testing with sp.testshib.org against my IdP
Gene Matthews
gmatthew at hitachi-cta.com
Fri Jul 12 10:40:03 EDT 2013
I'm new to Shibboleth and implementing SSO. I'm trying to test my new installation of shibboleth-idp by using testshib and getting the following:
opensaml::FatalProfileException at ( https://sp.testshib.org/Shibboleth.sso/SAML2/POST )
Error from identity provider:
Status: urn:oasis:names:tc:SAML:2.0:status:Responder
Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
I'm sure my configuration is not complete/correct. In login.config I'm attempting to get it to talk to LDAP but my LDAP logs show no activity whatsoever during this time frame. What I think is pertinent information is below. I'd appreciate any hints and/or nudges in the right direction.
login.config snippet:
ShibUserPassAuth {
edu.vt.middleware.ldap.jaas.LdapLoginModule required
ldapUrl=" ldap://myLDAP.me.com:389 "
baseDn="dc=me,dc=com"
bindDn="cn=Manager,dc=me,dc=com"
bindCredential="itsasecret"
tls="false"
ssl="false"
relying-party.xml snippet:
<metadata:MetadataProvider id="URLMD" xsi:type="metadata:FileBackedHTTPMetadataProvider"
metadataURL=" http://www.testshib.org/metadata/testshib-providers.xml "
backingFile="testshib.xml">
<!--
<metadata:MetadataFilter xsi:type="metadata:ChainingFilter">
<metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil"
maxValidityInterval="P7D" />
<metadata:MetadataFilter xsi:type="metadata:SignatureValidation"
trustEngineRef="shibboleth.MetadataTrustEngine"
requireSignedMetadata="true" />
<metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList">
<metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>
</metadata:MetadataFilter>
</metadata:MetadataFilter>
-->
</metadata:MetadataProvider>
</metadata:MetadataProvider>
idp-process.log:
...
19:45:08.788 - DEBUG [PROTOCOL_MESSAGE:113] -
<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL=" https://sp.testshib.org/Shibboleth.sso/SAML2/POST " Destination=" https://myIdp.me.com/idp/profile/SAML2/Redirect/SSO " ID="_c86cd863ed09aea7d64e85a08e1903fe" IssueInstant="2013-07-11T23:45:08Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"> https://sp.testshib.org/shibboleth-sp</saml:Issuer>
<samlp:NameIDPolicy AllowCreate="1"/>
</samlp:AuthnRequest>
...
19:45:08.789 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for https://sp.testshib.org/shibboleth-sp , looking up configuration based on metadata groups.
...
19:45:08.790 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for https://sp.testshib.org/shibboleth-sp . Using default relying party configuration.
19:45:08.790 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:130] - Evaluating security policy of type 'edu.internet2.middleware.shibboleth.common.security.ShibbolethSecurityPolicy' for decoded message
...
19:45:08.791 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] - Checking child metadata provider for entity descriptor with entity ID: https://sp.testshib.org/shibboleth-sp
19:45:08.792 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of https://sp.testshib.org/shibboleth-sp
19:45:08.792 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:250] - Metadata document did not contain a descriptor for entity https://sp.testshib.org/shibboleth-sp
19:45:08.792 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:317] - Metadata document did not contain any role descriptors of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity https://sp.testshib.org/shibboleth-sp
19:45:08.792 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:286] - Metadata document does not contain a role of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol urn:oasis:names:tc:SAML:2.0:protocol for entity https://sp.testshib.org/shibboleth-sp
19:45:08.792 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:308] - Checking child metadata provider for entity descriptor with entity ID: https://sp.testshib.org/shibboleth-sp
19:45:08.792 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of https://sp.testshib.org/shibboleth-sp
...
19:45:08.793 - DEBUG [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:64] - Evaluating simple signature rule of type: org.opensaml.saml2.binding.security.SAML2HTTPRedirectDeflateSignatureRule
...
19:45:08.793 - DEBUG [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:64] - Evaluating simple signature rule of type: org.opensaml.saml2.binding.security.SAML2HTTPPostSimpleSignRule
19:45:08.793 - DEBUG [org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:81] - Rule can not handle this request, skipping processing
19:45:08.793 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:85] - Successfully decoded message.
...
19:45:08.795 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:219] - SAML message intended destination endpoint matched recipient endpoint
19:45:08.795 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:387] - Decoded request from relying party ' https://sp.testshib.org/shibboleth-sp'
19:45:08.796 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID: https://sp.testshib.org/shibboleth-sp
...
19:45:08.797 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for https://sp.testshib.org/shibboleth-sp . Using default relying party configuration.
