IIS7 with SP-Plugin, authentication infinite loop

Tue Jul 17 04:51:16 EDT 2012

Am 13.07.2012 17:51, schrieb Cantor, Scott:
> On 7/13/12 8:09 AM, "Stefan König" <s.koenig at uni-tuebingen.de> wrote:
> Looping is described in the troubleshooting page in the wiki with some 
> material about it.
In case you refer to 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLooping ... 
I already did, without success.
And I wouldn't bother you, if the wiki would give me more hints... but 
I'm just stuck with it since over a week now.

target: https://idexfix.worldtalk.de:82/RoleManager/
ACS: https://idefix.worldtalk.de:82/Shibboleth.sso/SAML2/POST
redirected to: https://idexfix.worldtalk.de:82/RoleManager/

1st Cookie from pbm12.uni-tuebingen.de (IdP, Name: _idp_authn_lc_key)
   => Login Page
2nd Cookie from pbm12.uni-tuebingen.de (IdP, Name: _idp_session)
3rd Cookie from pbm12.uni-tuebingen.de (IdP, Name: _idp_authn_lc_key)
4th Cookie from idefix.worldtalk.de (SP, Name: 
_shibsession_64656661756c7475726e3a6964656669782e776f726c6474616c6b2e64653a7370)
    => Domain: idefix.worldtalk.de (for target host-name without ":82" 
according to cookie-info-page)

Loop starts:
... and the IdP wants to set a cookie named "_idp_authn_lc_key", SP 
wants to set a Session Cookie as 
("_shibsession_64656661756c7475726e3a6964656669782e776f726c6474616c6b2e64653a7370") 
over and over again.

> At some point I might look, but you have what you need there to diagnose
> it and you know your hostnames and set up better than the list.
I actually have no idea what I should do now to solve it. The Cookie are 
sent, but I don't know weather their names are correct.
Especially the last Cookie named like 
"_shibsession_64656661756c7475726e3a6964656669782e776f726c6474616c6b2e64653a7370"

Logging at the SPs side is more or less set to maximum:
----
# set overall behavior
log4j.rootCategory=INFO, native_log, warn_log

# fairly verbose for DEBUG, so generally leave at INFO
log4j.category.XMLTooling.XMLObject=DEBUG
log4j.category.XMLTooling.KeyInfoResolver=DEBUG
log4j.category.Shibboleth.PropertySet=DEBUG

# raise for low-level tracing of SOAP client HTTP/SSL behavior
log4j.category.XMLTooling.libcurl=INFO

# useful categories to tune independently:
#
# tracing of SAML messages and security policies
log4j.category.OpenSAML.MessageDecoder=DEBUG
log4j.category.OpenSAML.MessageEncoder=DEBUG
log4j.category.OpenSAML.SecurityPolicyRule=DEBUG

# interprocess message remoting
log4j.category.Shibboleth.Listener=DEBUG
# mapping of requests to applicationId
log4j.category.Shibboleth.RequestMapper=DEBUG
# high level session cache operations
log4j.category.Shibboleth.SessionCache=DEBUG
# persistent storage and caching
log4j.category.XMLTooling.StorageService=DEBUG
---

But I don't get any useful information from the logs. I dont think, that 
libcurl-debug information are usefull... everything else is on "DEBUG"

native.log just gives me repeatingly:
--
2012-07-17 10:06:23 DEBUG Shibboleth.Listener [3244] 
isapi_shib_extension: sending message (default/SAML2/POST)
2012-07-17 10:06:23 DEBUG Shibboleth.Listener [3244] 
isapi_shib_extension: send completed, reading response message
2012-07-17 10:06:23 DEBUG Shibboleth.Listener [3244] isapi_shib: sending 
message (default/Login::run::SAML2SI)
2012-07-17 10:06:23 DEBUG Shibboleth.Listener [3244] isapi_shib: send 
completed, reading response message
---

