SP randomly failed to validate certificate IDP certicate.

[Ian Young]

On 26 Jun 2012, at 15:35, DE VEGA BARREIRO, Manuel (Manuel) wrote:

I can't help but notice a difference between the two samples:

> Authentication and profile exchange between IDP and SP works fine, but time to time SP client refuse to accept IDP certificate:
>  
> 2012-06-26 12:29:49 DEBUG XMLTooling.SOAPTransport.CURL [91]: sending SOAP message to https://10.122.4.76:7122/coi-idp/AA
> 2012-06-26 12:29:49 DEBUG XMLTooling.libcurl [91]: About to connect() to 10.122.4.76 port 7122
> 2012-06-26 12:29:49 DEBUG XMLTooling.libcurl [91]:   Trying 10.122.4.76...
> 2012-06-26 12:29:49 DEBUG XMLTooling.libcurl [91]: connected

[…]

> I’m sure that certificate are ok, because most of the time SP accept it without any complains:
>  
> 2012-06-26 12:13:28 DEBUG XMLTooling.SOAPTransport.CURL [86]: sending SOAP message to https://10.122.4.76:7122/coi-idp/AA
> 2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]: Connection 0 seems to be dead!
> 2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]: Closing connection #0
> 2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]: About to connect() to 10.122.4.76 port 7122
> 2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]:   Trying 10.122.4.76...
> 2012-06-26 12:13:28 DEBUG XMLTooling.libcurl [86]: connected

So in these two particular cases, the SP was in a different state with respect to having previously communicated with the IdP.  It's conceivable this is related to your problem.  I'd suggest that if you have lots more logs you try looking through them for all occurrences, and see if this difference is consistent between the "good" and "bad" cases.

I'm not saying it will tell us what the problem is, but it might be a clue.

	-- Ian



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120626/bb9064f3/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120626/bb9064f3/attachment-0001.bin