Error after succeeded authentication
Gilles Badouet
badouetg at uni.coventry.ac.uk
Tue Jul 9 10:58:17 EDT 2013
Hi Peter,
I did the configuration as you recommended. There is no more error in idp-process.log after restarting and authentication. When I restart the shibd daemon, sp logs also show that the Idp metadata has been loaded successfully.
But when I try to log in (after authentication), i have "Unable to establish security of incoming assertion" in the browser and the shidb or shibd_warn log looks like the idp metadata is no longer available or loadable. The related log lines in shibd.log after a log in attempt are:
2013-07-09 15:48:52 WARN OpenSAML.MessageDecoder.SAML2 [2]: no metadata found, can't establish identity of issuer (https://amlib.co.uk/idp:8443/shibboleth)
2013-07-09 15:48:52 WARN Shibboleth.SSO.SAML2 [2]: no metadata found, can't establish identity of issuer (https://amlib.co.uk/idp:8443/shibboleth)
2013-07-09 15:48:52 WARN Shibboleth.SSO.SAML2 [2]: detected a problem with assertion: Unable to establish security of incoming assertion.
I would also like to let you know that I am not doing the deployment in a single machine. The SP and IdP are in different physical servers.
Kind regards
Gilles Rubens Badouet
Student ID: 3940347
Faculty of Engineering and Computing
MSc Network Computing Course
Mobile: 07424486426
________________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of users-request at shibboleth.net <users-request at shibboleth.net>
Sent: 09 July 2013 13:47
To: users at shibboleth.net
Subject: users Digest, Vol 25, Issue 47
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. Re: Error after succeeded authentication (Gilles Badouet)
2. Re: NoClassDefFoundError: org/w3c/dom/ElementTraversal
(Mustapha Aoussar)
3. Re: Error after succeeded authentication (Peter Schober)
----------------------------------------------------------------------
Message: 1
Date: Tue, 9 Jul 2013 12:31:32 +0000
From: Gilles Badouet <badouetg at uni.coventry.ac.uk>
Subject: Re: Error after succeeded authentication
To: "users at shibboleth.net" <users at shibboleth.net>
Message-ID:
<4eedd45edc5c4bbfa72108099cca3535 at DB3PR01MB025.eurprd01.prod.exchangelabs.com>
Content-Type: text/plain; charset="us-ascii"
Hello Peter,
I am deploying the test in a local network.
Just before your email, I noticed in wiki documentation that it is preferable to use uri="http..." instead of ssl based ( uri="https...") in the metadata provider
element of shibboleth2.xml. I did that and noticed therefore that the sp loaded successfully the IdP metadata. However, I still have the same error message after the authentication.
When I check the sp metadata (some-metadata.xml) loaded by the IdP, I noticed that the endpoint URL in <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location is effectively "http://ans.247lib.com/Shibboleth.sso/SAML2/POST" index="1" instead of what it is supposed to be as stated in the error ( https://ans.247lib.com/Shibboleth.sso/SAML2/POST'). How can I first access and modify the sp metadata. I cant see it when browsing the sp sub-folders.
>That means just that: The IdP cannot find the requested endpoint in
>metadata for this SP. How exactly did you add the SP's metadata to the
>IdP?
Below is the my metadata provider elements within the relying-party.xml to load the sp metadata.
<metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FilesystemMetadataProvider"
metadataFile="C:\IDP\metadata\idp-metadata.xml"
maxRefreshDelay="P1D" />
<metadata:MetadataProvider id="_7be67ad6e799cc5fdf9631f8904e15120bc0400c" xsi:type="metadata:FileBackedHTTPMetadataProvider"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
metadataURL="http://ans.247lib.com/Shibboleth.sso/Metadata"
backingFile="C:\IDP\metadata\some-metadata.xml" />
And to add the IdP metadata to the sp:
<MetadataProvider type="XML" uri="http://amlib.co.uk:8080/idp/profile/Metadata/SAML"
backingFilePath="C:\opt\shibboleth-sp\idp_metadata\amlibmetadata.xml" reloadInterval="7200">
Kind regards
Gilles Rubens Badouet
Student ID: 3940347
Faculty of Engineering and Computing
MSc Network Computing Course
Mobile: 07424486426
________________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of users-request at shibboleth.net <users-request at shibboleth.net>
Sent: 09 July 2013 11:36
To: users at shibboleth.net
Subject: users Digest, Vol 25, Issue 45
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. Re: Shibboleth Login Handler questions [SEC=UNCLASSIFIED]
(Peter Schober)
2. Error after succeeded authentication (Gilles Badouet)
3. Re: Error after succeeded authentication (Peter Schober)
4. Getting Shibboleth Extension not configured error (Tejash Mistry)
5. Re: Getting Shibboleth Extension not configured error
(Peter Schober)
----------------------------------------------------------------------
Message: 1
Date: Tue, 9 Jul 2013 10:52:12 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Shibboleth Login Handler questions [SEC=UNCLASSIFIED]
To: users at shibboleth.net
Message-ID: <20130709085212.GE6686 at aco.net>
Content-Type: text/plain; charset=us-ascii
* BONNY, Michael <Michael.Bonny at fahcsia.gov.au> [2013-07-09 08:38]:
> 1) Can I implement a Kerberos/SPNEGO Login Handler to Single Sign On the users?
> All of the examples I can find are all based around Linux/Apache. I
> thought that this would be easier with IIS on Windows using a domain
> joined server.
https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler
I don't think it matters much which OS the JVM runs on.
> 2) Can I implement an Other-IDP Login Handler, so that users can be
> authenticated by an alternate IDP?
> The end user would get the following experience:
> Navigate to shibsite1.mydomain.com (get redirected to shibidp.mydomain.com)
> Shibidp.mydomain.com would then detect the user was dev-internal,
> and redirect them to another IDP (devshibidp.mydomain.dev)
You could use the RemoteUser Login Handler for that, together with a
Shibboleth SP requiring sessions at a different SAML IdP.
-peter
------------------------------
Message: 2
Date: Tue, 9 Jul 2013 09:40:03 +0000
From: Gilles Badouet <badouetg at uni.coventry.ac.uk>
Subject: Error after succeeded authentication
To: "users at shibboleth.net" <users at shibboleth.net>
Message-ID:
<e0db1994cc4041949e18f315a1a05a17 at DB3PR01MB025.eurprd01.prod.exchangelabs.com>
Content-Type: text/plain; charset="us-ascii"
After a succeeded authentication (according to idp-process.log and ldap logs) through Ldap, I am getting "Error: No peer endpoint available to which to send SAML response" when using google chrome browser, and "opensaml::FatalProfileException at (http://ans.247lib.com/Shibboleth.sso/SAML2/POST): Unable to establish security of incoming assertion" when I use Internet explorer.
