Error after succeeded authentication
Gilles Badouet
badouetg at uni.coventry.ac.uk
Tue Jul 9 08:31:32 EDT 2013
Hello Peter,
I am deploying the test in a local network.
Just before your email, I noticed in wiki documentation that it is preferable to use uri="http..." instead of ssl based ( uri="https...") in the metadata provider
element of shibboleth2.xml. I did that and noticed therefore that the sp loaded successfully the IdP metadata. However, I still have the same error message after the authentication.
When I check the sp metadata (some-metadata.xml) loaded by the IdP, I noticed that the endpoint URL in <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location is effectively "http://ans.247lib.com/Shibboleth.sso/SAML2/POST" index="1" instead of what it is supposed to be as stated in the error ( https://ans.247lib.com/Shibboleth.sso/SAML2/POST'). How can I first access and modify the sp metadata. I cant see it when browsing the sp sub-folders.
>That means just that: The IdP cannot find the requested endpoint in
>metadata for this SP. How exactly did you add the SP's metadata to the
>IdP?
Below is the my metadata provider elements within the relying-party.xml to load the sp metadata.
<metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FilesystemMetadataProvider"
metadataFile="C:\IDP\metadata\idp-metadata.xml"
maxRefreshDelay="P1D" />
<metadata:MetadataProvider id="_7be67ad6e799cc5fdf9631f8904e15120bc0400c" xsi:type="metadata:FileBackedHTTPMetadataProvider"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
metadataURL="http://ans.247lib.com/Shibboleth.sso/Metadata"
backingFile="C:\IDP\metadata\some-metadata.xml" />
And to add the IdP metadata to the sp:
<MetadataProvider type="XML" uri="http://amlib.co.uk:8080/idp/profile/Metadata/SAML"
backingFilePath="C:\opt\shibboleth-sp\idp_metadata\amlibmetadata.xml" reloadInterval="7200">
Kind regards
Gilles Rubens Badouet
Student ID: 3940347
Faculty of Engineering and Computing
MSc Network Computing Course
Mobile: 07424486426
________________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of users-request at shibboleth.net <users-request at shibboleth.net>
Sent: 09 July 2013 11:36
To: users at shibboleth.net
Subject: users Digest, Vol 25, Issue 45
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. Re: Shibboleth Login Handler questions [SEC=UNCLASSIFIED]
(Peter Schober)
2. Error after succeeded authentication (Gilles Badouet)
3. Re: Error after succeeded authentication (Peter Schober)
4. Getting Shibboleth Extension not configured error (Tejash Mistry)
5. Re: Getting Shibboleth Extension not configured error
(Peter Schober)
----------------------------------------------------------------------
Message: 1
Date: Tue, 9 Jul 2013 10:52:12 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Shibboleth Login Handler questions [SEC=UNCLASSIFIED]
To: users at shibboleth.net
Message-ID: <20130709085212.GE6686 at aco.net>
Content-Type: text/plain; charset=us-ascii
* BONNY, Michael <Michael.Bonny at fahcsia.gov.au> [2013-07-09 08:38]:
> 1) Can I implement a Kerberos/SPNEGO Login Handler to Single Sign On the users?
> All of the examples I can find are all based around Linux/Apache. I
> thought that this would be easier with IIS on Windows using a domain
> joined server.
https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler
I don't think it matters much which OS the JVM runs on.
> 2) Can I implement an Other-IDP Login Handler, so that users can be
> authenticated by an alternate IDP?
> The end user would get the following experience:
> Navigate to shibsite1.mydomain.com (get redirected to shibidp.mydomain.com)
> Shibidp.mydomain.com would then detect the user was dev-internal,
> and redirect them to another IDP (devshibidp.mydomain.dev)
You could use the RemoteUser Login Handler for that, together with a
Shibboleth SP requiring sessions at a different SAML IdP.
-peter
------------------------------
Message: 2
Date: Tue, 9 Jul 2013 09:40:03 +0000
From: Gilles Badouet <badouetg at uni.coventry.ac.uk>
Subject: Error after succeeded authentication
To: "users at shibboleth.net" <users at shibboleth.net>
Message-ID:
<e0db1994cc4041949e18f315a1a05a17 at DB3PR01MB025.eurprd01.prod.exchangelabs.com>
Content-Type: text/plain; charset="us-ascii"
After a succeeded authentication (according to idp-process.log and ldap logs) through Ldap, I am getting "Error: No peer endpoint available to which to send SAML response" when using google chrome browser, and "opensaml::FatalProfileException at (http://ans.247lib.com/Shibboleth.sso/SAML2/POST): Unable to establish security of incoming assertion" when I use Internet explorer.
