Problems with IdP proxy

Yaowen Tu yaowen.tu at gmail.com
Tue Sep 17 21:19:22 EDT 2013 

Hi,

I am trying to set up an idp proxy following this link:
     https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering
.

The only difference is that I am not using Apache Proxy module, I am using
our own proxy to forward request. We have set the proxy to do session
stickiness.

1) I edited web.xml with:
<filter>
  <filter-name>IdPSessionFilter</filter-name>
  <filter-class
>edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter</filter-
class>
  <init-param>
    <param-name>ensureConsistentClientAddress</param-name>
    <param-value>false</param-value>
  </init-param>
</filter>

But it gives me following error:
 17:52:58.116 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:409]
- Message did not meet security requirements
org.opensaml.xml.security.SecurityException: SAML message intended
destination endpoint did not match recipient endpoint
    at
org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217)
~[opensaml-2.6.0.jar:na]
    at
org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72)
~[opensaml-2.6.0.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:389)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
[shibboleth-common-1.4.0.jar:na]
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
[servletContainer.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
[servletContainer.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[servletContainer.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
[servletContainer.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[servletContainer.jar:na]
    at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
[shibboleth-common-1.4.0.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
[servletContainer.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[servletContainer.jar:na]
    at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
[servletContainer.jar:na]
    at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
[servletContainer.jar:na]
    at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
[servletContainer.jar:na]
    at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
[servletContainer.jar:na]
    at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
[servletContainer.jar:na]
    at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
[servletContainer.jar:na]
    at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
[servletContainer.jar:na]
    at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
[servletContainer.jar:na]
    at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008)
[servletContainer.jar:na]
    at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
[servletContainer.jar:na]
    at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
[servletContainer.jar:na]
    at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895)
[na:1.6.0_45]
    at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918)
[na:1.6.0_45]
    at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]

2) I saw the exception came from SLF4JMDCCleanupFilter, so I just did the
same thing like:
<filter>
  <filter-name>SL4JCleanupFilter</filter-name>
  <filter-class
>edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter</filter-
class>
  <init-param>
    <param-name>ensureConsistentClientAddress</param-name>
    <param-value>false</param-value>
  </init-param>
</filter>
Note this is not in the wiki.

Then I saw this error which is different:
18:09:00.973 - ERROR
[org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML
message intended destination endpoint '
http://sma-pc1:8080/idp/profile/SAML2/POST/SSO' did not match the recipient
endpoint 'http://sma-pc1:8900/idp/profile/SAML2/POST/SSO'
18:09:00.981 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:409]
- Message did not meet security requirements
org.opensaml.xml.security.SecurityException: SAML message intended
destination endpoint did not match recipient endpoint
    at
org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217)
~[opensaml-2.6.0.jar:na]
    at
org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72)
~[opensaml-2.6.0.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:389)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
[shibboleth-common-1.4.0.jar:na]
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
[servletContainer.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
[servletContainer.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[servletContainer.jar:na]
    at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
[shibboleth-identityprovider-2.4.0.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
[servletContainer.jar:na]
    at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
[servletContainer.jar:na]
    at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
[servletContainer.jar:na]
    at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
[servletContainer.jar:na]
    at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
[servletContainer.jar:na]
    at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
[servletContainer.jar:na]
    at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
[servletContainer.jar:na]
    at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
[servletContainer.jar:na]
    at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
[servletContainer.jar:na]
    at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
[servletContainer.jar:na]
    at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008)
[servletContainer.jar:na]
    at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
[servletContainer.jar:na]
    at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
[servletContainer.jar:na]
    at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895)
[na:1.6.0_45]
    at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918)
[na:1.6.0_45]
    at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]

Looks like IdP is trying to match the URL in many places, is there a way to
disable the checking all together? It seems that following the wiki is not
enough. Is there anything I am missing?

Thanks,
Yaowen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130917/b0ceeeb7/attachment-0001.html

More information about the users mailing list