IdP SSO not working

[Sara Hopkins]

Many thanks Chad, Scott and Russell for your advice on this. Yes, I've 
been wondering what they're using for clustering. Indeed, I suspect the 
answer is "nothing", and I'm sure your diagnosis is correct. I'll feed back.

(By the way, I have access to the logs of an SP that they are using and 
I can see that somehow SAML1 attribute query *is* working. SSO, however, 
certainly isn't).

But I would still like to know how to track this in the IdP logs.
It was obvious enough to me that it couldn't find a session in the cache 
to match the cookie. What I couldn't see was any logging of it creating 
and storing a session, or looking for a session ID in the cache. And I 
still can't.

Perhaps I'm misunderstanding the code here:

https://svn.shibboleth.net/java-shib-idp2/branches/Rel_1_3/src/edu/internet2/middleware/shibboleth/serviceprovider/SessionManager.java

But I would expect to see logs of sessions being created, stored and 
removed if I've got logging set to DEBUG for 
edu.internet2.middleware.shibboleth.common.session.SessionManager - 
however *nothing* is ever logged for that by my test IdP (for which SSO 
and attribute query definitely work).

Cheers,

Sara

On 23/02/2012 19:40, Chad La Joie wrote:
> Yes, just confirming that Scott's interpretation is correct.  I means
> it is getting a cookie but finding no session that matches it.
>
> The cookie name is '_idp_session'.
>
> On Thu, Feb 23, 2012 at 14:29, Cantor, Scott<cantor.2 at osu.edu>  wrote:
>>>
>>> Logging is already set to DEBUG for everything under
>>> edu.internet2.middleware.shibboleth. I can't see anything logged
>>> indicating it is inspecting any cookies. What I am seeing is lots of
>>> lines like this (but with different session ID values):
>>>
>>> 06:05:12.955 - DEBUG
>>> [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:160] -
>>> No session associated with session ID
>>> NzQxNmVkZTJkMjkwNGUxNmFmNTM1OTVjZGY3ZmI1ZGU2MTZmMjdjODRmYTUwY2RjY2FmMDIyZj
>>> FmMjkwMDVkOQ==
>>> - session must have timed out
>>
>> I think that means it's getting a cookie that doesn't correspond to a
>> session in the cache. After the other recent post, I'm led to wonder, how
>> is this IdP clustered? If it's behind a load balancer, you have to cluster
>> it or deploy changes and plugins to avoid clustering it. And if you don't,
>> but have short term stickiness, you get no SSO (and no attribute query
>> support).
>>
>> -- Scott
>>
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
>

-- 
Sara Hopkins
Support Team
UK Access Management Federation for Education and Research
web:    http://www.ukfederation.org.uk/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.