Shibboleth SP crashing during signature computation

[Rob Whitener]

One of the interesting things is this only seems to happen when I don't
have a pre-existing session on our partner's system.  Right now, to test
the connection I go to their website and login.  Then, using a link to
their IDP (with our protected resource as a query parameter), the IDP then
initiates the SAML connection and I am redirected to my site's page and
have a valid session.  Which indicates to me that the signing works quite
well in the happy path.  My guess is they are passing me something in the
not-as-happy path that our SP doesn't  like.  You mentioned a stack trace
as another place to look, I haven't seen any stack traces in any of the
logs.  A stack trace is exactly what I would like to see, as well as the
response our SP is tripping over.  I am fairly certain that the issue is
one of configuration.

Thanks,

Rob

On Thu, Jul 12, 2012 at 5:24 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/12/12 3:51 PM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
> >
> >Things were going pretty smoothly with our Shibboleth SP installation and
> >configuration and suddenly today, the shibd process appears to be
> >crashing during the computation of the signature after receiving a
> >response from the IDP (I think).  Here is what
> > I am seeing in the /var/log/shibboleth/shibd.log when it goes down:
>
> Yes, those are some indirect logging messages inside libxml-security. I'd
> have to check that  code, I don't know if there are any messages that
> would show up after that.
>
> If it was working, then something had to have changed of course.
>
> Is there a reason you're signing the requests? Not that it's a good
> answer, but that's not generally of any value, so undoing that might at
> least be a workaround.
>
> >Our partner is using a Tivoly SAML solution.  Beyond syslog and
> >shibd.log, is there another place I can look to help debug this?
>
> A stack trace.
>
> >Has anyone seen this problem before?
>
> Unpatched libxml-security has issues signing or verifying with large RSA
> keys (which we put out a security advisory for).
>
> >  Also, I am using an unsupported version on an unsupported OS:
> >Shibboleth 2.3.1 on Ubuntu
> > 10.04.
>
> If it's crashing there, it has nothing to do with the Shibboleth version.
> If it's not the latest xmlsec code, that probably is the only fix.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120712/e1605151/attachment.html