Shibboleth IdP integration with Oracle 11g Identity Federation

lalithj j_lalith at hotmail.com
Mon Mar 25 19:52:40 EDT 2013 

Hi All,

We got Shibboleth IdP 2.3.8 in prod, currently we got couple of SPs
integrated with us successfully.

Now we got a new requirement that one of the SPs need to interact with us
but they( their applications) are based on Oracle 11g platform, to achive
SSO, they have decided OIF integration with our IdP.

They are in the exercise of linking with our IdP via OIF (Oracle Identity
Federation), We did exchange the meta data and our replying party now points
to their SP meta data as well, also in our filter policy we do release 4
attributes to this entity Id,

However Client is complaining that they are getting some exception 'bad
certifcate' in their logs and also not getting any attributes, which I
attached below fully.

Then I asked them to provide the test client URL and tried ourselves with
SAML tracer on, I just listed below the first SAML request (received by us)
which look very different to our other SP SAML requests.


Our Idp log also complains about an issue

No attribute of principal 'xxxxxxx' can be encoded in to a NameIdentifier of
required format 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress' for
relying party 'http://clientsp:14100/oam/fed'
10:47:25.272 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:778]
- Encoding response to SAML request
id-Wn0-Q5MdpBJfo3XgE6qx-tl4ST7vizDbfgnbeWGI from relying party
http://dev15sdvt.vu.edu.au:14100/oam/fed


What could be the reason for this error, any ideas 

SAML tracer entry.....

<ns12:AuthnRequest
xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing"
                   xmlns:xrd="xri://$xrd*($v*2.0)"
                   xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
                   xmlns:ns4="http://www.w3.org/2005/08/addressing"
                  
xmlns:tns="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"
                  
xmlns:ns6="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"
                   xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
                   xmlns:enc="http://www.w3.org/2001/04/xmlenc#"
                   xmlns:soap="http://www.w3.org/2003/05/soap-envelope"
                   xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
                  
xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
                   xmlns:ns12="urn:oasis:names:tc:SAML:2.0:protocol"
                  
xmlns:wst14="http://docs.oasis-open.org/ws-sx/ws-trust/200802"
                   xmlns:ic="http://schemas.xmlsoap.org/ws/2005/05/identity"
                   xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
                   xmlns:wst="http://schemas.xmlsoap.org/ws/2005/02/trust"
                  
xmlns:ns17="http://docs.oasis-open.org/ws-sx/ws-trust/200512"
                   xmlns:xrds="xri://$xrds"
                   xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                   xmlns:ns20="urn:oasis:names:tc:SAML:1.0:assertion"
                   xmlns:ns21="http://schemas.xmlsoap.org/soap/envelope/"
                  
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
                  
xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                  
xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
                   xmlns:ns27="urn:oasis:names:tc:SAML:profiles:v1metadata"
                   ForceAuthn="false"
                   IsPassive="false"
                   ID="id-yrt4HUBx3ozH-GSIuE4Zh1zPo6xqzurU5RMK5AGb"
                   Version="2.0"
                   IssueInstant="2013-03-25T23:14:11Z"
                  
Destination="https://ouridp.vu.edu.au/idp/profile/SAML2/Redirect/SSO"
                   >
    <saml:Issuer
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://dev15sdvt.vu.edu.au:14100/oam/fed</saml:Issuer>
    <ns12:NameIDPolicy
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
                       AllowCreate="true"
                       />
</ns12:AuthnRequest>



