Problems with back-channel connection

[Cantor, Scott]

On 10/8/13 10:34 AM, "Adam Portier" <aportier at haverford.edu> wrote:

>Thank you for your response. The logout I am trying to do is via the
>"Shibboleth.sso/Logout" in the default SP config. It is configure to do
>both a Local and SAML2 logout action. When it tries to do the SAML2
>logout action, that's when I see
> the error page and the connection attempt to the IdP back-channel. My
>point is that it looks like my back-channel communication isn't working
>at all (initial connection or anything afterward).

Well, that isn't what you posted a log trace of, that was an attribute
query. The mechanics would be the same in terms of the eventual problem
though.

>I am using Apache to proxy the HTTPS via an AJP connector on port 8009,
>using a guide I found online. However, I am letting Tomcat host 8443
>directly. Does that change anything about your suggestion?

If Tomcat is hosting 8443, and that's where the metadata is advertsing the
endpoint to be, then the issue is with the Java runtime's TLS
configuration and capability and its interoperability with the OpenSSL
version the SP is using.

-- Scott