Proxy and ISAPI extension not configured error

[Istvan Gonzales]

I have some new information and hopefully will have access to the machines
soon. It looks like the F1 load balancer is in front of the SP, not the
IdP. Sorry about the wild goose chase. I will look closer at the SP
configuration and try to spot the issue. Will also look into a more verbose
log setting.

Istvan

On Wed, Sep 12, 2012 at 10:00 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 9/12/12 9:20 PM, "Istvan Gonzales" <istvangonzales at gmail.com> wrote:
>
> >I looked closer into my problem with SP not accepting an authn assertion
> >through the proxy. I decrypted the "good" assertion and the "bad"
> >assertion and I see no differences of substance in their content. Each
> >has an AttributeStatement and an AuthnStatement,
> > and only a session ID differs between the two AuthnStatements.
>
> If you're still talking about the same error, the issue has absolutely
> nothing to do with SAML or your assertions. The web server(s) are simply
> not configured correctly and are not processing requests consistently with
> the URLs you intend them to be seeing. The external and internal views
> don't line up and that's not allowed.
>
> That's not at all unusual when a load balancer is involved, and it would
> be difficult or impossible to allow the SP to work for requests both
> through and around the load balancer because the web server can't know
> that that's happening. It has to handle requests based on the virtualized
> settings in use with the load balancer and that won't work for direct
> client access.
>
> >
> >I also learned a tad bit more about the environment. This is an F5 proxy.
> >No DNS is setup yet. But this shouldn't matter as long as there is a host
> >entry on the test machine and if the default configuration uses front
> >channel binding. Does the SP contact
> > the IdP directly?
>
> That depends on the profiles used, but it has nothing to do with the error
> in the subject.
>
> If you want to see how it's processing requests, turn up native.logger and
> see what the RequestMap is seeing. It will be off in some way in the cases
> that don't work.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120925/a0089a05/attachment-0001.html