Client log got below exception

<Error> <oracle.security.fed.controller.library.api.FedEngineInstance>
<FEDSTS-12079> <ResponseHandlerException: {0}
oracle.security.fed.controller.frontend.action.exceptions.ResponseHandlerException:
oracle.security.fed.util.soap.SOAPException:
javax.net.ssl.SSLHandshakeException: Received fatal alert:
<b>bad_certificate*
        at
oracle.security.fed.frontend.fed.responsehandler.profiles.sp.SendSoapRequestSSOResponseHandler.perform(SendSoapRequestSSOResponseHandler.java:119)
        at
oracle.security.fed.controller.library.api.FedEngineInstance.processCall(FedEngineInstance.java:279)
        at
oracle.security.fed.controller.library.api.FedEngineInstance.processCall(FedEngineInstance.java:164)
        at
oracle.security.fed.controller.library.api.FedEngineSPInstance.validateAndMapAssertion(FedEngineSPInstance.java:166)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at
oracle.security.am.engine.authn.internal.plugin.FedUserAuthenticationPlugin.invokeValidateAndMapAssertion(FedUserAuthenticationPlugin.java:284)
        at
oracle.security.am.engine.authn.internal.plugin.FedUserAuthenticationPlugin.process(FedUserAuthenticationPlugin.java:162)
        at
oracle.security.am.engine.authn.internal.executor.PlugInExecutor.execute(PlugInExecutor.java:197)
        at
oracle.security.am.engine.authn.internal.executor.AuthenticationSchemeExecutor.execute(AuthenticationSchemeExecutor.java:101)
        at
oracle.security.am.engine.authn.internal.controller.AuthenticationEngineControllerImpl.validateUser(AuthenticationEngineControllerImpl.java:265)
        at
oracle.security.am.engines.enginecontroller.AuthnEngineController.authenticateUser(AuthnEngineController.java:698)
        at
oracle.security.am.engines.enginecontroller.AuthnEngineController.processEvent(AuthnEngineController.java:299)
        at
oracle.security.am.controller.MasterController.processEvent(MasterController.java:570)
        at
oracle.security.am.controller.MasterController.processRequest(MasterController.java:759)
        at
oracle.security.am.controller.MasterController.process(MasterController.java:682)
        at
oracle.security.am.pbl.PBLFlowManager.delegateToMasterController(PBLFlowManager.java:209)
        at
oracle.security.am.pbl.PBLFlowManager.handleBaseEvent(PBLFlowManager.java:147)
        at
oracle.security.am.pbl.PBLFlowManager.processRequest(PBLFlowManager.java:107)
        at
oracle.security.am.pbl.transport.http.AMServlet.handleRequest(AMServlet.java:177)
        at
oracle.security.am.pbl.transport.http.AMServlet.doPost(AMServlet.java:136)
        at
oracle.security.am.pbl.transport.http.AMServlet.doGet(AMServlet.java:699)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:821)
        at
weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
        at
weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
        at
weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
        at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:27)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
 at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
        at
oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
        at
oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
        at
oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
        at
oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
        at
oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
        at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
        at
oracle.security.am.agent.wls.filters.OAMServletAuthenticationFilter.doFilter(OAMServletAuthenticationFilter.java:264)
        at
oracle.security.am.agent.wls.filters.OAMValidationSystemFilter.doFilter(OAMValidationSystemFilter.java:134)
        at
oracle.security.wls.oamagent.OAMAgentWrapperFilter.doFilter(OAMAgentWrapperFilter.java:120)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
        at
oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
        at
weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3738)
        at
weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3704)
        at
weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
        at
weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
        at
weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2281)
        at
weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2180)
        at
weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1491)
        at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
        at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
>
java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at
oracle.security.am.engine.authn.internal.plugin.FedUserAuthenticationPlugin.invokeValidateAndMapAssertion(FedUserAuthenticationPlugin.java:284)
        at
oracle.security.am.engine.authn.internal.plugin.FedUserAuthenticationPlugin.process(FedUserAuthenticationPlugin.java:162)
        at
oracle.security.am.engine.authn.internal.executor.PlugInExecutor.execute(PlugInExecutor.java:197)
        at
oracle.security.am.engine.authn.internal.executor.AuthenticationSchemeExecutor.execute(AuthenticationSchemeExecutor.java:101)
        at
oracle.security.am.engine.authn.internal.controller.AuthenticationEngineControllerImpl.validateUser(AuthenticationEngineControllerImpl.java:265)
        at
oracle.security.am.engines.enginecontroller.AuthnEngineController.authenticateUser(AuthnEngineController.java:698)
        at
oracle.security.am.engines.enginecontroller.AuthnEngineController.processEvent(AuthnEngineController.java:299)
        at
oracle.security.am.controller.MasterController.processEvent(MasterController.java:570)
        at
oracle.security.am.controller.MasterController.processRequest(MasterController.java:759)
        at
oracle.security.am.controller.MasterController.process(MasterController.java:682)
        at
oracle.security.am.pbl.PBLFlowManager.delegateToMasterController(PBLFlowManager.java:209)
        at
oracle.security.am.pbl.PBLFlowManager.handleBaseEvent(PBLFlowManager.java:147)
        at
oracle.security.am.pbl.PBLFlowManager.processRequest(PBLFlowManager.java:107)
        at
oracle.security.am.pbl.transport.http.AMServlet.handleRequest(AMServlet.java:177)
        at
oracle.security.am.pbl.transport.http.AMServlet.doPost(AMServlet.java:136)
        at
oracle.security.am.pbl.transport.http.AMServlet.doGet(AMServlet.java:697)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
        at
weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at
weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
        at
weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
        at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:60)
        at
oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
        at
oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
        at
oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
        at
oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
        at
oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
        at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:60)
