SP 2.4.2 connecting to IdP 1.3.1 and missing attributes

[Gordon Capreol]

Hello - I'm asking for some assistance in troubleshooting a connection between our Shibboleth SP Version 2.4.2 and an IdP running version 1.3.1.

Most of the time, login is working as expected, but occassionally, we're missing attributes on return. For example, from our logs:

Bad sign-in (no attributes returned)
2012-03-29 14:18:09 INFO Shibboleth-TRANSACTION [1]: New session (ID: _25xxx) with (applicationId: default) for principal from (IdP: urn:mace:incommon:northwestern.edu) at (ClientAddress: 98.213.53.61) with (NameIdentifier: C3xxx) using (Protocol: urn:oasis:names:tc:SAML:1.1:protocol) from (AssertionID: _a17b2103c1ecbb9ad51b6d8275f10df1)
2012-03-29 14:18:09 INFO Shibboleth-TRANSACTION [1]: Cached the following attributes with session (ID: _25xxx) for (applicationId: default) {
2012-03-29 14:18:09 INFO Shibboleth-TRANSACTION [1]: }

Good sign-in (all attributes returned)
2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: New session (ID: _9fxxx) with (applicationId: default) for principal from (IdP: urn:mace:incommon:northwestern.edu) at (ClientAddress: 98.213.53.61) with (NameIdentifier: EBxxx) using (Protocol: urn:oasis:names:tc:SAML:1.1:protocol) from (AssertionID: _2652ab6540ed07ba5f4fb4327d8ddb97)
2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: Cached the following attributes with session (ID: _9fxxx) for (applicationId: default) {
2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: 	uid (1 values)
2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: 	mail (1 values)
2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: 	eduPersonPrimaryAffiliation (1 values)
2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: 	nuSnapGroups (18 values)
2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: 	nuallschoolaffiliations (48 values)
2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: } 

Nothing changes on the SP or IdP configuration in between good and bad logins. Often we can go weeks without a problem, and then have several days where the login is up and down throughout the day. 

On the SP, I do see these error messages:
2012-03-29 14:06:52 ERROR Shibboleth.Listener [4880] isapi_shib: socket call resulted in error (10054): Unknown error

2012-03-29 14:18:09 ERROR Shibboleth.AttributeResolver.Query [1]: exception during SAML query to https://fed.it.northwestern.edu:8443/shibboleth-idp/AA: CURLSOAPTransport failed while contacting SOAP endpoint (https://fed.it.northwestern.edu:8443/shibboleth-idp/AA): Connection time-out

2012-03-29 14:18:09 ERROR Shibboleth.AttributeResolver.Query [1]: unable to obtain a SAML response from attribute authority

Kind Regards,
Gordon


Gordon Capreol | UNIVERSITYTICKETS | 2640 RT 9W | Cornwall | NY | 12518 | p: 646-355-UTIX (8849) | f: 212-937-2299 | gcapreol at universitytickets.com
For emergency support, please contact 888-771-1420 or support at universitytickets.com


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120329/bca160db/attachment.html