New Shibboleth daemon on new server - user/wayf page just reloads over and over

[Johnny Lasker]

Thank you for your feedback. I tried changing the SSO WAYF value in our
modern attempt, but I still get the 500 server error.  The best luck we've
had is by using something closer to our original configuration. It allows
us to get to the WAYF page, but still redirects back to itself.

Based on this page,
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO ,
it sounds like we need to use SSO to replace Session Initiator, but trying
it:
<SSO discoveryProtocol="SAMLDS"
discoveryURL="https://new.educause.edu/user/wayf">
  SAML2 SAML1
</SSO>



Or

<SSO discoveryProtocol="WAYF"
discoveryURL="https://new.educause.edu/user/wayf">
  SAML2 SAML1
</SSO>

Still gives us the same 500 error.

In the older version that is currently up, we use SessionInitiator like
this:

<SessionInitiator type="Chaining" Location="/DS" isDefault="true" id="DS"
acsByIndex="false" relayState="cookie">
                <SessionInitiator type="SAML2" acsByIndex="false"
acsIndex="1" template="bindingTemplate.html" />
                <SessionInitiator type="Shib1" acsIndex="5" />
                <SessionInitiator type="SAMLDS"
URL="https://new.educause.edu/user/wayf" />
            </SessionInitiator>



Is our SSO version missing something? Is there anything to change to the
older version (attached) that would make it work or do we absolutely have
to have a modern version to work with our 2.5.2 install?

Thank you for your help.

Johnny 




Johnny Lasker Programmer/Analyst

EDUCAUSE <http://www.educause.edu/>
Uncommon Thinking for the Common Good
282 Century Place, Suite 5000, Louisville, CO 80027
direct: 303.544.5677 | main: 303.449.4430 | educause.edu
<http://www.educause.edu/>





On 9/16/13 1:27 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 9/16/13 3:05 PM, "Johnny Lasker" <jlasker at educause.edu> wrote:
>
>>I'm following up on this post as I work with Ben. We made modifications
>>to
>>our config to 'modernize' it by swapping out SessionInitiator for SSO,
>>using just logout, and generally consolidating, but had no luck in
>>changing our outcome.
>
>It seems like the outcome completely changed because you didn't actually
>build a working config to test with yet.
>
>>I've attached our current shibboleth2.xml file if anyone has any thoughts
>>on what's off about it.
>
>There's nothing obviously wrong, I can't think of any way for it to behave
>that way.
>
>> I also attached our 'modern' version. When we load
>>try the modern version, we get a 500 error before reaching our WAYF page.
>
>An obvious error I see in it is that <SSO WAYF="SAMLDS"...
>is not valid, it's discoveryProtocol="SAMLDS", not WAYF="SAMLDS".
>
>I don't recall seeing a log trace on DEBUG of both log files when this
>happens.
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: shibboleth2.xml
Type: application/xml
Size: 7402 bytes
Desc: shibboleth2.xml
Url : http://shibboleth.net/pipermail/users/attachments/20130916/46d94570/attachment-0001.rdf