Shibboleth SP SSL3_GET_RECORD wrong version number

Coeus[TM] coeus.ph at gmail.com
Wed May 30 05:29:43 BST 2012


Hi,

I am having a problem with an Idp as our shibboleth sp (v2.1) cannot receive any
attributes from this specific provider that results to unsuccessful
authentication.

Our sp is giving this error:

2012-05-22 07:32:36 ERROR Shibboleth.AttributeResolver.Query [10]:
exception during SAML query to
https://idp.test.org:8443/shibboleth-idp/profile/SAML1/SOAP/AttributeQuery:
CURLSOAPTransport failed while contacting SOAP responder:
error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
2012-05-22 07:32:36 ERROR Shibboleth.AttributeResolver.Query [10]:
unable to obtain a SAML response from attribute authority

and on the Idp side:

12:57:00.244 - INFO
[edu.vt.middleware.ldap.jaas.JaasAuthenticator:176] - Authentication
succeeded for dn: cn=xxx,ou=xxxx,ou=xxxxx,ou=xxxxxxx,o=xxxx
12:57:01.306 - INFO [Shibboleth-Access:74] -
20120529T115701Z|82.132.211.243|idp.test.org:443|/profile/Shibboleth/SSO|
12:57:01.367 - INFO [Shibboleth-Audit:711] -
20120529T115701Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||https://sp.test.org/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml1:sso|https://idp.test.org/entity|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_d15179307bf62ded6833ea64d201492c|bc3|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_05ceaa4e5f899db92b083dddb943f9fd|_ebae70afe398e7ab849d2dbb91e17756,|

They said that the Authn Request from log posted above was followed by
nothing which is unusual.

On the other hand, I tried using our test sp (v2.4.3). I encountered
no errors at all
and the authentication was successful.

I suspect that this is a certificate problem.

Our production SP (v2.1):
- OpenSSL 0.9.8b 04 May 2006
- JBoss 4.x.x
- x509 certificate: rsa 1024 bit

Our test SP (v2.4.3):
- OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
- JBoss 5.x.x
- x509 certificate: rsa 2048 bit

Both are running on an Apache http server with the same version.

Thanks in advance for your help.


More information about the users mailing list