Adding SAML2 ACS points does not seem to map attributes from SAML2 IDP

[Jayashree Ravi]

Sorry a few more details I forgot to mention:
1. We are an SP and the changes shown below are for the SP.2. We also have not enabled SSL between our  loadbalancer and Apache/Shibboleth  and we do have warning messages in shibd_warn.log 
2012-10-01 15:20:59 WARN Shibboleth.Application :
insecure cookieProps setting, set to "https" for SSL/TLS-only usage

2012-10-01 15:20:59 WARN Shibboleth.Application :
handlerSSL should be enabled for SSL/TLS-enabled web sites

2012-10-01 15:20:59 WARN Shibboleth.PropertySet :
deprecation - remapping property (defaultACSIndex) to (acsIndex)

2012-10-01 15:20:59 WARN Shibboleth.PropertySet :
deprecation - remapping property (defaultACSIndex) to (acsIndex)
We have SSL upto the load balancer(F5)
ThanksJayashree



From: jravi123 at hotmail.com
To: users at shibboleth.net
Subject: Adding SAML2 ACS points does not seem to map attributes from SAML2 IDP
Date: Mon, 1 Oct 2012 19:27:08 +0000




Hello.
We added SAML2 endpoints to support SAML2 IDP's  We do receive the attributes from the IDP in the response which we see in the signature.log file as well. However we do not see any reference to attributes in transaction.log and also we see the following error message in native.log. Not sure if these are related.

shib_handler: invalid acsIndex property, or non-SAML 1.x ACS, using default SAML 1.x ACSshib_handler: socket call (unknown) resulted in error (32): no message
Our shibboleth2.xml file has the following tags added to support SAML2
<SessionInitiator type="Chaining"
Location="/Login"

                id="Login"
relayState="cookie">

           
<SessionInitiator type="Shib1"
defaultACSIndex="1" />

           
<SessionInitiator type="SAML2"
template="bindingTemplate.html"
outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST 

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
defaultACSIndex="2" />

           
</SessionInitiator>

 

           
<md:AssertionConsumerService Location="/SAML/POST"

               
index="3"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" />

 

           
<md:AssertionConsumerService Location="/SAML2/POST"
index="1"

               
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>

We are able to receive attributes from the existing SAML1 customers but we not SAML2 customers.

Any help would be appreciated.
ThanksJayashree

 		 	   		  

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121001/59479540/attachment.html