Shibboleth SP crashing during signature computation

[Cantor, Scott]

On 7/12/12 5:38 PM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
>
>One of the interesting things is this only seems to happen when I don't
>have a pre-existing session on our partner's system.

The SP doesn't know anything about that session, so I don't see how that
could matter.

>Right now, to test the connection I go to their website and login.  Then,
>using a link to their IDP (with our protected resource as a query
>parameter), the IDP then initiates the SAML connection and I am
>redirected to my site's page and have a valid session.

Well, there's no request there. That's IdP-initiated SSO.

>  Which indicates to me that the signing works quite well in the happy
>path.

It's not signing. It's not issuing a request at all.

>  My guess is they are passing me something in the not-as-happy
> path that our SP doesn't  like.

The crash happens when the SP issues a request, there's nothing from the
IdP involved in that path.

>  You mentioned a stack trace as another place to look, I haven't seen
>any stack traces in any of the logs.

A stack trace is from a core dump or a debugger attached to the shibd
process, not in the log.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPDebuggingNonWi
ndows

>  A stack trace is exactly what I would like to see, as well as the
>response our SP is tripping over.

There is no response, it's tripping over the formulation of a request, and
all indications are it's in the signature. As I said, one workaround is
simply to stop signing.

I'd also like to know how big the key is, and the xml-sec version.

-- Scott