Problems with back-channel connection

[Adam Portier]

Hello everyone,

I am working on a set of step-by-step instructions for converting some of
the web applications previously protected by mod_webauth for my institution
and I have hit a snag. I am new to Shibboleth and SAML2 in general, but
attended one of the installfests a few weeks ago and got an introduction to
how everything works. I was able to set up a single IdP / SP setup and get
basic login working for a protected Apache path. However, when I went to
implement Logout behavior, I noticed the back-channel was not working
correctly. I turned up the logging on both sides and noticed the following
log messages, indicating to me there is a problem with the SSL handshake.
Both machines are Ubuntu 12.04 servers. I installed the IdP from the web,
and the SP from the package in the Ubuntu repo.

(from the SP process log)
------
2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: About to connect() to
vm-test-idp01.haverford.edu port 8443 (#0)

2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]:   Trying 165.82.1.191...
2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: connected

2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: successfully set
certificate verify locations:

2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]:   CAfile: none
  CApath: /etc/ssl/certs

2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: SSLv3, TLS handshake,
Client hello (1):

2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: SSLv3, TLS alert, Server
hello (2):

2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: error:14077438:SSL
routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error

2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: Closing connection #0

2013-10-08 09:35:05 ERROR Shibboleth.AttributeResolver.Query [1]: exception
during SAML query to
https://vm-test-idp01.haverford.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery:
CURLSOAPTransport failed while contacting SOAP endpoint (
https://vm-test-idp01.haverford.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery):
error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal
error
2013-10-08 09:35:05 ERROR Shibboleth.AttributeResolver.Query [1]: unable to
obtain a SAML response from attribute authority
-----

I don't see any errors in the IdP log, and I am able to log into the
service. I can get info about my session from the SP, but when I go to do
the SAML logout I get an error because the back-channel isn't working. I
can see the flat files are getting created for the metadata and are getting
periodically refreshed. I will include below how I am exchanging my
metadata. I did spend some time looking in the mailing list archives and on
Google, but didn't find anything to help me. Any help someone can offer
into what I am doing wrong would be very much appreciated.

(On the SP)
-----
<MetadataProvider type="XML"
          uri="https://vm-test-idp01.haverford.edu/idp/profile/Metadata/SAML
"
          backingFilePath="vm-test-idp01_metadata.xml"
reloadInterval="7200">
        </MetadataProvider>
-----

(On the IdP)
-----
<metadata:MetadataProvider id="SP01MD"
            xsi:type="metadata:FileBackedHTTPMetadataProvider"
            metadataURL="
https://vm-test-sp01.haverford.edu/Shibboleth.sso/Metadata"
            backingFile="/opt/shibboleth-idp/metadata/vm-test-sp01.xml"/>
-----

-- 
Adam Portier
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131008/9a6e197e/attachment.html