Terracotta blip causing IdP hang
Elliot Kendall
elliot.kendall at ucsf.edu
Mon Apr 29 12:05:59 EDT 2013
> > We saw the same thing in a similar environment; our fix was to ditch
> > Terracotta and move to a stateless IdP. :/
>
> Stateless may infact be the way we (are all) headed but in the interm..
> You might gain some time by adjusting your l2 times in tc-config a bit ..
>
...snip...
>
> The above settings seem to ride out most VMware bumps and snapshot
> happenings in our environment. ((I did say most.. not all)) :-)
Thanks, I will try those. I suspect VMware bumps as the likely culprit
in my case, as well.
Just to confirm, by stateless IdP you mean running multiple independent
IdP systems and relying on load balancer session affinity to keep
clients from bouncing around between them, right? That actually
wouldn't be too bad for us since we're not allowed to do rolling
restarts of the cluster anyway for policy reasons.
> Message: 2
> Date: Fri, 26 Apr 2013 18:58:54 +0000
> From: "Qian, Yi" <yqian at ku.edu>
> Subject: Re: eduPersonTargetedID
> To: Shib Users <users at shibboleth.net>
> Message-ID: <CDA0374E.2DDC7%yqian at ku.edu>
> Content-Type: text/plain; charset="us-ascii"
>
> Thanks Etan
> changed to Script got rid of the error
>
> Thanks Scott
> for clearing it, since we are release this to every SP, the Manager
> thinking about the security issues, only uid is encoded, he likes to
> include sp entity id so the eduPersonTargetedID will be truly unique
>
> On 4/26/13 1:28 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
> >On 4/26/13 2:08 PM, "Qian, Yi" <yqian at ku.edu> wrote:
> >>
> >>Our eduPersonTargetedID just follows shibboleth wiki, including 2 parts
> >>idp entity id, sp entity id and encoded uid, separated by !
> >
> >You are mistaken. That is an SP construct, it has nothing to do with your
> >IdP or what it sends. You're sending a NameID element. It's XML, not a
> >string.
> >
> >>
> >>Manager wants the last part to be encoded idp entity id + sp entity id +
> >>uid. I tried to use script attribute definition. But got "Invalid content
> >>was found starting with element 'Script'. One of
> >>'{"urn:mace:shibboleth:2.0:resolver":AttributeEncoder}' is expected."
> >>error
> >
> >Do NOT do this. The choice of how the value looks at the application end
> >is up to the SP and is configured there.
> >
> >-- Scott
> >
> >
> >--
> >To unsubscribe from this list send an email to
> >users-unsubscribe at shibboleth.net
> >
>
>
>
>
> ------------------------------
>
> Message: 3
> Date: Fri, 26 Apr 2013 19:06:22 +0000
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> Subject: Re: eduPersonTargetedID
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> <BA63CEAE152A7742B854C678D9491383750E7177 at CIO-KRC-D1MBX01.osuad.osu.edu>
>
> Content-Type: text/plain; charset="us-ascii"
>
> On 4/26/13 2:58 PM, "Qian, Yi" <yqian at ku.edu> wrote:
> >
> >Thanks Scott
> > for clearing it, since we are release this to every SP, the Manager
> >thinking about the security issues, only uid is encoded, he likes to
> >include sp entity id so the eduPersonTargetedID will be truly unique
>
> If you're using the built-in connector, it already is, you don't have to
> do this to make that happen.
>
> Somebody's confused here. It may be me, but I don't think so.
>
> -- Scott
>
>
>
>
> ------------------------------
>
> Message: 4
> Date: Fri, 26 Apr 2013 12:30:24 -0700 (PDT)
> From: Jim Blankenship <jblank at uw.edu>
> Subject: Using requireSessionWith and Need Path Exclusion
> To: users at shibboleth.net
> Message-ID: <1367004624749-7586460.post at n2.nabble.com>
> Content-Type: text/plain; charset=us-ascii
>
> We have a vendor app which we want to protect with Token auth but has some
> directories which must be unprotected as it breaks internal service stuff.
>
> My problem is that I can get it to do the right thing with Normal login but
> not with our Token login.
>
> Running Shib 2.5.1 on Windows 2012.
>
> Any ideas how to disable auth checking when using requireSessionWith ?
>
>
> An example
>
> Directory structure
>
> /Webapp/Secure
> /Webapp/Secure/Public
> /Webapp/Token
> /Webapp/Token/Public
>
> Browser Tests
>
> - /Webapp/Secure - prompts for normal login - yea
> - /Webapp/Secure/Public - doesn't prompt for login - yea
>
> - /Webapp/Token - prompts for login with Token - yea
> - /Webapp/Token/Public - prompts for login with Token - boo
>
>
>
>
> <RequestMap>
> <Host name="dev.xyz.edu">
> <Path name="Webapp" authType="shibboleth"
> requireSession="false">
> <Path name="Secure" authType="shibboleth"
> requireSession="true">
> <Path name="Public" authType="shibboleth"
> requireSession="false"/>
> </Path>
> <Path name="Token" authType="shibboleth"
> requireSessionWith="Token">
> <Path name="Public" authType="shibboleth"
> requireSession="false"/>
> </Path>
> </Path>
> </Host>
> </RequestMap>
>
>
> <SessionInitiator type="Chaining" Location="/Login"
> isDefault="false" id="Token" forceAuthn="true"
> relayState="cookie"
> entityID="urn:mace:incommon:xyz.edu">
> <SessionInitiator type="SAML2" acsIndex="1"
>
> authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken"
> template="bindingTemplate.html"/>
> </SessionInitiator>
>
> Thanks
>
> Jim Blankenship
>
>
>
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/Using-requireSessionWith-and-Need-Path-Exclusion-tp7586460.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
>
>
> ------------------------------
>
> Message: 5
> Date: Fri, 26 Apr 2013 19:37:18 +0000
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> Subject: Re: Using requireSessionWith and Need Path Exclusion
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> <BA63CEAE152A7742B854C678D9491383750E71E1 at CIO-KRC-D1MBX01.osuad.osu.edu>
>
> Content-Type: text/plain; charset="us-ascii"
>
> On 4/26/13 3:30 PM, "Jim Blankenship" <jblank at uw.edu> wrote:
>
> >Any ideas how to disable auth checking when using requireSessionWith ?
