Error Message with IdP "LoginContext key cookie was not present in request"

[Kevin Foote]

actually your attribute stack does look a little different on the two releases..  


PROD:

- INFO [Shibboleth-Audit:989] - 20140103T200048Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_ce588315b22a1c4396dedf130250871d|https://shib.lynda.com/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp.massey.ac.nz/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e6ca73607c0983f37ee0a94217d44df3|prynhart|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|eduPersonAffiliation,eduPersonPrincipalName,eduPersonPrimaryAffiliation,transientId,surname,eduPersonScopedAffiliation,givenName,eduPersonTargetedID,email,displayName,|_f378d3878bb5297463f6fb02dc1f4006||

TEST:

- INFO [Shibboleth-Audit:1028] - 20140103T202156Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_c0f11eb204560633df556b738e3a59ef|https://shib.lynda.com/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idp-test.massey.ac.nz/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_05daf5afbee2f1dfe4fc42257dd75ce5|prynhart|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|eduPersonAffiliation,eduPersonPrincipalName,transientId,surname,givenName,displayName,lynda.com_mail,|_1ff77810e126b236f4eacd0b73aaa226||

--------
thanks
 kevin.foote

On Jan 3, 2014, at 2:33 PM, Patrick Rynhart <P.Rynhart at massey.ac.nz> wrote:

> Hi,
> 
> We have two Shibboleth IdPs (a production and test instance) which is 
> federated with the same SP (Lynda.com).  Until recently, both have been 
> functioning correctly.  However, within the last few days, our 
> production IdP instance fails when attempting to log into this SP. 
> After turning up the log level to DEBUG, the error message "LoginContext 
> key cookie was not present in request" is found in the logs (just after 
> the POST).  Other SPs that our Prod IdP is federated with aren't 
> affected.  We've also tried different browser sessions and user 
> combinations.
> 
> I provide DEBUG logs during a login attempt for both the Production (not 
> working with Lynda.com) IdP and the Test (working with Lynda.com) IdPs. 
>  The version of Shibboleth used in Prod is 2.3 while that in Test is 
> 2.4 - but they are configured similarly.  I am posting both versions for 
> comparison because the bulk of the logs are similar and I can't spot any 
> (obvious) differences as to one should fail while the other succeed.
> 
> Production IdP (idp.massey.ac.nz) - Not Working with Lynda.com:
> http://www.massey.ac.nz/~prynhart/downloads/LyndaCom_Login_Error_20140104.txt
> 
> Test IdP (idp-test.massey.ac.nz) - Working With Lynda.com:
> http://www.massey.ac.nz/~prynhart/downloads/LyndaCom_Login_Error_20140104_via_TestIdP.txt
> 
> If someone could please help me troubleshoot this issue it would be most 
> appreciated.  The reason for the "break" isn't known - in particular 
> there haven't been any (known) configuration changes at either end.
> 
> With Thanks,
> 
> Patrick
> 
> -- 
> Patrick Rynhart
> Systems Engineer
> Infrastructure Support Section
> Information Technology Services
> Massey University
> Palmerston North
> New Zealand
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net