Error resolving principal name

[Morris, Andi]

I believe I have worked out the cause of the invalid transientId and I think it's down to the way I setup high-availability on our Shibboleth IdPs.

We are running a pair of identical IdPs. Same config, same metadata and internal certificates etc. These are then setup as a web farm on our TMG servers and published to the web via reverse proxy.  A separate pair of protocol publishing rules pointing 8443 to each individual server for the incoming 8443 requests is also setup. This seems to work with no issues at all, and I could drain and stop one shib server, make config changes, restart the tomcat service and bring it back online without any outage for the end user.

However, it appears that this was causing the described issue if a SAML1 attribute query came in to a different server than the authentication request originated from. Cookie-based session affinity within TMG was maintaining the same server for the auth requests, however the direct requests to the 8443 port were always hitting the same server as that rule sat higher in the list of firewall rules.

If f I disable all access to the secondary server by draining the web farm and disabling the 8443 publishing rule the SAML1 authentication is successful and attributes are passed. Likewise for draining the primary server.

At least, that's my slightly layman's way of deciphering what is happening.

For the time being I've disabled the secondary server and the associated reverse proxy 8443 rules, and all seems to be ok. I'll look resilience further from here.

Cheers,
Andi
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: 16 April 2015 13:51
To: 'Shib Users'
Subject: RE: Error resolving principal name

> Any ideas?

Well the first thing to check is that you really did issue that transientId.
If you didn't nothing on your side is broken.  If you did issue it then you need to chase up why it has become invalid.

/Rod


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
________________________________

[Cardiff Metropolitan University - 150 years of nurturing talent]<http://www.cardiffmet.ac.uk/cardiffmet150>