Global Logout issues with 2-way SSL

[federator]

Sorry for bringing up the SLO question again.  But here is the situation 
we encountered:

We configured the IdP (version 2.4) with 2-way SSL (using client cert) 
for user authentication, and using HTTP-POST for SLO.   The SP was able 
to send out a global logout message signed by SP's cert.  But the IdP 
couldn't process the logout message.   An OpenSAML exception is thrown 
(org.opensaml.ws.security.SecurityPolicyException: Client certificate 
authentication failed for context presenter entity ID), indicating that 
the client cert doesn't much the policy rule.

After turn on the debugger for OpenSAML and carefully examining the log 
messages, we discovered that the IdP is trying to use the user's cert 
(of the user who is currently logged in), instead of using the SP's cert 
to validate the logout message:

10:01:36.125 - ERROR 
[org.opensaml.ws.security.provider.ClientCertAuthRule:157] - 
Authentication via client certificate failed for context presenter 
entity ID samlsp2.identia.net
10:01:36.127 - WARN 
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:543] 
- Message did not meet security requirements

There is no way the SP is able to obtain the client's cert. The question 
is, is there anyway to define the OpenSAML security policy rule to use 
SP's cert instead of the user cert to process the global logout 
message?  Where is the configuration file that defines the OpenSAML's 
ClientCertAuthRule or how to define the rule declaratively? The complete 
logfile is attached below.

Thanks a lot for your help!

Nick
------------------ IdP Log ---------------------

10:01:36.087 - INFO [Shibboleth-Access:73] - 
20141218T150136Z|127.0.0.1|samlidp.identia.net:4443|/profile/SAML2/POST/SLO|
10:01:36.090 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] 
- shibboleth.HandlerManager: Looking up profile handler for request 
path: /SAML2/POST/SLO
10:01:36.090 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] 
- shibboleth.HandlerManager: Located profile handler of the following 
type for the request path: 
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler
10:01:36.090 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:154] 
- Processing incoming SAML LogoutRequest
10:01:36.090 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:502] 
- Decoding message with decoder binding 
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
10:01:36.094 - DEBUG 
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] 
- Looking up relying party configuration for samlsp2.identia.net
10:01:36.094 - DEBUG 
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:130] 
- Custom relying party configuration found for samlsp2.identia.net
10:01:36.099 - DEBUG 
[org.opensaml.ws.security.provider.ClientCertAuthRule:117] - Attempting 
to authenticate inbound connection that presented the certificate:
10:01:36.099 - DEBUG 
[org.opensaml.ws.security.provider.ClientCertAuthRule:118] - 
MIICsDCCAhmgAwIBAgIJAJ7zLcNStflOMA0GCSqGSIb3DQEBBQUAMFMxCzAJBgNVBAYTAlVTMRgw
... (this is the user's certificate)
u7f6xuGkoHo=
10:01:36.100 - DEBUG 
[org.opensaml.ws.security.provider.ClientCertAuthRule:150] - Attempting 
client certificate authentication using context presenter entity ID: 
samlsp2.identia.net
....
10:01:36.123 - DEBUG 
[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:531] 
- Attempting to retrieve PKIX validation info from cache using index: 
[samlsp2.identia.net,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING]
....
10:01:36.124 - DEBUG 
[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:634] 
- Added new PKIX info to entity cache with key: 
[samlsp2.identia.net,{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor,urn:oasis:names:tc:SAML:2.0:protocol,SIGNING]
10:01:36.125 - DEBUG 
[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:637] 
- Write lock over cache released
10:01:36.125 - ERROR 
[org.opensaml.ws.security.provider.ClientCertAuthRule:157] - 
Authentication via client certificate failed for context presenter 
entity ID samlsp2.identia.net
10:01:36.127 - WARN 
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler:543] 
- Message did not meet security requirements
org.opensaml.ws.security.SecurityPolicyException: Client certificate 
authentication failed for context presenter entity ID
at 
org.opensaml.ws.security.provider.ClientCertAuthRule.doEvaluate(ClientCertAuthRule.java:159) 
~[openws-1.5.1.jar:na]
at 
org.opensaml.ws.security.provider.ClientCertAuthRule.evaluate(ClientCertAuthRule.java:123) 
~[openws-1.5.1.jar:na]
at 
org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51) 
~[openws-1.5.1.jar:na]
at 
org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132) 
~[openws-1.5.1.jar:na]
at 
org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83) 
~[openws-1.5.1.jar:na]
at 
org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) 
~[opensaml-2.6.1.jar:na]
at 
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.decodeRequest(SLOProfileHandler.java:515) 
[shibboleth-identityprovider-2.4.0.jar:na]
at 
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processLogoutRequest(SLOProfileHandler.java:240) 
[shibboleth-identityprovider-2.4.0.jar:na]
at 
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processRequest(SLOProfileHandler.java:155) 
[shibboleth-identityprovider-2.4.0.jar:na]
at 
edu.internet2.middleware.shibboleth.idp.profile.saml2.SLOProfileHandler.processRequest(SLOProfileHandler.java:1) 
[shibboleth-identityprovider-2.4.0.jar:na]
at 
edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) 
[shibboleth-common-1.4.0.jar:na]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) 
[servlet-api.jar:na]
at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) 
[catalina.jar:7.0.54]
...

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141218/fa6ae2c0/attachment-0001.html