>
> That setting implies requiring a session. It's also generally very
> superflous now so the solution is not to use it. If you need to customize
> behavior, just add settings to the RequestMap directly, and then you can
> set requireSession on or off as needed.
>
> Assuming by "token" you mean you need a requested authn context class,
> just add authnContextClassRef to the map.
>
> If you touch a SessionInitiator at this point, you're probably doing more
> work than needed.
>
> Note that no matter what you do, that's not enough to force use of a
> context class, you still need to check it on the way back in as an
> authorization rule.
>
> -- Scott
>
>
>
>
> ------------------------------
>
> Message: 6
> Date: Fri, 26 Apr 2013 19:40:21 +0000
> From: "Qian, Yi" <yqian at ku.edu>
> Subject: Re: eduPersonTargetedID
> To: Shib Users <users at shibboleth.net>
> Message-ID: <CDA041B6.2DDE6%yqian at ku.edu>
> Content-Type: text/plain; charset="us-ascii"
>
> I know it is already unique because I tested against testshib, the problem
> is my manager like to have encode NameID unique to each SP too, he wants
> the NameID includes idp entity id, sp entity id and uid
>
> On 4/26/13 2:06 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
> >On 4/26/13 2:58 PM, "Qian, Yi" <yqian at ku.edu> wrote:
> >>
> >>Thanks Scott
> >> for clearing it, since we are release this to every SP, the Manager
> >>thinking about the security issues, only uid is encoded, he likes to
> >>include sp entity id so the eduPersonTargetedID will be truly unique
> >
> >If you're using the built-in connector, it already is, you don't have to
> >do this to make that happen.
> >
> >Somebody's confused here. It may be me, but I don't think so.
> >
> >-- Scott
> >
> >
> >--
> >To unsubscribe from this list send an email to
> >users-unsubscribe at shibboleth.net
> >
>
>
>
>
> ------------------------------
>
> Message: 7
> Date: Fri, 26 Apr 2013 19:47:28 +0000
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> Subject: Re: eduPersonTargetedID
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> <BA63CEAE152A7742B854C678D9491383750E7226 at CIO-KRC-D1MBX01.osuad.osu.edu>
>
> Content-Type: text/plain; charset="us-ascii"
>
> On 4/26/13 3:40 PM, "Qian, Yi" <yqian at ku.edu> wrote:
>
> >I know it is already unique because I tested against testshib, the problem
> >is my manager like to have encode NameID unique to each SP too, he wants
> >the NameID includes idp entity id, sp entity id and uid
>
> That is *already* how it works. I don't think I'm making this clear. You
> should absolutely NOT be creating your own string as a NameID that
> includes those bangs or entityIDs. That would be totally unreasonable.
> Depending on where you do it, it's either redundant to the hash, or it
> will bloat the size of your attribute value to a totally crazy size.
>
> The way this looks in SAML is this:
>
> <NameID Format="...persistent" NameQualifier="IdP name"
> SPNameQualifier="SP name">
> value
> </NameID>
>
> You don't handle the inclusion of the entityIDs, that's done for you.
>
> -- Scott
>
>
>
>
> ------------------------------
>
> Message: 8
> Date: Fri, 26 Apr 2013 17:39:17 -0700 (PDT)
> From: Jim Blankenship <jblank at uw.edu>
> Subject: Re: Using requireSessionWith and Need Path Exclusion
> To: users at shibboleth.net
> Message-ID: <1367023157663-7586465.post at n2.nabble.com>
> Content-Type: text/plain; charset=us-ascii
>
> This fixed my problem:
>
> <RequestMap>
> <Host name="dev.xyz.edu">
> <Path name="Webapp" authType="shibboleth" requireSession="false">
> <Path name="Secure" authType="shibboleth" requireSession="true">
> <Path name="Public" authType="shibboleth" requireSession="false"/>
> </Path>
> <Path name="Token" authType="shibboleth" requireSession="true"
> authnContextClassRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken">
> <Path name="Public" authType="shibboleth" requireSession="false"/>
> </Path>
> </Path>
> </Host>
> </RequestMap>
>
> Thanks!
>
> Jim Blankenship
>
>
>
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/Using-requireSessionWith-and-Need-Path-Exclusion-tp7586460p7586465.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
>
>
> ------------------------------
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> End of users Digest, Vol 22, Issue 94
> *************************************
--
Elliot Kendall
IAM Support Engineer - Single Sign On
Information Technology Services
University of California, San Francisco
More information about the users
mailing list