SP Expiring the User Session - Why?
ragadeep
ragadeep99 at hotmail.com
Mon Dec 9 15:39:32 EST 2013
Hello,
Following is our environment
- Shibboleth-SP 2.5
- Apache 2.2
We
have a IdP initiated SSO usecase and are noticing that the user gets
timed out in under 2 mins. We are not sure why the user is getting timed
out so quick. The Shibboleth protects a web application running on a
Tomcat server with an Apache front. The session in the web application
is set to expire in 30 mins. Following are full details
Thanks
Ragadeep
The client has an IdP that is sending the below <samlp:Response> as part of an IdP initiated SSO usecase
************************************************************************************************
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-SFO1sv8l-shUAEsDAmI2IKE-Khg-"
IssueInstant="2013-12-06T15:39:05Z" Version="2.0">
<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://myidp.com/idp
</saml:Issuer>
<dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
<dsig:SignedInfo>
<dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<dsig:Reference URI="#id-SFO1sv8l-shUAEsDAmI2IKE-Khg-">
<dsig:Transforms>
<dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<dsig:DigestValue>+S2+nJTJEEPdDn0UOpqFv22C+ew=</dsig:DigestValue>
</dsig:Reference>
</dsig:SignedInfo>
<dsig:SignatureValue>mKuzwCDOnbCvKLL7uZ7EBqHy1IqQ==</dsig:SignatureValue>
</dsig:Signature>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">ABC12345</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData NotOnOrAfter="2013-12-06T15:54:05Z"
Recipient="https://mysp.com/Shibboleth.sso/SAML2/POST"/>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2013-12-06T15:29:05Z" NotOnOrAfter="2013-12-06T15:54:05Z">
<saml:AudienceRestriction>
<saml:Audience>mysp.com</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2013-12-06T15:39:05Z" SessionIndex="id-Ki0kbaXnRMxusDp0yKc1exLkcQo-">
<saml:AuthnContext>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
<saml:AttributeStatement xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<saml:Attribute Name="MYATTR" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml:AttributeValue xsi:type="xs:string">ABC12345</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>
************************************************************************************************
What
we are noticing is that the SP expires the session after a few minutes
after authenticating the user. I
As
we see in the logs, SP expires the session as below
************************************************************************************************
2013-12-06 15:39:07 DEBUG OpenSAML.MessageDecoder.SAML2 [3]: extracting issuer from SAML 2.0 protocol message
2013-12-06 15:39:07 DEBUG OpenSAML.MessageDecoder.SAML2 [3]: message from (http://myidp.com/idp)
2013-12-06 15:39:07 DEBUG OpenSAML.MessageDecoder.SAML2 [3]: searching metadata for message issuer...
2013-12-06
15:39:07 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [3]: evaluating
message flow policy (replay checking on, expiration 60)
2013-12-06
15:39:07 DEBUG XMLTooling.StorageService [3]: inserted record
(id-3xJwHyzy6Q0tWi8p5gM575-jtNw-) in context (MessageFlow) with
expiration (1386344585)
2013-12-06 15:39:07 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [3]: validating signature profile
2013-12-06 15:39:07 DEBUG XMLTooling.TrustEngine.ExplicitKey [3]: attempting to validate signature with the peer's credentials
2013-12-06 15:39:07 DEBUG XMLTooling.TrustEngine.ExplicitKey [3]: signature validated with credential
2013-12-06 15:39:07 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [3]: signature verified against message issuer
2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: processing message against SAML 2.0 SSO profile
2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: extracting issuer from SAML 2.0 assertion
2013-12-06
15:39:07 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [3]: evaluating
message flow policy (replay checking on, expiration 60)
2013-12-06
15:39:07 DEBUG XMLTooling.StorageService [3]: inserted record
(id-SFO1sv8l-shUAEsDAmI2IKE-Khg-) in context (MessageFlow) with
expiration (1386344585)
2013-12-06 15:39:07 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [3]: validating signature profile
2013-12-06 15:39:07 DEBUG XMLTooling.TrustEngine.ExplicitKey [3]: attempting to validate signature with the peer's credentials
2013-12-06 15:39:07 DEBUG XMLTooling.TrustEngine.ExplicitKey [3]: signature validated with credential
2013-12-06 15:39:07 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [3]: signature verified against message issuer
2013-12-06
15:39:07 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [3]:
assertion satisfied bearer confirmation requirements
2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: SSO profile processing completed successfully
2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: extracting pushed attributes...
2013-12-06
15:39:07 DEBUG Shibboleth.AttributeExtractor.XML [3]: unable to extract
attributes, unknown XML object type: samlp:Response
2013-12-06
15:39:07 DEBUG Shibboleth.AttributeExtractor.XML [3]: skipping unmapped
NameID with format
(urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName)
2013-12-06
15:39:07 DEBUG Shibboleth.AttributeExtractor.XML [3]: unable to extract
attributes, unknown XML object type: saml:AuthnStatement
2013-12-06
15:39:07 DEBUG Shibboleth.AttributeDecoder.String [3]: decoding
SimpleAttribute (MYATTR) from SAML 2 Attribute (MYATTR) with 1 value(s)
2013-12-06 15:39:07 DEBUG Shibboleth.AttributeFilter [3]: filtering 1 attribute(s) from (http://myidp.com/idp)
2013-12-06
15:39:07 DEBUG Shibboleth.AttributeFilter [3]: applying filtering
rule(s) for attribute (MYATTR) from (http://myidp.com/idp)
2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: resolving attributes...
