Unable to parse SAML attributes and redirecting the request back to the URL

[Justin Russo]

Thanks You very much Scott,
So from your conversation i understood that the key problem is not generating the session cookie.
so if i try to see to generate it , may be it will solve the problem. 
i will try to looks through the documentation to see if i can find the info on generation.

the native log has
2013-06-28 14:21:53 INFO Shibboleth.Config : shibboleth 2.5.1 library shutting down
2013-06-28 14:21:53 INFO Shibboleth.Config : reload thread finished
2013-06-28 14:21:53 INFO Shibboleth.SessionCache : cleanup thread exiting
2013-06-28 14:21:53 INFO XMLTooling.Config : xmltooling 1.5.2 library shutdown complete
2013-06-28 14:21:53 INFO Shibboleth.Config : shibboleth 2.5.1 library shutdown complete
2013-06-28 15:11:13 INFO XMLTooling.Config : xmltooling 1.5.2 library initialization complete
2013-06-28 15:11:13 INFO Shibboleth.Config : shibboleth 2.5.1 library initialization complete
2013-06-28 15:11:13 INFO Shibboleth.Config : reload thread started...running when signaled
2013-06-28 15:11:13 INFO Shibboleth.Config : loaded XML resource (C:/opt/shibboleth-sp/etc/shibboleth/shibboleth2.xml)
2013-06-28 15:11:13 INFO Shibboleth.Config : Shibboleth SP Version 2.5.1
2013-06-28 15:11:13 INFO Shibboleth.Config : Library versions: log4shib 1.0.5, Xerces-C 3.1.1, XMLTooling-C 1.5.2, Shibboleth 1.5.1
2013-06-28 15:11:13 INFO Shibboleth.Config : building ListenerService of type TCPListener...
2013-06-28 15:11:13 INFO Shibboleth.Config : building SessionCache of type StorageService...
2013-06-28 15:11:13 WARN Shibboleth.SessionCache : cacheTimeout property is deprecated in favor of cacheAllowance (see documentation)
2013-06-28 15:11:13 INFO Shibboleth.Config : building RequestMapper of type Native...
2013-06-28 15:11:13 INFO Shibboleth.SessionCache : cleanup thread started...run every 900 secs; timeout after 900 secs
2013-06-28 15:11:13 INFO Shibboleth.AssertionLookup : installing default ACL (127.0.0.1 ::1)

hope you have a good vacation.

thanks again scott,

thanks,
Justin



________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Friday, June 28, 2013 3:12 PM
Subject: Re: Unable to parse SAML attributes and redirecting the request back to the URL
 

On 6/28/13 3:00 PM, "justin9" <justin9 at ymail.com> wrote:

>Hi Scott,
>
>well i also see cookies being generated in my computer.

Cookies come from web servers.

>i went trough the documentation and i believe but might be wrong that the
>error is happening at the step # 6  Back to the Protected Resource.

I believe your redirect either doesn't happen, or happens with no session
cookie, which is what causes all loops.

>I have the debug info from my shibd.log and it doesnt have any place where
>session is invalid.

No, because most likely no session cookie is being supplied by your
client, but you should check native.log as well.

That's a loop:

2013-06-28 11:36:41 INFO Shibboleth.SessionCache [1]: new session created:
ID (_c41a8cf8ea72f00ae2f9b755d32814f9) IdP
(https://abccompany.org/SAML2/IDP)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (10.1.1.202)
2013-06-28 11:36:41 DEBUG Shibboleth.SSO.SAML2 [1]: ACS returning via
redirect to: https://myserver/roundup
2013-06-28 11:36:41 DEBUG Shibboleth.Listener [1]: dispatching message
(default/Login::run::SAML2SI)


If the session cookie were present, it wouldn't jump from sending you to
the resource to initiating a new session.

Your log doesn't suggest a problem with the ACS and resource vhosts not
matching, which is another source of looping. Both use a bogus "myserver"
unqualified hostname, which should make them part of a common cookie
domain.

So I have no suggestion. You have no alternative but to trace the traffic
and determine why the shibsession cookie is not being returned at the end.

I'm on vacation, so do not expect any further responses, there's nothing
new here I can tell you.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130628/aea58cfe/attachment.html