New Shibboleth daemon on new server - user/wayf page just reloads over and over

[Ben Turner]

Hi Scott

Thank you so much for your reviewing our issue.  Originally we were using 2.5.2 however our current production system was running 2.3.1 successfully so when we encountered so many challenges we attempted to use the exact version and configuration as we were using on our other system (less the unique setup of new.educause.edu as a SP).

So I have made the adjustment you suggested with the version of the shibd service.  We're now running 2.5.2 again and the double ampersand has been corrected.  Unfortunately we're still seeing the same behavior and we're still not seeing anything indicating an issue in the various log files.
'
Interestingly enough though, now when I restart the daemon service there isn't an incommon.xml file created as it was generating it successfully when we were using 2.3.1.  Maybe that has some significance?

Is there any other ideas that you might have that I can investigate?  I have log output but I am not clear on what output might be the most helpful in diagnosing this since the log file output hasn't changed in so much as its not showing anything other than INFO and DEBUG lines that only indicate successful startup and attribute configurations.

Ben



________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Thursday, September 12, 2013 10:23 AM
To: Shib Users
Subject: Re: New Shibboleth daemon on new server - user/wayf page just  reloads over and over

FWIW, I just tried manually injecting a query string of similar form into
an SP and it worked, so I'm not sure why yours doesn't.

I will note however that you said, and I dearly hope you mispoke, that
you're running 2.3.1, which is:

a) ancient
b) unsupported
c) completely insecure

So, I suppose if that's true, I'd suggest you upgrade to a supported
version if you can't figure out what's causing the extra ampersand. It may
be something changed in the code that would work around the issue since
I'm not seeing it fail.

What's very odd is that to have to request the DS again, it isn't seeing
the SAMLDS=1 parameter either. If the code saw that, it would fail instead
of looping back. It isn't meant to be doing that.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net