credential definition for the Request sent by the idp itself (Retrieving metadata for entity 'https://idefix.worldtalk.de/idp/shibboleth' in role '{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor' for protocol 'urn:oasis:names:tc:SAML:2.0:protocol').
I also got log lines as "No metadata for relying party https://idefix.worldtalk.de/idp, treating party as anonymous" and "SAML 2 SSO profile is not configured for relying party https://idefix.worldtalk.de/idp"; That's the reason why I finally added a RelyingParty for entity 'https://idefix.worldtalk.de/idp/shibboleth' with itself as its "provider" in the relying-party.xml:

--- CUT HERE (relying-party.xml) ---
     <rp:RelyingParty id="https://idefix.worldtalk.de/idp"
                               provider="https://idefix.worldtalk.de/idp"
                               defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
         <rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" />
         <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" />
         <rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile" />
         <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile" />
     </rp:RelyingParty>
--- CUT HERE ---




--- CUT HERE (idp-process.log) ----
11:01:15.949 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:274] - Attempting to encrypt assertion to relying party 'https://idefix.worldtalk.de/idp/shibboleth'
11:01:15.951 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:279] - Assertion to be encrypted is:
<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_041ed7c8c610dbb33ca8452c33b37887" IssueInstant="2012-02-20T10:01:15.864Z" Version="2.0">
    <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://idefix.worldtalk.de/idp/shibboleth</saml2:Issuer>

[... some more XML ...]

    <saml2:Subject>
       <saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idefix.worldtalk.de/idp/shibboleth" SPNameQualifier="https://idefix.worldtalk.de/idp/shibboleth">_4b134ea73f9b295c3e9a76fea9676ade</saml2:NameID>
       <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
          <saml2:SubjectConfirmationData Address="134.2.22.86" InResponseTo="_54a47f7b77a7c7deda0fc050f3bea4a2" NotOnOrAfter="2012-02-20T10:06:15.864Z" Recipient="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST"/>
       </saml2:SubjectConfirmation>
    </saml2:Subject>
    <saml2:Conditions NotBefore="2012-02-20T10:01:15.864Z" NotOnOrAfter="2012-02-20T10:06:15.864Z">
       <saml2:AudienceRestriction>
          <saml2:Audience>https://idefix.worldtalk.de/idp/shibboleth</saml2:Audience>
       </saml2:AudienceRestriction>
    </saml2:Conditions>
    <saml2:AuthnStatement AuthnInstant="2012-02-20T10:01:15.844Z" SessionIndex="9472804cbda62fb99c450cd21c02a390416a8655d6b9199cc17c936d28205a3f">
       <saml2:SubjectLocality Address="134.2.22.86"/>
       <saml2:AuthnContext>
          <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
       </saml2:AuthnContext>
    </saml2:AuthnStatement>
</saml2:Assertion>


[... uninteresting ...]

11:01:15.976 - DEBUG [org.opensaml.security.MetadataCredentialResolver:206] - Attempting to retrieve credentials from cache using index: [https://idefix.worldtalk.de/idp/shibboleth,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]
11:01:15.977 - DEBUG [org.opensaml.security.MetadataCredentialResolver:223] - Unable to retrieve credentials from cache using index: [https://idefix.worldtalk.de/idp/shibboleth,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,ENCRYPTION]
11:01:15.977 - DEBUG [org.opensaml.security.MetadataCredentialResolver:243] - Attempting to retrieve credentials from metadata for entity: https://idefix.worldtalk.de/idp/shibboleth
11:01:15.977 - DEBUG [org.opensaml.security.MetadataCredentialResolver:315] - Retrieving metadata for entity 'https://idefix.worldtalk.de/idp/shibboleth' in role '{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor' for protocol 'urn:oasis:names:tc:SAML:2.0:protocol'
11:01:15.977 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] - Checking child metadata provider for entity descriptor with entity ID: https://idefix.worldtalk.de/idp/shibboleth

[.... more log lines about how it tried to fetch encryption credentials ...]

11:01:15.987 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:904] - Could not resolve a key encryption credential for peer entity: https://idefix.worldtalk.de/idp/shibboleth
11:01:15.991 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter
org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:905) ~[shibboleth-identityprovider-2.3.5.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:286) ~[shibboleth-identityprovider-2.3.5.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:283) [shibboleth-identityprovider-2.3.5.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:165) [shibboleth-identityprovider-2.3.5.jar:na]
	at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) [shibboleth-identityprovider-2.3.5.jar:na]
	at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) [shibboleth-common-1.3.4.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.35]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
	at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.5.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
	at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.5.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
	at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.4.jar:na]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.35]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.35]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) [catalina.jar:6.0.35]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.35]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.35]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.35]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.35]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:6.0.35]
	at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote.jar:6.0.35]
	at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) [tomcat-coyote.jar:6.0.35]
	at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:776) [tomcat-coyote.jar:6.0.35]
	at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:705) [tomcat-coyote.jar:6.0.35]
	at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:898) [tomcat-coyote.jar:6.0.35]
	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote.jar:6.0.35]
	at java.lang.Thread.run(Unknown Source) [na:1.6.0_30]


[....]


11:25:40.125 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:287] - No metadata for relying party https://idefix.worldtalk.de/idp, treating party as anonymous
11:25:40.125 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:199] - SAML 2 SSO profile is not configured for relying party https://idefix.worldtalk.de/idp


----


-- 
----------==========#########>>>>>ZDV<<<<<#########==========----------

Dipl.-Inform. Stefan König
Zentrum für Datenverarbeitung
Universität Tübingen
Wächterstraße 76
D-72074 Tübingen

E-Mail: s.koenig at uni-tuebingen.de
Fon: +49 7071 29-70286
Fax: +49 7071 29-5912

----------==========##########>>>>>@<<<<<##########==========----------


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4467 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/users/attachments/20120220/9f6be910/attachment.bin

More information about the users mailing list