session not sticky or something else?

[Nickles, Brent]

Thanks Scott, We are trying the Crypto route with DataSealer but receiving this error below.  
Set up per the wiki:
Principal Connectors:
    <resolver:PrincipalConnector id="shibCryptoTransient" xsi:type="pc:CryptoTransient"
    xmlns:pc="urn:mace:shibboleth:2.0:resolver:pc"
    dataSealerRef="shibboleth.TransientIDDataSealer"
    nameIDFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
    
    <resolver:PrincipalConnector id="saml2CryptoTransient" xsi:type="pc:CryptoTransient"
    xmlns:pc="urn:mace:shibboleth:2.0:resolver:pc"
    dataSealerRef="shibboleth.TransientIDDataSealer"
    nameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>

Resolver:
    <resolver:AttributeDefinition id="cryptoTransientId" xsi:type="ad:CryptoTransientId"
        xmlns:ad="urn:mace:shibboleth:2.0:resolver:ad"
        dataSealerRef="shibboleth.TransientIDDataSealer"
        lifetime="PT3M">
        
        <resolver:AttributeEncoder xsi:type="encoder:SAML1StringNameIdentifier"
        xmlns:encoder="urn:mace:shibboleth:2.0:attribute:encoder"
        nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
        
        <resolver:AttributeEncoder xsi:type="encoder:SAML2StringNameID"
        xmlns:encoder="urn:mace:shibboleth:2.0:attribute:encoder"
        nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
    </resolver:AttributeDefinition>

Filter:
        <afp:AttributeRule attributeID="cryptoTransientId">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

14:38:53.518 - ERROR [edu.internet2.middleware.shibboleth.common.util.DataSealer:379] - Given final block not properly padded
14:38:53.519 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml1.AbstractSAML1ProfileHandler:563] - Error resolving principal name for SAML request from relying party 'https://libraries.umd.edu/pdst-hs/sp'. Cause: Caught exception unwrapping principal identifier.

Any ideas?   Thanks Brent

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, January 07, 2013 11:33 AM
To: Shib Users
Subject: Re: session not sticky or something else?

On 1/7/13 11:13 AM, "Nickles, Brent" <bnick001 at umaryland.edu> wrote:

>We have an IdP that is behind a Cisco Load balancer (two servers)Š.when 
>only one server is up, everything is fine, but when both servers are
>active I get a failure.   If I¹m understanding correctly, the second
>machine (for the SOAP call) doesn¹t know what the transient identifier is
>and fails.   This is only happening against a certain SP, is this a
>configuration issue, can it be resolved at the load balancer with 
>cookies, or is this where Terracotta comes in?

The latter, or you need to switch to the crypto plugins that generate transients using a shared key. Or you push attributes and stop using queries.

You can't use stickiness, there are two different machines involved, the client and the SP.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net