An extract of corresponding idp-process.log is as below:
10:04:59.030 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:176] - Authentication succeeded for dn: uid=jean,ou=People,dc=amlib,dc=com
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] - dn = dc=amlib,dc=com
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] - filter = (uid={0})
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] - filterArgs = [jean]
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] - searchControls = javax.naming.directory.SearchControls at 12f2edf
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 1c2a573]
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:223] - Committed the following principals: [jean[]]
10:04:59.046 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:229] - Committed the following roles: []
10:04:59.061 - INFO [Shibboleth-Access:73] - 20130709T090459Z|192.168.0.2|amlib.co.uk|/profile/SAML2/Redirect/SSO|
10:04:59.061 - WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying party 'https://ans.247lib.com/shibboleth' requested the response to be returned to endpoint with ACS URL 'https://ans.247lib.com/Shibboleth.sso/SAML2/POST' and binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint, with that URL and using a supported binding, can be found in the relying party's metadata
10:04:59.061 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party https://ans.247lib.com/shibboleth
10:21:18.041 - INFO [Shibboleth-Access:73] - 20130709T092118Z|192.168.0.2|amlib.co.uk|/profile/SAML2/Redirect/SSO|
The related error message on shibd.log is:
2013-07-09 09:57:57 ERROR XMLTooling.ParserPool : fatal error on line 0, column 0, message: unable to connect socket for URL 'https://amlib.co.uk/idp/profile/Metadata/SAML'
2013-07-09 09:57:57 ERROR OpenSAML.MetadataProvider.XML : error while loading resource (https://amlib.co.uk/idp/profile/Metadata/SAML): XML error(s) during parsing, check log for specifics
2013-07-09 09:57:57 WARN OpenSAML.MetadataProvider.XML : adjusted reload interval to 1800 seconds
2013-07-09 09:57:57 CRIT OpenSAML.MetadataProvider.XML : maintaining existing configuration, error reloading resource (https://amlib.co.uk/idp/profile/Metadata/SAML): XML error(s) during parsing, check log for specifics
2013-07-09 10:22:11 WARN OpenSAML.MessageDecoder.SAML2 [1]: no metadata found, can't establish identity of issuer (https://amlib.co.uk/idp/shibboleth)
2013-07-09 10:22:11 WARN Shibboleth.SSO.SAML2 [1]: no metadata found, can't establish identity of issuer (https://amlib.co.uk/idp/shibboleth)
2013-07-09 10:22:11 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: Unable to establish security of incoming assertion.
2013-07-09 10:27:34 INFO XMLTooling.StorageService : purged 4 expired record(s) from storage
2013-07-09 10:27:57 INFO OpenSAML.MetadataProvider.XML : reloading remote resource...
2013-07-09 10:27:57 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (https://amlib.co.uk/idp/profile/Metadata/SAML)
2013-07-09 10:27:57 INFO OpenSAML.MetadataProvider.XML : adjusted reload interval to 7200 seconds
Kind regards
Gilles Rubens Badouet
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130709/59caea16/attachment-0001.html
------------------------------
Message: 3
Date: Tue, 9 Jul 2013 11:58:12 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Error after succeeded authentication
To: users at shibboleth.net
Message-ID: <20130709095812.GJ6686 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Gilles Badouet <badouetg at uni.coventry.ac.uk> [2013-07-09 11:41]:
> 10:04:59.061 - WARN
> [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] -
> Relying party 'https://ans.247lib.com/shibboleth' requested the
> response to be returned to endpoint with ACS URL
> 'https://ans.247lib.com/Shibboleth.sso/SAML2/POST' and binding
> 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no
> endpoint, with that URL and using a supported binding, can be found
> in the relying party's metadata
> 10:04:59.061 - ERROR
> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447]
> - No return endpoint available for relying party
> https://ans.247lib.com/shibboleth
That means just that: The IdP cannot find the requested endpoint in
metadata for this SP. How exactly did you add the SP's metadata to the
IdP?
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider
If you don't have a federation that manages IdP and SP metadata for
you it's easiest to add file based metadata to relying-party.xml and
use that for all local (or self-managed) SPs, e.g.
<metadata:MetadataProvider id="localSPs" xsi:type="metadata:FilesystemMetadataProvider"
metadataFile="/opt/shibboleth-idp/metadata/local-sps.xml" maxRefreshDelay="PT15M" />
This will also pick up any changes you make to this file after 15
minutes max.
