IDPv3 and ECP

Mon Apr 13 17:15:42 EDT 2015

Thanks, Scott.

We¹re actually using Apache Tomcat, not Jetty.  The error message when I
run the script is Error: "Unable to log in to IdP
'https://shibber.ncsa.illinois.edu/idp/profile/SAML2/SOAP/ECP' at ecp.pl
line 641."  We¹re also using AJP with Apache and we have this line in the
proxy_ajp.conf file, which seems to forward requests to the IDP
successfully.

ProxyPass /idp/ ajp://localhost:8009/idp/

Below are some excerpts from the shib logs.  It looks like whatever is
coming back doesn¹t make sense to the XML parser (seems like this might be
the case with a SOAP error).

idp-process.log:

2015-04-13 14:05:09,765 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver
:306] - Next refresh cycle for metadata provider
'http://www.testshib.org/metadata/testshib-providers.xml' will occur on
'2015-04-13T22:05:09.725Z' ('2015-04-13T17:05:09.725-05:00' local time)
2015-04-13 14:19:56,946 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 14:34:56,947 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 14:49:56,948 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 14:51:10,921 - ERROR
[net.shibboleth.utilities.java.support.xml.BasicParserPool:50] - XML
Parsing Error
org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,944 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDec
oder:151] - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,946 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling message from input stream
	at 
org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDeco
der.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:152)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable to parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,974 - INFO [Shibboleth-Audit.SSO:241] -
20150413T195110Z||||http://shibboleth.net/ns/profiles/saml2/sso/ecp||||||||
2015-04-13 14:52:06,599 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDec
oder:151] - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:2
57)
2015-04-13 14:52:06,605 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling message from input stream
	at 
org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDeco
der.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:152)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable to parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:2
57)
2015-04-13 14:52:06,622 - INFO [Shibboleth-Audit.SSO:241] -
20150413T195206Z||||http://shibboleth.net/ns/profiles/saml2/sso/ecp||||||||
2015-04-13 15:04:56,950 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 15:19:56,960 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 15:34:56,951 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 15:49:56,971 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1

>From idp-warn.log:
2015-04-13 14:51:10,921 - ERROR
[net.shibboleth.utilities.java.support.xml.Basic
ParserPool:50] - XML Parsing Error
org.xml.sax.SAXParseException: Premature end of file.
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAX
ParseException(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,944 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttp
ServletRequestXMLMessageDecoder:151] - Error unmarshalling message from
input st
ream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse in
putstream, it contained invalid XML
	at net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(Basic
ParserPool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAX
ParseException(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,946 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:
73] - Profile Action DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling mes
sage from input stream
	at org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessa
geDecoder.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:15
2)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable 
to parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-13 14:52:06,599 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDec
oder:151] - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:2
57)
2015-04-13 14:52:06,605 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling message from input stream
	at 
org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDeco
der.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:152)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable to parse inputstream, it contained invalid XML
	at 
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
	at 
com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:2
57)

On 4/13/15, 3:49 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 4/13/15, 4:39 PM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:
>>
>>At this point, I¹m just trying to get my IDP v 3 to work successfully
>>with
>>the scripts at http://www.cilogon.org/ecp (testecp.sh and ecp.pl) so I¹m
>>not trying to implement a client.
>
>Those are the clients then. I didn't know what you were trying to run.
>But those clients don't do SPNEGO unless the libcurl command is
>manipulated to do it, I guess.
>
>>It sounds like implementing ECP in IDP v3 is supposed to be simpler than
>>in IDP v2, but I¹m a little confused about what specific steps need to be
>>taken.  Is there something I missed?
>
>No. REMOTE_USER isn't set, I guess. You didn't give me any log trace to
>work from, but I would imagine that's what's happening.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net