        at
oracle.security.am.agent.wls.filters.OAMServletAuthenticationFilter.doFilter(OAMServletAuthenticationFilter.java:264)
        at
oracle.security.am.agent.wls.filters.OAMValidationSystemFilter.doFilter(OAMValidationSystemFilter.java:133)
        at
oracle.security.wls.oamagent.OAMAgentWrapperFilter.doFilter(OAMAgentWrapperFilter.java:120)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:60)
        at
oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:60)
        at
weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3738)
        at
weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3704)
        at
weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
        at
weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
        at
weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2281)
        at
weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2180)
        at
weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1491)
        at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
        at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Caused by: java.lang.RuntimeException:
oracle.security.fed.controller.frontend.action.exceptions.ResponseHandlerException:
oracle.security.fed.util.soap.SOAPException:
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
        at
oracle.security.fed.controller.library.api.FedEngineInstance.processCall(FedEngineInstance.java:395)
        at
oracle.security.fed.controller.library.api.FedEngineInstance.processCall(FedEngineInstance.java:164)
        at
oracle.security.fed.controller.library.api.FedEngineSPInstance.validateAndMapAssertion(FedEngineSPInstance.java:166)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at
oracle.security.am.engine.authn.internal.plugin.FedUserAuthenticationPlugin.invokeValidateAndMapAssertion(FedUserAuthenticationPlugin.java:284)
        at
oracle.security.am.engine.authn.internal.plugin.FedUserAuthenticationPlugin.process(FedUserAuthenticationPlugin.java:162)
        at
oracle.security.am.engine.authn.internal.executor.PlugInExecutor.execute(PlugInExecutor.java:197)
        at
oracle.security.am.engine.authn.internal.executor.AuthenticationSchemeExecutor.execute(AuthenticationSchemeExecutor.java:101)
        at
oracle.security.am.engine.authn.internal.controller.AuthenticationEngineControllerImpl.validateUser(AuthenticationEngineControllerImpl.java:265)
        at
oracle.security.am.engines.enginecontroller.AuthnEngineController.authenticateUser(AuthnEngineController.java:698)
        at
oracle.security.am.engines.enginecontroller.AuthnEngineController.processEvent(AuthnEngineController.java:299)
        at
oracle.security.am.controller.MasterController.processEvent(MasterController.java:570)
        at
oracle.security.am.controller.MasterController.processRequest(MasterController.java:759)
        at
oracle.security.am.controller.MasterController.process(MasterController.java:682)
        at
oracle.security.am.pbl.PBLFlowManager.delegateToMasterController(PBLFlowManager.java:209)
at
oracle.security.am.pbl.PBLFlowManager.handleBaseEvent(PBLFlowManager.java:147)
        at
oracle.security.am.pbl.PBLFlowManager.processRequest(PBLFlowManager.java:107)
        at
oracle.security.am.pbl.transport.http.AMServlet.handleRequest(AMServlet.java:177)
        at
oracle.security.am.pbl.transport.http.AMServlet.doPost(AMServlet.java:136)
        at
oracle.security.am.pbl.transport.http.AMServlet.doGet(AMServlet.java:699)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:821)
        at
weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
        at
weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
        at
weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
        at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:27)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
        at
oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
        at
oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
        at
oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
        at
oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
        at
oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
        at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
        at
oracle.security.am.agent.wls.filters.OAMServletAuthenticationFilter.doFilter(OAMServletAuthenticationFilter.java:264)
        at
oracle.security.am.agent.wls.filters.OAMValidationSystemFilter.doFilter(OAMValidationSystemFilter.java:134)
        at
oracle.security.wls.oamagent.OAMAgentWrapperFilter.doFilter(OAMAgentWrapperFilter.java:120)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
        at
oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:61)
        ... 9 more
Caused by:
oracle.security.fed.controller.frontend.action.exceptions.ResponseHandlerException:
oracle.security.fed.util.soap.SOAPException:
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
        at
oracle.security.fed.frontend.fed.responsehandler.profiles.sp.SendSoapRequestSSOResponseHandler.perform(SendSoapRequestSSOResponseHandler.java:119)
        at
oracle.security.fed.controller.library.api.FedEngineInstance.processCall(FedEngineInstance.java:279)
        ... 51 more
<Mar 21, 2013 3:50:16 PM EST> <Error> <oracle.oam.binding> <OAM-00002>
<Error occurred while handling the request.
java.lang.NullPointerException
        at
oracle.security.am.pbl.protocol.plugin.credcollect.DefaultRedirectionStrategy.getTargetUrl(DefaultRedirectionStrategy.java:403)
        at
oracle.security.am.pbl.protocol.plugin.credcollect.DefaultRedirectionStrategy.getRedirectUrl(DefaultRedirectionStrategy.java:314)
        at
oracle.security.am.pbl.protocol.plugin.credcollect.DefaultCredCollectResponseExecutor.process(DefaultCredCollectResponseExecutor.java:121)
        at
oracle.security.am.pbl.protocol.plugin.credcollect.CredentialCollectionResponseHandler.process(CredentialCollectionResponseHandler.java:99)
        at
oracle.security.am.pbl.PBLFlowManager.handleBaseEvent(PBLFlowManager.java:175)
        at
oracle.security.am.pbl.PBLFlowManager.processRequest(PBLFlowManager.java:107)
        at
oracle.security.am.pbl.transport.http.AMServlet.handleRequest(AMServlet.java:177)
        at
oracle.security.am.pbl.transport.http.AMServlet.doPost(AMServlet.java:136)
        at
oracle.security.am.pbl.transport.http.AMServlet.doGet(AMServlet.java:697)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
        at
weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
        at
weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
        at
weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
        at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
        at
weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:60)
        at
oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)




Thanks










--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibboleth-IdP-integration-with-Oracle-11g-Identity-Federation-tp7585604.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.

More information about the users mailing list