transaction.log gives me for every loop request:
---
2012-07-17 10:06:23 INFO Shibboleth-TRANSACTION [1]: New session (ID: 
_500dba757a58057594eb3073af30c764) with (applicationId: default) for 
principal from (IdP: https://pbm12.uni-tuebingen.de/idp/shibboleth) at 
(ClientAddress: 134.2.22.86) with (NameIdentifier: none) using 
(Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: 
_a199f086b135e310576e49301961b964)
2012-07-17 10:06:23 INFO Shibboleth-TRANSACTION [1]: Cached the 
following attributes with session (ID: 
_500dba757a58057594eb3073af30c764) for (applicationId: default) {
2012-07-17 10:06:23 INFO Shibboleth-TRANSACTION [1]: 
unscoped-affiliation (1 values)
2012-07-17 10:06:23 INFO Shibboleth-TRANSACTION [1]: }
---

shibd.log says something like this:
--
2012-07-17 10:06:23 DEBUG OpenSAML.MessageDecoder.SAML2POST [1]: 
validating input
2012-07-17 10:06:23 DEBUG OpenSAML.MessageDecoder.SAML2POST [1]: decoded 
SAML message:
<?xml version="1.0" encoding="UTF-8"?><saml2p:Response 
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
Destination="https://idefix.worldtalk.de:82/Shibboleth.sso/SAML2/POST" 
ID="_574706c73c6b31bf8bd658f65a57faf4" 
InResponseTo="_7cda3f6ee096f2a2db553abd0560cae5" 
IssueInstant="2012-07-17T08:06:24.039Z" Version="2.0"><saml2:Issuer 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" 
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://pbm12.uni-tuebingen.de/idp/shibboleth</saml2:Issuer><saml2p:Status><saml2p:StatusCode 
Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status><saml2:EncryptedAssertion 
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><xenc:EncryptedData 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" 
Id="_05d1a006d3c8afc29b99b8522642acdd" 
Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod 
Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/><ds:KeyInfo 
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey 
Id="_dc8197226d4d13dc2d26ea79db6725a2" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod 
Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" 
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/></xenc:EncryptionMethod><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIC5TCCAc2gAwIBAgIJAL87kmW0ghlyMA0GCSqGSIb3DQEBBQUAMBUxEzARBgNVBAMTCnUtMDIy
LWMwODYwHhcNMTIwMjE1MTc0MTM5WhcNMjIwMjEyMTc0MTM5WjAVMRMwEQYDVQQDEwp1LTAyMi1j
