IDP 2.3.6 Stops Sending SAML Responses.

[Montoya,Jose T]

I’m updating the thread name since it applies to all response from the IDP.

The scenario:
The shibboleth IDP starts and runs for a while but eventually stops sending responses. It continues to receive and process incoming requests.

The browser waits for a redirect from the shibboleth IDP after successful login (I have confirmed this using fiddler and IE).
The log shows that the SAML response was successfully encoded and the shibboleth Audit Logger does not show a confirmation of what was sent (using saml1 as a reference).

From my old days, it looks like a blocked thread or socket. The browser will eventually receive the response, especially when I shut down the idp (indicating some sort of resource release).

The issue occurs under heavy load. Last night it ran fine for 12 hours. It was until this morning about 8:00am when usage increases that the symptom shows up.

I did not see this behavior in idp v 2.1.5.
There are no indications of insufficient threads, memory or disk space. I don’t see reaching connection limits as well.
Ideas?


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Zico
Sent: Tuesday, May 01, 2012 7:07 AM
To: Shib Users
Subject: Re: IDP 2.3.6 Stops Sending SAML 1 Responses.

You can use "ALL" / "TRACE" instead of "DEBUG", though your log file will be bigger but it will help you check deep.
On Tue, May 1, 2012 at 4:40 AM, Montoya,Jose T <jtmontoya at mdanderson.org<mailto:jtmontoya at mdanderson.org>> wrote:
This is what I have at this time:
I'm changing the IDP logger to Trace, maybe that gives more detail.
Any other loggers I can add?

<!-- Logs IdP, but not OpenSAML, messages -->
   <logger name="edu.internet2.middleware.shibboleth">
       <level value="DEBUG" />
   </logger>

   <!-- Logs OpenSAML, but not IdP, messages -->
   <logger name="org.opensaml">
       <level value="DEBUG" />
   </logger>

   <!-- Logs LDAP related messages -->
   <logger name="edu.vt.middleware.ldap">
       <level value="INFO"/>
   </logger>

   <!-- Logs inbound and outbound protocols messages at DEBUG level -->
   <logger name="PROTOCOL_MESSAGE">
       <level value="DEBUG" />
   </logger>
   <logger
       name="edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver"
   >
       <level value="DEBUG" />
   </logger>

   <!-- Logs cookie information -->
   <logger name="edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter">
       <level valule="DEBUG" />
   </logger>


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



--
Best,
Zico
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120501/605c4462/attachment-0001.html