Problems authenticating with TestShib

[Martin Simpson]

Hi All,

I am new to shibboleth, but have been asked to run some tests to assess the viability of using shib with office 365.  I have set up an initial IdP and tested against TestShib, however I get the following error:

opensaml::FatalProfileException
.......

I'm sorry this didn't work out just yet.

opensaml::FatalProfileException at (https://sp.testshib.org/Shibboleth.sso/SAML2/POST)

SAML response contained an error.

Error from identity provider:

Status: urn:oasis:names:tc:SAML:2.0:status:Responder
Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed


A look at the logs doesn't seem to show any specific errors that I can see.... I have checked the time on my server, plus the MetaData seems okay...

2013-06-14 05:36:46 INFO Shibboleth.SecurityPolicyProvider.XML : reload thread finished
2013-06-14 05:57:30 DEBUG Shibboleth.Listener [45]: dispatching message (default/TestShib::run::SAML2SI)
2013-06-14 05:57:30 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [45]: validating input
2013-06-14 05:57:30 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [45]: marshalling, deflating, base64-encoding the message
2013-06-14 05:57:30 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [45]: marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" Destination="https://amshib.amersham.ac.uk/idp/profile/SAML2/Redirect/SSO" ID="_59adf7938f8221d51efc9648cb4db2f7" IssueInstant="2013-06-14T09:57:30Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest>
2013-06-14 05:57:30 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [45]: message encoded, sending redirect to client
2013-06-14 05:57:31 DEBUG Shibboleth.Listener [51]: dispatching message (default/SAML2/POST)
2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2POST [51]: validating input
2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2POST [51]: decoded SAML message:
<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" ID="_02271f03d4fd9f10643c27b6e12ea0e9" InResponseTo="_59adf7938f8221d51efc9648cb4db2f7" IssueInstant="2013-06-14T09:55:41.189Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://amshib.amersham.ac.uk/idp/shibboleth</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/></saml2p:StatusCode></saml2p:Status></saml2p:Response>
2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: extracting issuer from SAML 2.0 protocol message
2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: message from (https://amshib.amersham.ac.uk/idp/shibboleth)
2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: searching metadata for message issuer...
2013-06-14 05:57:31 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [51]: evaluating message flow policy (replay checking on, expiration 60)
2013-06-14 05:57:31 DEBUG XMLTooling.StorageService [51]: inserted record (_02271f03d4fd9f10643c27b6e12ea0e9) in context (MessageFlow) with expiration (1371203981)
2013-06-14 05:57:31 DEBUG Shibboleth.SSO.SAML2 [51]: processing message against SAML 2.0 SSO profile

I would be very very grateful if somebody can point me in the right direction.

Thanks in advance

Martin Simpson
Computer Services
Amersham & Wycombe College
T: 01494 585226
F: 01494 585566

[cid:image003.jpg at 01CE68EE.38A78190]


*************************************************************************************
All incoming and outgoing email to/from Amersham & Wycombe College is automatically 
monitored for undesirable content.

Any views or opinions expressed are solely those of the author.
*************************************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130614/37705aaa/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.jpg
Type: image/jpeg
Size: 26304 bytes
Desc: image003.jpg
Url : http://shibboleth.net/pipermail/users/attachments/20130614/37705aaa/attachment-0001.jpg