> The related error message on shibd.log is:
>
>
> 2013-07-09 09:57:57 ERROR XMLTooling.ParserPool : fatal error on line 0, column 0, message: unable to connect socket for URL 'https://amlib.co.uk/idp/profile/Metadata/SAML'
>
> 2013-07-09 09:57:57 ERROR OpenSAML.MetadataProvider.XML : error while loading resource (https://amlib.co.uk/idp/profile/Metadata/SAML): XML error(s) during parsing, check log for specifics
The SP failed to connect to the IdP to grab its metadata from that
URL. In short: Don't do that. Instead transfer the IdP's metadata to
the SP securely once and use file based metadata at the SP, like in
the distributed default configuration:
<MetadataProvider type="XML" file="idp-metadata.xml"/>
Put the IdP's metadata into /etc/shibboleth and name it
"idp-metadata.xml" (or whatever, but then also adjust the file name
above).
-peter
------------------------------
Message: 4
Date: Tue, 9 Jul 2013 03:23:21 -0700
From: "Tejash Mistry" <Tejash.Mistry at fasttrackteam.com>
Subject: Getting Shibboleth Extension not configured error
To: <users at shibboleth.net>
Message-ID: <4b1ddeca$14bf9c61$1490401$@com>
Content-Type: text/plain; charset="us-ascii"
Hello All,
I have configured Shibboleth SP on Windows 2003 server on IIS 6. I have
installed Shibboleth version 2.5.1. When I tried to call Shibboleth I got
below error
"Shibboleth Extension not configured for web site (check ISAPI mappings in
SP configuration)."
Can anyone help me please?
Thanks In advance.
Regards,
Tejash
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130709/ea775121/attachment-0001.html
------------------------------
Message: 5
Date: Tue, 9 Jul 2013 12:35:49 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Getting Shibboleth Extension not configured error
To: users at shibboleth.net
Message-ID: <20130709103549.GK6686 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Tejash Mistry <Tejash.Mistry at fasttrackteam.com> [2013-07-09 12:24]:
> "Shibboleth Extension not configured for web site (check ISAPI mappings in
> SP configuration)."
Check the archives, the same question was asked (and answered) two
weeks ago.
-peter
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 25, Issue 45
*************************************
------------------------------
Message: 2
Date: Tue, 9 Jul 2013 14:38:12 +0200
From: Mustapha Aoussar <mustapha.aoussar at gmail.com>
Subject: Re: NoClassDefFoundError: org/w3c/dom/ElementTraversal
To: Shib Users <users at shibboleth.net>
Message-ID:
<CAP=4u8RAQknY6XPNmwSAKCa_qjUEK5u9Qop9NKxeCJFp0GxEbA at mail.gmail.com>
Content-Type: text/plain; charset="iso-8859-1"
Thank you so much, but I already did it. I copied the *xalan-2.7.1.jar* and
*xercesImpl-2.10.0.jar* correctly to JETTY_HOME/lib/endorsed/ and I added
the following line to *start.ini*: -Djava.endorsed.dirs=lib/endorsed I
followed all the steps of this guide:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPJetty7Prepare.
2013/7/9 Paul Hethmon <paul.hethmon at clareitysecurity.com>
> You need to properly endorse xalan and xerces for use with your
> container (Jetty). Check the wiki for the information on how to do this and
> what it means.
>
> Paul
>
> From: Mustapha Aoussar <mustapha.aoussar at gmail.com>
> Reply-To: Shibboleth Users <users at shibboleth.net>
> Date: Tuesday, July 9, 2013 8:08 AM
> To: Shibboleth Users <users at shibboleth.net>
> Subject: NoClassDefFoundError: org/w3c/dom/ElementTraversal
>
> Hello!
> I tried to install and run the *Shibboleth IdP* under *Jetty 7*, but I
> got this error:
> *java.lang.NoClassDefFoundError: org/w3c/dom/ElementTraversal*
>
> See the complete error here: *http://pastebin.com/idFBgnjd*
>
> I opened a ticket in my web host to ask for help about this problem, and
> they answered as follows:
>
> You need to make sure that the xml-apis-2.10.0.jar file is properly
> included on your CLASSPATH. I tried to get this working for you, but it
> looks like there is some code inside the program that is overriding the
> environment's CLASSPATH settings. I suggest that you start simple -- just a
> test Java program that tries to import the ElementTraversal class, and
> build up from there until you understand the obstacle that is preventing
> your app from starting.