19:45:08.797 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:226] - Creating login context and transferring control to authentication engine
19:45:08.800 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:181] - Storing LoginContext to StorageService partition loginContexts, key 42ffb6dea5d2d90edd4e9e669234553ac50cf97bfc45dc88a9d30df541f91308
19:45:08.800 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:240] - Redirecting user to authentication engine at https://myIdp.me.com:443/idp/AuthnEngine
19:45:08.804 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request
19:45:08.804 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:240] - Beginning user authentication process.
19:45:08.804 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:283] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.shibboleth.idp.authn.provider.PreviousSessionLoginHandler at 63cb110c, urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified=edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler at 28cc5e03}
19:45:08.805 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:332] - Filtering out previous session login handler because there is no existing IdP session
19:45:08.805 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:464] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified=edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler at 28cc5e03}
19:45:08.805 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:497] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler
19:45:08.805 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler:66] - Redirecting to https://myIdp.me.com:443/idp/Authn/RemoteUser
19:45:08.810 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet:77] - No remote user information was present in the request
19:45:08.810 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144] - Returning control to authentication engine
19:45:08.811 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request
19:45:08.811 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514] - Completing user authentication process
19:45:08.811 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585] - Validating authentication was performed successfully
19:45:08.811 - ERROR [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:618] - No user identified by login handler.
19:45:08.816 - ERROR [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:563] - Authentication failed with the error:
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException: No user identified by login handler.
...
at java.lang.Thread.run(Thread.java:722) [na:1.7.0_21]
19:45:08.817 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:161] - Returning control to profile handler
19:45:08.817 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:177] - Redirecting user to profile handler at https://myIdp.me.com:443/idp/profile/SAML2/Redirect/SSO
19:45:08.822 - INFO [Shibboleth-Access:73] - 20130711T234508Z|137.168.66.32| myIdp.me.com :443|/profile/SAML2/Redirect/SSO|
19:45:08.822 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/Redirect/SSO
19:45:08.823 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
19:45:08.823 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:588] - Unbinding LoginContext
19:45:08.823 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:614] - Expiring LoginContext cookie
19:45:08.823 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:625] - Removed LoginContext, with key 42ffb6dea5d2d90edd4e9e669234553ac50cf97bfc45dc88a9d30df541f91308, from StorageService partition loginContexts
19:45:08.823 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:178] - Incoming request contains a login context and indicates there was an error authenticating the principal, processing second leg of request
...
19:45:08.825 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for https://sp.testshib.org/shibboleth-sp
19:45:08.825 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for https://sp.testshib.org/shibboleth-sp , looking up configuration based on metadata groups.
19:45:08.825 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID: https://sp.testshib.org/shibboleth-sp
19:45:08.825 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of https://sp.testshib.org/shibboleth-sp
19:45:08.826 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] - Metadata document does not contain an EntityDescriptor with the ID https://sp.testshib.org/shibboleth-sp
19:45:08.826 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID: https://sp.testshib.org/shibboleth-sp
19:45:08.826 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of https://sp.testshib.org/shibboleth-sp
19:45:08.826 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for https://sp.testshib.org/shibboleth-sp . Using default relying party configuration.
19:45:08.826 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID: https://myIdp.me.com/idp/shibboleth
19:45:08.826 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:520] - Searching for entity descriptor with an entity ID of https://myIdp.me.com/idp/shibboleth
...
19:45:08.830 - DEBUG [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:69] - Selecting endpoint by ACS URL ' https://sp.testshib.org/Shibboleth.sso/SAML2/POST' and protocol binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' for request '_c86cd863ed09aea7d64e85a08e1903fe' from entity ' https://sp.testshib.org/shibboleth-sp'
...
19:45:08.873 - DEBUG [PROTOCOL_MESSAGE:74] -
<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination=" https://sp.testshib.org/Shibboleth.sso/SAML2/POST " ID="_0f25317e9aa351286f042d0920247911" InResponseTo="_c86cd863ed09aea7d64e85a08e1903fe" IssueInstant="2013-07-11T23:45:08.832Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"> https://myIdp.me.com/idp/shibboleth</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>
</saml2p:StatusCode>
</saml2p:Status>
</saml2p:Response>
Thanks,
Gene
Gene Matthews
Systems Integration and Engineering (SIE)
Hitachi CTA, Inc.
3617 Parkway Lane
Norcross, GA 30092
M: 678.994.1374
O: 770.797. 2552
F: 770-797-2550
Gene.Matthews at hitachi-cta.com
www.hitachi-cta.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130712/3e4937c7/attachment-0001.html
More information about the users
mailing list