Problems authenticating with TestShib

[Nate Klingenstein]

Martin,

Your IdP returned your user to the SP with a failed authentication message in response, not a successful authentication and assertion.  You'll need to relook at the IdP user authentication mechanisms in place and ensure they can actually authenticate a user.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn

Likely you need to comment out RemoteUser and uncomment UsernamePassword in handler.xml, but it depends entirely on what flavor of authentication you're trying to use.

Thanks,
Nate.

On Jun 14, 2013, at 9:59 , Martin Simpson wrote:

> Hi All,
>  
> I am new to shibboleth, but have been asked to run some tests to assess the viability of using shib with office 365.  I have set up an initial IdP and tested against TestShib, however I get the following error:
>  
> opensaml::FatalProfileException
> …….
>  
> I'm sorry this didn't work out just yet.
>  
> opensaml::FatalProfileException at (https://sp.testshib.org/Shibboleth.sso/SAML2/POST)
>  
> SAML response contained an error.
>  
> Error from identity provider:
>  
> Status: urn:oasis:names:tc:SAML:2.0:status:Responder
> Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
>  
>  
> A look at the logs doesn’t seem to show any specific errors that I can see…. I have checked the time on my server, plus the MetaData seems okay…
>  
> 2013-06-14 05:36:46 INFO Shibboleth.SecurityPolicyProvider.XML : reload thread finished
> 2013-06-14 05:57:30 DEBUG Shibboleth.Listener [45]: dispatching message (default/TestShib::run::SAML2SI)
> 2013-06-14 05:57:30 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [45]: validating input
> 2013-06-14 05:57:30 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [45]: marshalling, deflating, base64-encoding the message
> 2013-06-14 05:57:30 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [45]: marshalled message:
> <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" Destination="https://amshib.amersham.ac.uk/idp/profile/SAML2/Redirect/SSO" ID="_59adf7938f8221d51efc9648cb4db2f7" IssueInstant="2013-06-14T09:57:30Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest>
> 2013-06-14 05:57:30 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [45]: message encoded, sending redirect to client
> 2013-06-14 05:57:31 DEBUG Shibboleth.Listener [51]: dispatching message (default/SAML2/POST)
> 2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2POST [51]: validating input
> 2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2POST [51]: decoded SAML message:
> <?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" ID="_02271f03d4fd9f10643c27b6e12ea0e9" InResponseTo="_59adf7938f8221d51efc9648cb4db2f7" IssueInstant="2013-06-14T09:55:41.189Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://amshib.amersham.ac.uk/idp/shibboleth</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/></saml2p:StatusCode></saml2p:Status></saml2p:Response>
> 2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: extracting issuer from SAML 2.0 protocol message
> 2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: message from (https://amshib.amersham.ac.uk/idp/shibboleth)
> 2013-06-14 05:57:31 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: searching metadata for message issuer...
> 2013-06-14 05:57:31 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [51]: evaluating message flow policy (replay checking on, expiration 60)
> 2013-06-14 05:57:31 DEBUG XMLTooling.StorageService [51]: inserted record (_02271f03d4fd9f10643c27b6e12ea0e9) in context (MessageFlow) with expiration (1371203981)
> 2013-06-14 05:57:31 DEBUG Shibboleth.SSO.SAML2 [51]: processing message against SAML 2.0 SSO profile
>  
> I would be very very grateful if somebody can point me in the right direction.
>  
> Thanks in advance
>  
> Martin Simpson
> Computer Services
> Amersham & Wycombe College
> T: 01494 585226
> F: 01494 585566
>  
> <image003.jpg>
>  
>  
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net