>
>
> but unfortunately i don't know to programming in java. So how can I
> solve this problem?
> Thank you very much for any help! :)
>
> Best regards!
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130709/6bb79c62/attachment-0001.html
------------------------------
Message: 3
Date: Tue, 9 Jul 2013 14:46:39 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Error after succeeded authentication
To: users at shibboleth.net
Message-ID: <20130709124639.GA24684 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Gilles Badouet <badouetg at uni.coventry.ac.uk> [2013-07-09 14:32]:
> Just before your email, I noticed in wiki documentation that it is
> preferable to use uri="http..." instead of ssl based (
> uri="https...") in the metadata provider element of
> shibboleth2.xml. I did that and noticed therefore that the sp loaded
> successfully the IdP metadata. However, I still have the same error
> message after the authentication.
Using TLS/SSL for fetching metadata in a local test deployment may
cause some issues (e.g. with all components on one host and when
accessing the webserver via the loopback interface) but mostly this is
to make clear that fetching metadata this way (i.e., with TLS/SSL or
without TLS/SSL) does *not* provide trustworthy metadata.
So don't fetch metadata via HTTP (or HTTPS, for that matter) and you
rid yourself of all those issues.
> When I check the sp metadata (some-metadata.xml) loaded by the IdP,
> I noticed that the endpoint URL in <md:AssertionConsumerService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location
> is effectively "http://ans.247lib.com/Shibboleth.sso/SAML2/POST"
> index="1" instead of what it is supposed to be as stated in the
> error ( https://ans.247lib.com/Shibboleth.sso/SAML2/POST'). How can
> I first access and modify the sp metadata. I cant see it when
> browsing the sp sub-folders.
That's a consequence of (a) fetching metadata directly from the SP,
which is discouraged (with a comment at the very beginning of that
metadata), and (b) switching the protocol you fetch that metadata with
from https to http, which will then give you http on all included
endpoints.
So, again, don't do that.
> Below is the my metadata provider elements within the relying-party.xml to load the sp metadata.
>
> <metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
>
> <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FilesystemMetadataProvider"
> metadataFile="C:\IDP\metadata\idp-metadata.xml"
> maxRefreshDelay="P1D" />
>
> <metadata:MetadataProvider id="_7be67ad6e799cc5fdf9631f8904e15120bc0400c" xsi:type="metadata:FileBackedHTTPMetadataProvider"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> metadataURL="http://ans.247lib.com/Shibboleth.sso/Metadata"
> backingFile="C:\IDP\metadata\some-metadata.xml" />
Copy the SP's metadata to C:\IDP\metadata\some-metadata.xml and change
the metadata:MetadataProvider to look like this (or the example I
already posted in my previous email):
<metadata:MetadataProvider id="SomeSP" xsi:type="metadata:FilesystemMetadataProvider"
metadataFile="C:\IDP\metadata\some-metadata.xml"
maxRefreshDelay="P1D" />
> And to add the IdP metadata to the sp:
>
> <MetadataProvider type="XML" uri="http://amlib.co.uk:8080/idp/profile/Metadata/SAML"
> backingFilePath="C:\opt\shibboleth-sp\idp_metadata\amlibmetadata.xml" reloadInterval="7200">
Same here: Copy the IDP's metadata to C:\opt\shibboleth-sp\amlibmetadata.xml
directory (which should be C:\opt\shibboleth-sp in your case) and
refer to it with a MetadataProvider via
file="C:\opt\shibboleth-sp\amlibmetadata.xml"
Pointing to http(s) URLs does not solve any of your problems, in fact
it causes them all.
-peter
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 25, Issue 47
*************************************
More information about the users
mailing list