Problems with back-channel connection

[Adam Portier]

Thank you for the suggestion. I switched Tomcat over to use Sun 1.7 JDK,
and I can now see the initial back-channel communication completing
correctly when the SP is looking for attributes. I still get an error when
trying to log out (ERROR
[org.opensaml.ws.security.provider.MandatoryAuthenticatedMessageRule:37] -
Inbound message issuer was not authenticated), but I don't think that has
anything to do with the back-channel not being properly configured. If
anyone has any suggestions about this new problem, please chime in.
Otherwise I am going to work on this some more myself and maybe ask for
more help later if I get stuck.


On Tue, Oct 8, 2013 at 10:45 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 10/8/13 10:34 AM, "Adam Portier" <aportier at haverford.edu> wrote:
>
> >Thank you for your response. The logout I am trying to do is via the
> >"Shibboleth.sso/Logout" in the default SP config. It is configure to do
> >both a Local and SAML2 logout action. When it tries to do the SAML2
> >logout action, that's when I see
> > the error page and the connection attempt to the IdP back-channel. My
> >point is that it looks like my back-channel communication isn't working
> >at all (initial connection or anything afterward).
>
> Well, that isn't what you posted a log trace of, that was an attribute
> query. The mechanics would be the same in terms of the eventual problem
> though.
>
> >I am using Apache to proxy the HTTPS via an AJP connector on port 8009,
> >using a guide I found online. However, I am letting Tomcat host 8443
> >directly. Does that change anything about your suggestion?
>
> If Tomcat is hosting 8443, and that's where the metadata is advertsing the
> endpoint to be, then the issue is with the Java runtime's TLS
> configuration and capability and its interoperability with the OpenSSL
> version the SP is using.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Adam Portier
Linux Administrator
IITS Core Technologies
Haverford College
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131008/62101657/attachment.html