2013-12-06
15:39:07 DEBUG Shibboleth.AttributeResolver.Query [3]: found
AttributeStatement in input to new session, skipping query
2013-12-06 15:39:07 DEBUG Shibboleth.SessionCache [3]: creating new session
2013-12-06 15:39:07 DEBUG Shibboleth.SessionCache [3]: storing new session...
2013-12-06
15:39:07 DEBUG XMLTooling.StorageService [3]: inserted record (session)
in context (_263852c73a50b2e98fcbefcd2716fa62) with expiration
(1386347947)
2013-12-06 15:39:07 DEBUG XMLTooling.StorageService [3]:
inserted record (E01953571) in context (NameID) with expiration
(1386373147)
2013-12-06 15:39:07 DEBUG XMLTooling.StorageService [3]:
inserted record (id-SFO1sv8l-shUAEsDAmI2IKE-Khg-) in context
(_263852c73a50b2e98fcbefcd2716fa62) with expiration (1386347947)
2013-12-06
15:39:07 INFO Shibboleth.SessionCache [3]: new session created: ID
(_263852c73a50b2e98fcbefcd2716fa62) IdP (http://myidp.com/idp)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (123.45.678.90)
2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: ACS returning via redirect to: https://mysp.com/myapp/somepage.html
2013-12-06 15:39:07 DEBUG Shibboleth.Listener [4]: dispatching message (find::StorageService::SessionCache)
2013-12-06
15:39:07 DEBUG XMLTooling.StorageService [4]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386347947)
2013-12-06 15:39:11 DEBUG Shibboleth.Listener [5]: dispatching message (find::StorageService::SessionCache)
2013-12-06
15:39:11 DEBUG XMLTooling.StorageService [5]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386347951)
2013-12-06 15:39:11 DEBUG Shibboleth.Listener [6]: dispatching message (find::StorageService::SessionCache)
2013-12-06
15:39:11 DEBUG XMLTooling.StorageService [6]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386347951)
2013-12-06 15:39:11 DEBUG Shibboleth.Listener [1]: dispatching message (find::StorageService::SessionCache)
...........
...........
...........//OMITTED LOG ENTRIES TO REDUCE EMAIL SIZE
...........
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [1]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:07 DEBUG Shibboleth.Listener [5]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [5]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:07 DEBUG Shibboleth.Listener [7]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [7]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:07 DEBUG Shibboleth.Listener [9]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [9]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:07 DEBUG Shibboleth.Listener [10]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [10]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:07 DEBUG Shibboleth.Listener [2]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [2]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:07 DEBUG Shibboleth.Listener [3]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [3]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:07 DEBUG Shibboleth.Listener [6]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [6]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:07 DEBUG Shibboleth.Listener [8]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [8]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)
2013-12-06 15:40:08 DEBUG Shibboleth.Listener [4]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:08 DEBUG XMLTooling.StorageService [4]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348008)
2013-12-06 15:40:08 DEBUG Shibboleth.Listener [1]: dispatching message (touch::StorageService::SessionCache)
2013-12-06
15:40:08 DEBUG XMLTooling.StorageService [1]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348008)
2013-12-06 15:40:14 DEBUG Shibboleth.Listener [5]: dispatching message (remove::StorageService::SessionCache)
2013-12-06 15:40:14 INFO Shibboleth.SessionCache [5]: removed session (_263852c73a50b2e98fcbefcd2716fa62)
2013-12-06 15:40:14 DEBUG Shibboleth.Listener [5]: dispatching message (default/Login::run::SAML2SI)
2013-12-06
15:40:14 DEBUG XMLTooling.StorageService [5]: inserted record
(feff1c4749418cb0f91a09569b44587e074fb146233459a9014e3227fc533f1f) in
context (RelayState) with expiration (1386345014)
2013-12-06 15:40:14 WARN Shibboleth.SessionInitiator.SAML2 [5]: no credential resolver installed, leaving message unsigned
************************************************************************************************
This is followed by the SP trying to
Following are the Application defaults for the SP in shibboleth2.xml
************************************************************************************************
<ApplicationDefaults entityID="MySPEntityID" REMOTE_USER="eppn persistent-id targeted-id">
<Sessions lifetime="28800" timeout="3600" checkAddress="false"
handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="https" relayState="ss:mem"
exportLocation="http://localhost/Shibboleth.sso/GetAssertion" exportACL="127.0.0.1" >
************************************************************************************************
Currently
the key and cert are out of sync due to some changes and we currently
have following in shibd_warn.log and we are going to be generating a new
key/cert pair.
************************************************************************************************
2013-12-06
15:37:13 CRIT Shibboleth.Application : error building
CredentialResolver: FilesystemCredentialResolver given mismatched
key/certificate, check for consistency.
2013-12-06 15:38:30 WARN Shibboleth.SessionInitiator.SAML2 [1]: no credential resolver installed, leaving message unsigned
2013-12-06 15:40:14 WARN Shibboleth.SessionInitiator.SAML2 [5]: no credential resolver installed, leaving message unsigned
2013-12-06 16:09:17 WARN Shibboleth.SessionInitiator.SAML2 [9]: no credential resolver installed, leaving message unsigned
2013-12-06 16:09:17 WARN Shibboleth.SessionInitiator.SAML2 [2]: no credential resolver installed, leaving message unsigned
************************************************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131209/42e75090/attachment-0001.html
More information about the users
mailing list