MDg2MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxNkPc6eIymarYERKhcvE9q4bAXkY
z11Yc5N/U8oqz1yhp3IRDQcgEyW78wR321QPGPfAlg58es3IH/c8crbijgi2NhqnS6d7NTHcsdAQ
R4PeSCC0grip17aNgs0RpDlklacNt1hn2v1HgUDGh5W4TXa7ajYpH1D7DpQzmz+QFc3SDCueshv3
aG1kA0bMPWudLo3Ek2v7LmBK2WhV2coL5BfHYXxk3k1fjb2mKPnmyS7+On+NmjW7Hrd0W937ndym
aEoksyj2b/pVp9zo1X8TgKje319Gqp8nTPszBeSiAejCqyOvCFq87yMzv7rMXqrrfrN1IqQHT0Go
5LnikrsXMwIDAQABozgwNjAVBgNVHREEDjAMggp1LTAyMi1jMDg2MB0GA1UdDgQWBBQJ5+zX87CR
CEkDfOb/k8lnGG6XpTANBgkqhkiG9w0BAQUFAAOCAQEAjwmcHQ1U8a0hdfXqasT8/entwCVnfbFe
XMMhGdlZWtKrJMS+idvf6f6V5b+buAdgjirSLGKA5C59uuaoteB260oU4q93WLKyttDfG8k0ppf8
cZaOC9Vz8PlHVp6GnyepMl374DWKSnDadaON/+emf6OIFrgJ/mM5FboazpilXA6dz7sM9qbi4CF2
UPolNpC/pwHeRwhIXnOMUFgWNuJHzUl4SuaJzmhQVqsJ67mjip436e/Rf4SuRAgUERLPD1PboFwU
ZrsBZGw4TctBOkX/+yrER4JqloMfNArwMYfaYg/prdltzMmIpo3/Dr9yn8o3LJb3QPpln+ahYlmr
WlZ/xg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo><xenc:CipherData 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue>ZOOYZR95ziXeNU/AHszi6/COGpbrLnQmueRG4vxCp/D5GhEb04/p9vNGrgDekaCU+6gJsLVbhtOoXmgwQPdrYeFotxp6qqOO3EBQ9gWq9EFF2qR70P8KC8fJ2Tj7B4hSbwa9RJ3A4HcKrdg/HvWiO2v7PezWhGkcx+FojowmyTjFgwafI09vSMxzIOUUJIPpRG/R+GGHqdh2B9T3YKZBq4DfyCPr6aTSp4Y2vd526yGkQXWMBI2k/IHiJkWdZ3kzh+ima0pMJobuRw1oW+uspeh8IV2PZI14PSprK1kwhUM0Khy9jCU2AmfxeggaRz00de6q3gvEOTRy36ZKQruyjA==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></ds:KeyInfo><xenc:CipherData 
xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue>kVqGIvD8pmMIjmgr/8Sdvx8w5KaWr7XnAsOsLJ/BI8T+G3muBxElkXanMHQnxeSTKZ1dbSam6/H2v1Wl0wDDtCbXboZpdRTv91pEP2EMvvZEo7dInPcGg5Kp6Aeq+p4wbf7pGYVOepetsT6fBRPI00igZVa4snPBWkkIVkGycWmuiCklYFp4AY8z8kitcZBB9GdUIryUP8S5zqtLnc+PhVErJMLWm8ILOl6YKnXo6LC34u397O74eg9O0zwXY2clPEUmEfr+NyC7YroQHhhBrh2wxrXj3jIygAh0fhen/ZsA8cjgQ0vfKR+DY/7MubszLYy6/FufovLMrUk589hXS4YxIifEudGakBePX/YmMIVj4rsOuavmvAh2fpk/oAVVxWJFjALQchcZIum4LZWVFjyajjmAsLQMjBl5//axcBgRWx1SozhmSb1Ijh0wQcLj5BLxL0Q5q/0TwsMWGHqVSatZROBM0IyvAp101U822wcOyhYGURtq2oJ3N1ppQaJqMTm9L0cAQMgE6v9C0DTQ5s3IvF61ivpBFnAdHA1+etzarbOH38ep20/xFweJqDMAfm/g9p0cXITOxgGIX5ylB8qEnwlTJsrITKBjK9+As9AowLY0gGXm5onIi/WFAKE43Ik3wukvPKPartKaB3bFTh5RvQBVpwr9ChXmw5tuBkvutAVEIesNajoqFQXimAhGZ3MuskGbiYkWklQ8P8ovf8r3GpPuoOVwYkNGLHCoKlvax05jcEZiE9YR46kfaJlnPitPDPFtithFM8kcCGjXzGck9OWJAG1jvX22OA6RYzdYnJtD9OlLp3UwOJs74/19paZqL0Hd1STwDgghXNqd4OYfYAKrTCNxfIlV0IrYIkXuy94b+kTTinPWRwuJ+1PgNkFaCif61zILbSOrkYxEnVq7Xpv9eM7UBvHkFRCUrGHqwTh0AuIoPfWIFOHxegGyvjG3H6FjcDCdephvBHPKHfS77QNtOqiR4uiRSaWwUtEeDk+dzAxHWoom4WSZ2gqIURGQmNrbdX8HbGanZAlEElyKq2Oro1iqQSCzeX3f8g3BuACwpGkCKXwSJEg7vYugPCh8neYx3uMGd+ubu89stDiKNy8RVgSEelgX4ACXDr7rLrbPBtw/Y6Ea6W2KNxQWrf46wjbt27qKtX8vur1WACJRSFa8cDmvgF4LQTuISHlK5tB2EjUkg+ggmC2yHWlklUISk9+1Wh1n0aPmUkO+qy8fjeAW7pauCGRr7fy4UUQuarFpjPREygHO7O78Ju28IFd33m9usRN4dbX20bWnYqt2sXqLmZpiqiFguIUumsSlj3Swn5YjJyrU/pjYnsrwqLDM39mMIV3j99yYWffbp7oxfgeuwlyWwvoxK92dVhWsl6ABZPzeY2nutwelmNZmtCsHtGVNSHB37UFlKvfEytAoLp9Bv9gLuA9M1JYIi1m8m0uTHWQm3/vujMGqtjRyY01K6V2Q/LW+pr1GyY/KI75TL8/qTYz2shU+nzbM2Ry+osyhoEnqLp4pXIXVIEtFXfl1PkAZezE8AWE7Qq5Kxnn+qDOQE/F5qH+wNqJdQXm+EwQIbUkMA7ykMchlIou1wfqHjBPMr1Xy8sM1oapVQ39347gRuynajZCT4AG2ysomdbHpTQhPjXbC/yhGvP9aNYUsQxzTQedpfnAt8mb3cJZ31nwUeJSwb03bmlmXiJdmLrVLqJAdALZN7nrr0T/Ok7AU0c990CN1nFMEH3oVDHC/CDu01gI2AmfgkTDNFcv4ID2SHGw5OglsrnK2usAaYlWUYleKyAEh6Xs1JRfqwHl0b6lZztLNcFyx09VQi4WFOGr/a0BR4X6UTL0bOAW8AbLKsxsl2lNtulhLq2g3vnMsfii4SJIQlPDSqEAICGDWTDjIa3Lweq+T+bIJx8wP3bCXEEyVb6nUK9NTk2qQjvkD23i/zVQQyri/3x9aFsiiAaM48+K9uEKAogcgGkk6acacFu0GAteV+0yYDhFTimipJ7DhydmeKLGfeH7nueGmlqOYiHbq8zQMsN1HguCvQBxJy02ciKW6GxpwdlrDTObIkubKKU1CbsBcNW/9JCW5tjd9jr6cDh7EfMwYDa9FICVxjOjh/972MS4pyfqk85SwICLc/ZWrvLq1Wm7q5JlMgXydPWDZc0ilEKMJD+IjnQLXTs8AgLi292OeS7alh8wWjwAr3QTm3GtzUEk9S/yHko9ht20tcTkQUqXtL8eTP4ZoPGYnEzsaVcNITlPmoAfwLm47rQUjNRgPUEQiaJDgWm6ZB4glbiIBamG9agxvhary89P9SduVZNwfTJ/fzVKyJyl9kVT+5CbRQj4H03nAPdjWZFzACMJd/+Bq/p83zs9t66JVZHkta5A/SnjKQ1p6Ssu8DZtxEuPn6Gpe92sZBCgLU8mMjcww9zuFRPpMkmf7bIJ7ReAt0pt5xkPIXJjFQplNytx60cKes9RMXRLxoWACaTWsSuD4oFRG/uE5it6802rRSStxsoQ28NGo4oWqzkCNdT30JErZHzhE+jsnZKdGMlSMFm1cM6iEHTqktnqrsCrD6IgjuYmX1hrnvfsMwVHy7laUm9talzO9RNwJ5+ltun/IzuveUHMQGmPP8ifqouHpizL9Fve5Jr3OwlGHpprvSZpkKDw83Y1VB+kLf7cbgtVJ3yDUPIfm3BQlGAejAZd8jZ7Kw4MyZ5j9kNZkYnCdMwau0a7/KoldmQFhHkiRyZwjyEWzbjWCZlNkPyM+ltsSE8N/qz52ssu01v82UybxxE8Y1ojnj++wvGizQb6vYVG/Tjqbmz2Bs3PzHyHtp35XYaXsp9f39sMD4ZaToI3kDwT/+RckzypfobPyIhCbmfI/TbvnlYarqUAZ9cdz84hOcnkSKBNZUSF9648aHTGwQ3Kd19NsKsd6DkSXiHx+YrFXM9wX7cZNdxp7F15cSsPI6ExuCScl1Me94qGKJCzuNC5VoIKDXZHL29SvvNsBwYi/xAzEkLAtIB+2KC5XxsiMI39H4+d3LnebDpeLkApz/cypZd1sXN/vjUEb39kubAGaNszdnV4qTZ7PZk29PLJT5JM9dp5W6tiqciWhGMJ1FAt3OkcJ/0Jvx9Ezutc+K3eaOpQ41AaCeqw4RvjCLU8aPpBGO0ICHieG0