Shibboleth SP crashing during signature computation

[Rob Whitener]

Hi Scott,

I believe the version of libxml-security we are using is 15.0.1 :

root at VM:/# find / -name libxml-security*
/var/lib/dpkg/info/libxml-security-c15.postinst
/var/lib/dpkg/info/libxml-security-c15.md5sums
/var/lib/dpkg/info/libxml-security-c15.postrm
/var/lib/dpkg/info/libxml-security-c15.shlibs
/var/lib/dpkg/info/libxml-security-c15.list
/usr/share/doc/libxml-security-c15
/usr/lib/libxml-security-c.so.15
/usr/lib/libxml-security-c.so.15.0.1

The key we are using is 1675 bytes including the begin and end delimitters,
and its RSA.

Also, I am going to try attaching the debugger to try and get a stack
trace, but first I thought I would try out the simple route of turning off
the signing to see if that solves it.  If I remove this element:

<PolicyRule type="XMLSigning" errorFatal="true"/>

from my <Policy> element, is that what turns off the signing?

Thanks,

Rob

On Thu, Jul 12, 2012 at 7:41 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/12/12 5:38 PM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
> >
> >One of the interesting things is this only seems to happen when I don't
> >have a pre-existing session on our partner's system.
>
> The SP doesn't know anything about that session, so I don't see how that
> could matter.
>
> >Right now, to test the connection I go to their website and login.  Then,
> >using a link to their IDP (with our protected resource as a query
> >parameter), the IDP then initiates the SAML connection and I am
> >redirected to my site's page and have a valid session.
>
> Well, there's no request there. That's IdP-initiated SSO.
>
> >  Which indicates to me that the signing works quite well in the happy
> >path.
>
> It's not signing. It's not issuing a request at all.
>
> >  My guess is they are passing me something in the not-as-happy
> > path that our SP doesn't  like.
>
> The crash happens when the SP issues a request, there's nothing from the
> IdP involved in that path.
>
> >  You mentioned a stack trace as another place to look, I haven't seen
> >any stack traces in any of the logs.
>
> A stack trace is from a core dump or a debugger attached to the shibd
> process, not in the log.
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPDebuggingNonWi
> ndows
>
> >  A stack trace is exactly what I would like to see, as well as the
> >response our SP is tripping over.
>
> There is no response, it's tripping over the formulation of a request, and
> all indications are it's in the signature. As I said, one workaround is
> simply to stop signing.
>
> I'd also like to know how big the key is, and the xml-sec version.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120713/b1d9cbcf/attachment.html