reasons for error.jsp to be displayed?

[Paul Hethmon]

Sounds like it might be a cookie problem. If the login context cookie is lost before the session cookie is set (by the authentication engine), then the IdP doesn't know what to do with the user. I've seen this occur when the login credentials are submitted multiple times. The first time they are accepted and the login context is thrown away as the session is set. However, the browser submitted the credentials a second time and it dropped the first request/response. So when Shib tries to reply, the necessary information is gone.

If you can reproduce it, then a trace with FF and SAML Tracer should show what's happening (though not guaranteed 100%).

In general, the error.jsp page will be used when Shib is unable to do anything further. Meaning it can't send the user to the SP they are trying to get to. Either with a successful SAML Response or a SAML error message. It can also be shown when the incoming AuthnRequest is invalid in some way (time skew). Another time is when the SP sends an ACS endpoint in the AuthnRequest that is not listed in their metadata, that's an error.

Paul


From: Gene Matthews <gmatthew at hitachi-cta.com<mailto:gmatthew at hitachi-cta.com>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Tuesday, November 19, 2013 3:02 PM
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: reasons for error.jsp to be displayed?

10:33:13.106 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:178] - Successfully authenticated user X
10:33:13.107 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144] - Returning control to authentication engine
10:33:13.107 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:360] - No login context in storage service
10:33:13.108 - WARN [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:147] - No login context available, unable to return to authentication engine
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131119/2315d0ea/attachment.html