xEPsSa8tlU7hVe/05evAsVidBWMugIqkDGdaV9Acgmu0MK33GAWZBME1uojel7/FVKkVf4SRZiNRa0sPmJnY+HtiWUiy9skubB1qJlHscbgcMpDb6zOeduGdK49dav63ZRkhrYFQiw4UFzOUwHDzxfSJt6CYArWa4FLWLgScLP5+ROQHYyyhTl8M7RLdGdZM4To7Kqd3EU5UPXqmHpgQVpA0MtTav5pU/EAd78nYswkmgVedLjbg0QtwCJKxhCGnrsf1H8euhUeT3vdJ4kaRM+kxtuuu6snlYvECZWwtUMpTI9vsx4iyt7h5GBI4DVRUy/E5e5UMAVV0BYtk6MMUskk/Zii/VtdHB48esbkW/O6pUXWeXzg2CvgjKa6CKy1fsRTn2lCaAiA2eY02bO/HqFwuMLrx3PvsXAg3GtXapxGUUf+fj5Vbk1d0EynCQf6PVNG3JZb63ad00HXuTDn1hSXtYK+on0AC9SNU2D4CmMFxSe7E3sFe0EwxgO7tkDp3khyPMz9kUUjDFb1FWGoGWIw3yEw89gkVwGYZH4Blw8vXcqybJH702YQ20SuSXApISvEHlW1KLj2A1Ay1rr/6z0sw8zZwOUfivOukwuhIYXVA6JB3etmenmLr60j4WH6CoeBKGAswoho1e96H7MTXyOI+rz+qXUJfbWMu4g+ENsg6fzQu955NDHY9A2XzAkQv48v0sx+3euuY1rapgwOuVjf7NyTE0CGyXq6i5U/lhbJqMROqP/UZUgW3QY6toUf7BVFPCAbPk7zUUvLbTnATZwJk8F8SEDzD7oSjaSdpnXUrYdr3L1PikgrJv9iPbH2mxFIGco5Q0VlPXHUlsOiZkEhC43CKMLOActNSief5psTOcoxoDxdsvJVbADHZ/0uHGpmKCLOIUi7k/n4YAmteEYQOpMZQIQIV2dEVIp+DzRxWCAfSQDtSjnDCnCEUBe+gHKwhU0eT0QVUhkMwlra88/c1j5zJppQp4bFlVYXgPwIscfJZxwoK1FPMd+9hxdAYQBXFHKFQyukcvBr27vPTvr4PqZ+EpPnSDzDCoV40b1V8XAloJnnGnxQQXj9NMaPmvEmTVGowbaysEEWE3jafFktW++E5Roe/7FC4wFD72bL8VwObycCHX6f3OhRe2g4ds19f2YLXaI960o3PQHmK5mHu4Wdxf50I1W1j+ZrQPPstxQtvkEi598HDCJNnHPgp9IDGaJw5bzRkX0iFKtxyG9s7b3wCDRpXM0Hi+hwsT8YjIne+1QeeAF8f6RX2kkRmmyec6GV6YgG6biNW42kfEmqpB5jwpQL3+0c8sOQxMbEE/JtKhXyk8YGZELlm7tETIcy7vlmbrdlUOSyxbPGtFZVtvVOoc8fSg7KKQQz2F3WvtwBEDOlvzlGczjvEh3BoUOtchrqo4xc8PIEVUMTCbPM0oOA98aDzqu7DxoxaX/+Ji2ejinx0HCMJQbM/ysbbAf+k8rB5LOOTJhTytxbj8dgrCbjvdigt2Hoht709iAX/fwJGg391cUPuHi9tGnDu5m7mh0xBoDL2/WCLfDlkdNewZ5xJ7zBGIrbxqO6PztEuS3PSQatjegacBa9AZbPzz20vqOmdTxsoY1qZyWV7GnuFdeEwfltLCgTPzUK3ZMUjllwgbBwvT73tU0aMsTTz5D9dysbP+0yL+/BzWjrrKU4DtW4p7xjanAynm/vk4q9nnIKD7DWOd6FF4gjLI+DZpfDsztDMkUbsMlofLwIeLitlcMMcojB2HUzYum6WKAShgcPrreQHV+D3rBR67GZyXUC600gKKli2sC/F0xRxLQCFmlKJUofd61ocryT/xkfoSG1Pp7f+plzYEMbIqKNQCKWmrOiFmDordlTUV3eSGipeOSWJCNsvukARx1oqCXUcoULYBn4J27cPC/tiuoyrUNPGjCuS/fB62jHlO1fuph0eP8DgiQS8OMvfI+vfwLhNNoKaXdrMlJiPxIP+LjYKIIljOQJwoTLtRcTkBa0ds0vOXB1Y41ml0GPjb2FUmnaoTAy7l5YIU6O8v9K0CW3p+SpKd6xfi9iXBt2LGlXls0JlBo9jd6s9GP3nlC1Tp1G6WOzd/Q2x42r0EnRvcAYcPObXhBhTLU0LMMbuO6QUreJoMaILGkeJx3c3ByVvNFMTFWQ//gFcyduCtR6MWxZ+KVSbC7QFTXeTkajuFdai5cd9J5pmQcYcYKloj0M4lkfNMnQ4Xnu3JLdrELzDiLqhelXfs2qK7yCkh7lLo8vHf/JbfJXr6tC5Ur+AGIqyrSnHZwd97+SN+gdg3gDOotptDgXT2sf3yiVGbFwVvFG9FUz+iiqlRbOS3R5NcCXGS2DPyf3b1ABfn5OHxM2fYNquAivEzJyA0WP5EZIHZt7tjaI/hiUyNVEJhG/ales5Ct2PfMCfpg76C+TtyfjRXTyHALEangm7iVjuHZ96k6U2QkzIkUpchEFkTWyvUZPhSSeaYLTTbMoWspfXWVCLYiNb8vAenYMLougLWr5HuXff4flHRQqi78FqSYN/QjIIfe8IRa3n63BWm5QRLnu9kwJb0KvbOTBVeKmU7nDTT+ma4Np+O7nmtrxQ7IsgyvPZt/UI8XAvzkTIF6fMy7e4RtR/vKMl9EZ8HNwO2Si5jEFx9hsK8nLJagQSHWN9HYp8EKs34AmxV9RJovIw5foUM729QgNyEm9lRc9DGdgLq33J8kxCQoa8cSC5Is0RyT0XsFgZ7xlx0/AeyvcuReaUjWTkGLA0cd2lfK1Wov4k+guxI4t+SKfcWasjlrQs+D+rsu50UMNlm9GxRlhNqkHDeMRMQq6LRZXWQmBIugxqQShyFYcRb9OiCc2HD4ifZvHnqpofqpso9owgPKEAdbzxKAm8CV+4+4QJ68BpT5AUiAr7GFaXXZINJzDM7gVwyfBkzX/KkWJ2r6CZcvbGbiskXDQUuwHN1aAHxZGSMrxy0/fc0uee2y+e1xCQXQTJIeiY/h+51+TzrajYOcdGz9d2LPbg+bR6BKPHej2edYwSfP/EIPPKtQ3COhufR8e5slGWbymbQZGU2CJix2HNIuVJoxpbFUaKaknHe5DwUZ16+9ahdkjr9g+MpAh5b3j6ivtPvd/fJDuh/1W+lFE4fKDat/eI52x4/EV2JGF3QuC1IV+6KPSXfOK9WzBGI4uixAK09qudOctVT1DP5pPF4E/LR5ktpD24u0mRcsFcPz/GeGtfWuSCoacOCFp0ycKf+jQMGWFaUmyjfHiFYwkcl36qM//+QvJ1LVMiXXKtVQ/U9jALLnnDxkVM+C4FA9KeHunOAe/313S0qhJ2DCFbh+egMmPk60BICgMnJKwpFZs8NxgKC7KhZ4dCqWghOxiaX7BqfyUwNiNBXZQHE0KBpYvzKCBd77MqeoFsgWYVXLzfvEog06lWc3AekzMC20UuiTg/Zl4goBuvzk6pK8KnE01+xf0RropIh3vWANRtAqLQyKQGPSlF+49iHhDGQgRL4g+XBrgdmrgpEGPkJZDm/T3yHU3LimdWF2/JMLfMhjlngfJAUHSr0CtxD63bU6dY5uD/3WsFsNO0l+dIESZ6kwwsGNUKtuS/WZ9haj0+KorHQcKukXTZQn3VDpLwHgvUwzd7UQGt4W4FwfF18vL3mHctDtE5qP+ERPqURCwlI8Uj9qW0CwUdNx18507xg0AvXASjVuMLR/qwmDN5FexO/+PM2F15Q30k13aAdVsR68ViS+drcQIRM76fcFGLs0pDQX4xJrdBU4A7m3fBkBrFIiPL/ukAIKuh0eZm1shZqk8/8YXUh06NtV45KLvnBR8CEZXuah6ReyzX5Vv61oEutARrvwm1upS3FRtEYBrsgmVHSVTrdXJ9ARQ8qFQ8qPWmkwQUKBIbgxlPs/KerhWPjq5T9GV0Yx1y+08XLiw8TYZ76BNU5kp4spZqgXTrEtz9+i+JelWCeZL/bm3kh5EOBcoVS6vEH6olam/CtP7cIXJOdSQLCQG8sOw/0/1yzC1ixWLFNKz9sn8mrYkXqgLjmWc0CEWXGIB6uZUKRwlL7xBBAlDrlKlXJNytqG8qArHtalg3dCrRkq/OhMKYmcd7z4j7gVIkKxzEMsL1Wnl5svEdLoZbeRHBhIynKzAF2WJIDPUUou+lH2t+mD20Jb/PrNhi3gTjBgd/WcoozKE/yDBwjgl9XJou4CekBfaZIo6C2K2PaUFlMil10EJEuLseofKkCLRysp+Klk4Gob+Xxz7MCbnjEOKcPTtQ2oVmMYfu46c1wl76/bjEyACkMG7N7ztvzEzyl5X3Lc67InJIXOpZwhSXCGt+DRcU/bLrCcu7R/a3gazidfUsmaGmKcgfExa+lrJqUs0XOxekxqTdkRjGRqEbtd3DvYZGnyaMQahuI9I4wl1LwrgXC0XidPe3aEZxHwJUuZaslATakkiBBXByKWfEcwx33wUGdIiKNCZ8eOJ7V4356e1PQAxWYv9X/3R9rywjaMgbb+P4vRzm+fpjxYctmaI2IWGCkODIPrivygHESgvy874xRUVPXaEvsfBDrK54HMNDF9/Y4co04m81TRRvPDOkGSun7kKDxx9yIb+o3BN8BE7UCB97z0q2f6ZPIWGIkHlGbN4CoSv1Ze+Jk+eQwNpi98cgk3SvZLQNCs4X52Z93dq6HW2Nw5tFU