Problems with IdP proxy

Yaowen Tu yaowen.tu at gmail.com
Tue Sep 17 21:26:21 EDT 2013 

Looking at the last exception again, it seems coming from IdPNoCacheFilter.
It seems that I need to do the same thing for IdPNoCacheFilter like I did
for IdPSessionFilter and SL4JCleanupFilter to disable the check. I don't
have the environment. I will try it tomorrow and see it the request goes
through.

I would be appreciated if anyone has had the same issue before could let me
know the solution.

Anyways, wiki needs to be updated since changing setting for
IdPSessionFilter only doesn't seems to be enough. Please let me know if I
am wrong.

Thanks,
Yaowen

Yaowen


On Tue, Sep 17, 2013 at 6:19 PM, Yaowen Tu <yaowen.tu at gmail.com> wrote:

> Hi,
>
> I am trying to set up an idp proxy following this link:
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering.
>
> The only difference is that I am not using Apache Proxy module, I am using
> our own proxy to forward request. We have set the proxy to do session
> stickiness.
>
> 1) I edited web.xml with:
> <filter>
>   <filter-name>IdPSessionFilter</filter-name>
>   <filter-class
> >edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter</filter-
> class>
>   <init-param>
>     <param-name>ensureConsistentClientAddress</param-name>
>     <param-value>false</param-value>
>   </init-param>
> </filter>
>
> But it gives me following error:
>  17:52:58.116 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:409]
> - Message did not meet security requirements
> org.opensaml.xml.security.SecurityException: SAML message intended
> destination endpoint did not match recipient endpoint
>     at
> org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217)
> ~[opensaml-2.6.0.jar:na]
>     at
> org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72)
> ~[opensaml-2.6.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:389)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
> [shibboleth-common-1.4.0.jar:na]
>     at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [servletContainer.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [servletContainer.jar:na]
>     at
> edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
> [shibboleth-common-1.4.0.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
> [servletContainer.jar:na]
>     at
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008)
> [servletContainer.jar:na]
>     at
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
> [servletContainer.jar:na]
>     at
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
> [servletContainer.jar:na]
>     at
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895)
> [na:1.6.0_45]
>     at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918)
> [na:1.6.0_45]
>     at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]
>
> 2) I saw the exception came from SLF4JMDCCleanupFilter, so I just did the
> same thing like:
> <filter>
>   <filter-name>SL4JCleanupFilter</filter-name>
>   <filter-class
> >edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter</filter-
> class>
>   <init-param>
>     <param-name>ensureConsistentClientAddress</param-name>
>     <param-value>false</param-value>
>   </init-param>
> </filter>
> Note this is not in the wiki.
>
> Then I saw this error which is different:
> 18:09:00.973 - ERROR
> [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML
> message intended destination endpoint '
> http://sma-pc1:8080/idp/profile/SAML2/POST/SSO' did not match the
> recipient endpoint 'http://sma-pc1:8900/idp/profile/SAML2/POST/SSO'
> 18:09:00.981 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:409]
> - Message did not meet security requirements
> org.opensaml.xml.security.SecurityException: SAML message intended
> destination endpoint did not match recipient endpoint
>     at
> org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217)
> ~[opensaml-2.6.0.jar:na]
>     at
> org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72)
> ~[opensaml-2.6.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:389)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
> [shibboleth-common-1.4.0.jar:na]
>     at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [servletContainer.jar:na]
>     at
> edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
> [shibboleth-identityprovider-2.4.0.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
> [servletContainer.jar:na]
>     at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
> [servletContainer.jar:na]
>     at
> org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008)
> [servletContainer.jar:na]
>     at
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
> [servletContainer.jar:na]
>     at
> org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
> [servletContainer.jar:na]
>     at
> java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895)
> [na:1.6.0_45]
>     at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918)
> [na:1.6.0_45]
>     at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]
>
> Looks like IdP is trying to match the URL in many places, is there a way
> to disable the checking all together? It seems that following the wiki is
> not enough. Is there anything I am missing?
>
> Thanks,
> Yaowen
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130917/b3b312d9/attachment.html

More information about the users mailing list