Intermittent login issues, missing attributes

[John Kamminga]

Hello, I have 1 service provider that is having intermittent login problems. I've noticed the problem myself when testing the App the first time I try and login I get an authentication error, then if I clear my cache and login again it works. When I check the Shib log files I see that the attributes aren't being released every time.
Here is what I see in my log files:

Error Login:
10:32:23.022 - INFO [Shibboleth-Access:73] - 20150413T173223Z|169.236.250.61|shib.ucmerced.edu:443|/profile/Shibboleth/SSO|
10:32:23.126 - INFO [Shibboleth-Audit:745] - 20150413T173223Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||https://ermsp.ucop.edu|urn:mace:shibboleth:2.0:profiles:saml1:sso|urn:mace:incommon:ucmerced.edu|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_hexValue|jkamminga|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_hexValue|_hexValue,|
10:32:23.531 - INFO [Shibboleth-Access:73] - 20150413T173223Z|132.249.219.62|shib.ucmerced.edu:8443|/profile/SAML1/SOAP/AttributeQuery|
10:32:23.810 - INFO [Shibboleth-Access:73] - 20150413T173223Z|10.30.41.144|shib.ucmerced.edu:443|/profile/SAML2/Redirect/SSO|

Successful Login:
11:08:34.481 - INFO [Shibboleth-Access:73] - 20150413T180834Z|132.249.219.62|shib.ucmerced.edu:8443|/profile/SAML1/SOAP/AttributeQuery|
11:08:34.482 - INFO [org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:100] - SAML protocol message was not signed, skipping XML signature processing
11:08:34.483 - INFO [org.opensaml.ws.security.provider.ClientCertAuthRule:153] - Authentication via client certificate succeeded for context presenter entity ID: https://ermsp.ucop.edu
11:08:34.588 - INFO [Shibboleth-Audit:745] - 20150413T180834Z|urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding|_hexValue|https://ermsp.ucop.edu|urn:mace:shibboleth:2.0:profiles:saml1:query:attribute|urn:mace:incommon:ucmerced.edu|urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding|_ hexValue |jkamminga||eduPersonPrincipalName,surname,givenName,commonName,UCNetId,transientId,email,displayName,|_ hexValue|_ hexValue,|

What are some things that would cause the IdP to release attributes to a Service Provider one time but not another?
I apologize for such a vague question, but where do you think would be a good place to start debugging would be?


I'm running Shibboleth IdP 2.4.2

Please let me know if you need any more information or if you would like to see more of the log file.

Thanks,
John Kamminga
Web Application Development
Information Technology Department
University of California, Merced
T: 209.228.2965<tel:209.228.2965>
E: jkamminga at ucmerced.edu<mailto:jkamminga at ucmerced.edu>
W: it.ucmerced.edu<http://it.ucmerced.edu/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150413/82c08204/attachment.html