5u9cmUOiImZgluXAadTtGo8bY729plpm9XtW/UMfDaPNkTySQp7jMmRWfL6vOPKGuXwHovUrlCI01lF65GVBooHQB8uJlJzH0aDYZJDyb43MZ1tDCeBhZoZ82INbKr1F0vbILfunusBJ7E/1RJIube6wag9khK1sG3gzm06MLR2Q5ZqaT+NQ362JX+C8DjFJlN4EW7Xi3ENm5tjxCrhciFrvDiqIA84agBuoFXFqEJWtVM6giKftwZW82+MR+1IQfriefEXirqdhJ3rBnnFt2j9rlu8bAnqSautmp7EPwyRWIw1MPZL5IobQ/zvc+GINxw25zVYXu7IZTZ/7EJ6XmIMUhqFPdb4ELykcDQyJozZOQWpSUxy9GK+Wq5tNX0+WDkF5QZYxceFKm+NkPfkhNJP+lR13TROGi/YJebNc6Gx7PFgRn+gSUq1yaiWsHksLW0BCO1fgEcIvyp0MUJcP4OD/UrPoJLnLuglXzRNjkqjzMZmTOtbvtxVBLI11nyrnHKfgTa5/nf4WaVqeVnzYhz3FEOE+zlkldezsOEsJo2pl+ARp85a4F2j20I5sphSzR8JCv+X4HNogykm2I8hHbWhjDNdvhaB66R4HKe3WCvEKvy/D0OPLIoM3AEQtuuaJCVkce7zux4Q/3OTePfUtpbkbHcNm5JKRcVYOKzcACUNfZ3JnjaJCmEy/RP2GZreUMHaFbANb+MUCnPq6AC7gFgV9jyqlnl9enBrI5I2E38Q3VGjkkgnd5mq4K8DqQp6+i6vAEFgFkqlY1Fd0A+KXnEYl8w4PA=</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData></saml2:EncryptedAssertion></saml2p:Response>
2012-07-17 10:06:23 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: extracting 
issuer from SAML 2.0 protocol message
2012-07-17 10:06:23 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: message 
from (https://pbm12.uni-tuebingen.de/idp/shibboleth)
2012-07-17 10:06:23 DEBUG OpenSAML.MessageDecoder.SAML2 [1]: searching 
metadata for message issuer...
2012-07-17 10:06:23 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: 
evaluating message flow policy (replay checking on, expiration 60)
2012-07-17 10:06:23 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [1]: 
evaluating message flow policy (replay checking on, expiration 60)
2012-07-17 10:06:23 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: 
validating signature profile
2012-07-17 10:06:23 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [1]: 
signature verified against message issuer
2012-07-17 10:06:23 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation 
[1]: assertion satisfied bearer confirmation requirements
2012-07-17 10:06:23 INFO Shibboleth.AttributeExtractor.XML [1]: skipping 
unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.42
2012-07-17 10:06:23 INFO Shibboleth.AttributeExtractor.XML [1]: skipping 
unmapped SAML 2.0 Attribute with Name: bwScopedUsername
2012-07-17 10:06:23 INFO Shibboleth.AttributeExtractor.XML [1]: skipping 
unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.4