An extract of corresponding idp-process.log is as below:
10:04:59.030 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:176] - Authentication succeeded for dn: uid=jean,ou=People,dc=amlib,dc=com
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] - dn = dc=amlib,dc=com
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] - filter = (uid={0})
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] - filterArgs = [jean]
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] - searchControls = javax.naming.directory.SearchControls at 12f2edf
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 1c2a573]
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:223] - Committed the following principals: [jean[]]
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:229] - Committed the following roles: []
10:04:59.061 - INFO [Shibboleth-Access:73] - 20130709T090459Z|192.168.0.2|amlib.co.uk|/profile/SAML2/Redirect/SSO|
10:04:59.061 - WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying party 'https://ans.247lib.com/shibboleth' requested the response to be returned to endpoint with ACS URL 'https://ans.247lib.com/Shibboleth.sso/SAML2/POST' and binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint, with that URL and using a supported binding, can be found in the relying party's metadata
10:04:59.061 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party https://ans.247lib.com/shibboleth
10:21:18.041 - INFO [Shibboleth-Access:73] - 20130709T092118Z|192.168.0.2|amlib.co.uk|/profile/SAML2/Redirect/SSO|
The related error message on shibd.log is:
2013-07-09 09:57:57 ERROR XMLTooling.ParserPool : fatal error on line 0, column 0, message: unable to connect socket for URL 'https://amlib.co.uk/idp/profile/Metadata/SAML'
2013-07-09 09:57:57 ERROR OpenSAML.MetadataProvider.XML : error while loading resource (https://amlib.co.uk/idp/profile/Metadata/SAML): XML error(s) during parsing, check log for specifics
2013-07-09 09:57:57 WARN OpenSAML.MetadataProvider.XML : adjusted reload interval to 1800 seconds
2013-07-09 09:57:57 CRIT OpenSAML.MetadataProvider.XML : maintaining existing configuration, error reloading resource (https://amlib.co.uk/idp/profile/Metadata/SAML): XML error(s) during parsing, check log for specifics
2013-07-09 10:22:11 WARN OpenSAML.MessageDecoder.SAML2 [1]: no metadata found, can't establish identity of issuer (https://amlib.co.uk/idp/shibboleth)
2013-07-09 10:22:11 WARN Shibboleth.SSO.SAML2 [1]: no metadata found, can't establish identity of issuer (https://amlib.co.uk/idp/shibboleth)
2013-07-09 10:22:11 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: Unable to establish security of incoming assertion.
2013-07-09 10:27:34 INFO XMLTooling.StorageService : purged 4 expired record(s) from storage
2013-07-09 10:27:57 INFO OpenSAML.MetadataProvider.XML : reloading remote resource...
2013-07-09 10:27:57 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (https://amlib.co.uk/idp/profile/Metadata/SAML)
2013-07-09 10:27:57 INFO OpenSAML.MetadataProvider.XML : adjusted reload interval to 7200 seconds
Kind regards
Gilles Rubens Badouet
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130709/59caea16/attachment-0001.html
------------------------------
Message: 3
Date: Tue, 9 Jul 2013 11:58:12 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Error after succeeded authentication
To: users at shibboleth.net
Message-ID: <20130709095812.GJ6686 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Gilles Badouet <badouetg at uni.coventry.ac.uk> [2013-07-09 11:41]:
> 10:04:59.061 - WARN
> [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] -
> Relying party 'https://ans.247lib.com/shibboleth' requested the
> response to be returned to endpoint with ACS URL
> 'https://ans.247lib.com/Shibboleth.sso/SAML2/POST' and binding
> 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no
> endpoint, with that URL and using a supported binding, can be found
> in the relying party's metadata
> 10:04:59.061 - ERROR
> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447]
> - No return endpoint available for relying party
> https://ans.247lib.com/shibboleth
That means just that: The IdP cannot find the requested endpoint in
metadata for this SP. How exactly did you add the SP's metadata to the
IdP?
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider
If you don't have a federation that manages IdP and SP metadata for
you it's easiest to add file based metadata to relying-party.xml and
use that for all local (or self-managed) SPs, e.g.
<metadata:MetadataProvider id="localSPs" xsi:type="metadata:FilesystemMetadataProvider"
metadataFile="/opt/shibboleth-idp/metadata/local-sps.xml" maxRefreshDelay="PT15M" />
This will also pick up any changes you make to this file after 15
minutes max.
> The related error message on shibd.log is:
>
>
> 2013-07-09 09:57:57 ERROR XMLTooling.ParserPool : fatal error on line 0, column 0, message: unable to connect socket for URL 'https://amlib.co.uk/idp/profile/Metadata/SAML'
>
> 2013-07-09 09:57:57 ERROR OpenSAML.MetadataProvider.XML : error while loading resource (https://amlib.co.uk/idp/profile/Metadata/SAML): XML error(s) during parsing, check log for specifics
The SP failed to connect to the IdP to grab its metadata from that
URL. In short: Don't do that. Instead transfer the IdP's metadata to
the SP securely once and use file based metadata at the SP, like in
the distributed default configuration:
<MetadataProvider type="XML" file="idp-metadata.xml"/>
Put the IdP's metadata into /etc/shibboleth and name it
"idp-metadata.xml" (or whatever, but then also adjust the file name
above).
-peter
------------------------------
Message: 4
Date: Tue, 9 Jul 2013 03:23:21 -0700
From: "Tejash Mistry" <Tejash.Mistry at fasttrackteam.com>
Subject: Getting Shibboleth Extension not configured error
To: <users at shibboleth.net>
Message-ID: <4b1ddeca$14bf9c61$1490401$@com>
Content-Type: text/plain; charset="us-ascii"
Hello All,
I have configured Shibboleth SP on Windows 2003 server on IIS 6. I have
installed Shibboleth version 2.5.1. When I tried to call Shibboleth I got
below error
"Shibboleth Extension not configured for web site (check ISAPI mappings in
SP configuration)."
Can anyone help me please?
Thanks In advance.
Regards,
Tejash
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130709/ea775121/attachment-0001.html
------------------------------
Message: 5
Date: Tue, 9 Jul 2013 12:35:49 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Getting Shibboleth Extension not configured error
To: users at shibboleth.net
Message-ID: <20130709103549.GK6686 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Tejash Mistry <Tejash.Mistry at fasttrackteam.com> [2013-07-09 12:24]:
> "Shibboleth Extension not configured for web site (check ISAPI mappings in
> SP configuration)."
Check the archives, the same question was asked (and answered) two
weeks ago.
-peter
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 25, Issue 45
*************************************
More information about the users
mailing list