LDAP credential
Bo Lorentsen
bl at moch.dk
Fri Sep 21 06:39:35 EDT 2012
On 2012-09-21 12:31, Peter Schober wrote:
> * Bo Lorentsen<bl at moch.dk> [2012-09-21 11:28]:
>> Hmm, ok ... I am not sure how to approach this problem. If I use my
>> resource https://lue.dk/sso, I end up ok in my idp (it is happy in the
>> log), and I enter my password (tl / dogfood), LDAP is happy but ... the
>> endpoint error (you are welcome to try).
> That produces a proper looking auth request and so wouldn't cause the
> error you posted, which was "No SAMLRequest or SAMLResponse query path
> parameter" (when there clearly is one). Which is what Scott already
> said.
> Any more WARN or ERROR in the log?
For the record, I have added the SP in the relay-party.xml like this :
<metadata:MetadataProvider id="URLMD"
xsi:type="metadata:FileBackedHTTPMetadataProvider"
metadataURL="https://lue.dk/Shibboleth.sso/Metadata"
backingFile="/usr/local/share/idp/metadata/lue-metadata.xml">
</metadata:MetadataProvider>
It is a bit messy ... but this is the process log, from the successful
LDAP auth, on the idP :
12:15:45.401 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:178]
- Successfully authenticated user tl
12:15:45.401 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144]
- Returning control to authentication engine
12:15:45.401 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209]
- Processing incoming request
12:15:45.401 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514]
- Completing user authentication process
12:15:45.401 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585]
- Validating authentication was performed successfully
12:15:45.401 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:696]
- Updating session information for principal tl
12:15:45.401 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:700]
- Creating shibboleth session for principal tl
12:15:45.401 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:806]
- Adding IdP session cookie to HTTP response
12:15:45.402 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:715]
- Recording authentication and service information in Shibboleth session
for principal: tl
12:15:45.402 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:560]
- User tl authenticated with method
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
12:15:45.402 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:161]
- Returning control to profile handler
12:15:45.402 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:177]
- Redirecting user to profile handler at
https://idp.moch.dk:443/idp/profile/SAML2/Redirect/SSO
12:15:45.444 - INFO [Shibboleth-Access:74] -
20120921T101545Z|192.153.174.44|idp.moch.dk:443|/profile/SAML2/Redirect/SSO|
12:15:45.444 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86]
- shibboleth.HandlerManager: Looking up profile handler for request
path: /SAML2/Redirect/SSO
12:15:45.444 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97]
- shibboleth.HandlerManager: Located profile handler of the following
type for the request path:
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
12:15:45.444 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:574] -
Unbinding LoginContext
12:15:45.444 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:600] -
Expiring LoginContext cookie
12:15:45.444 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:611] -
Removed LoginContext, with key 9498b26c-927e-473f-b384-aaf5e6f93051,
from StorageService partition loginContexts
12:15:45.444 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:170]
- Incoming request contains a login context and indicates principal was
authenticated, processing second leg of request
12:15:45.444 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
https://idp.moch.dk/idp/shibboleth
12:15:45.444 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
Searching for entity descriptor with an entity ID of
https://idp.moch.dk/idp/shibboleth
12:15:45.445 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
https://idp.moch.dk/idp/shibboleth
12:15:45.445 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
Searching for entity descriptor with an entity ID of
https://idp.moch.dk/idp/shibboleth
12:15:45.445 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128]
- Looking up relying party configuration for
https://idp.moch.dk/idp/shibboleth
12:15:45.445 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134]
- No custom relying party configuration found for
https://idp.moch.dk/idp/shibboleth, looking up configuration based on
metadata groups.
12:15:45.445 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
https://idp.moch.dk/idp/shibboleth
12:15:45.445 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
Searching for entity descriptor with an entity ID of
https://idp.moch.dk/idp/shibboleth
12:15:45.445 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157]
- No custom or group-based relying party configuration found for
https://idp.moch.dk/idp/shibboleth. Using default relying party
configuration.
12:15:45.445 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
https://idp.moch.dk/idp/shibboleth
12:15:45.445 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
Searching for entity descriptor with an entity ID of
https://idp.moch.dk/idp/shibboleth
12:15:45.446 - DEBUG
[org.opensaml.saml2.binding.AuthnResponseEndpointSelector:47] - Unable
to select endpoint, no entity role metadata available.
12:15:45.446 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429]
- No return endpoint available for relying party
https://idp.moch.dk/idp/shibboleth
12:15:45.446 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:346] -
No login context in storage service
12:15:45.446 - DEBUG
[edu.internet2.middleware.shibboleth.idp.ui.ServiceContactTag:177] - No
relying party, nothing to display
thanks for taking the time to help
/BL
More information about the users
mailing list