2012-07-17 10:06:23 INFO Shibboleth.AttributeExtractor.XML [1]: skipping 
unmapped SAML 2.0 Attribute with Name: urn:oid:0.9.2342.19200300.100.1.3
2012-07-17 10:06:23 INFO Shibboleth.AttributeExtractor.XML [1]: skipping 
unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.10
2012-07-17 10:06:23 INFO Shibboleth.SessionCache [1]: new session 
created: ID (_500dba757a58057594eb3073af30c764) IdP 
(https://pbm12.uni-tuebingen.de/idp/shibboleth) 
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (134.2.22.86)
2012-07-17 10:06:23 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: 
validating input
2012-07-17 10:06:23 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: 
marshalling, deflating, base64-encoding the message
2012-07-17 10:06:23 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: 
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://idefix.worldtalk.de:82/Shibboleth.sso/SAML2/POST" 
Destination="https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO" 
ID="_f2475c39a471c76d6e4495e7906ff26c" 
IssueInstant="2012-07-17T08:06:23Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Version="2.0"><saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:idefix.worldtalk.de:sp</saml:Issuer><samlp:NameIDPolicy 
AllowCreate="1"/></samlp:AuthnRequest>
2012-07-17 10:06:23 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: 
message encoded, sending redirect to client
-- CUT HERE --

Everthing looks fine. I can't see any warnings... or even errors. Seems 
as if a session is created...

Should be still fine that way... right?
Execept for the missing port ":82" for the 4th cookie; which I think is 
just a simplification of the output.
But OKAY... I reconfigured the resource to the standard-https-port 
(443). Without changing the result. Still runs in a loop...

Any ideas what to try next?

-- 
----------==========#########>>>>>ZDV<<<<<#########==========----------

Dipl.-Inform. Stefan König
Zentrum für Datenverarbeitung
Universität Tübingen
Wächterstraße 76
D-72074 Tübingen

E-Mail: s.koenig at uni-tuebingen.de
Fon: +49 7071 29-70286
Fax: +49 7071 29-5912

----------==========##########>>>>>@<<<<<##########==========----------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4480 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/users/attachments/20120717/ebe17467/attachment-0001.bin 