Error resolving principal name

[Dave Perry]

Andi

We are trying to deploy a v3 IdP behind forefront. Our admin is having issues making the port 8443 thing work at all.

He's installed the backchannel certificate onto the TMG server, and I've added it to Jetty (running the IdP) - but when he tries to add it to an HTTPS listener on port 8443 he gets a login error (using the Test button).

Could we contact you off list for pointers?


Thanks,
Dave
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Morris, Andi
Sent: 16 April 2015 16:19
To: 'Shib Users'
Subject: RE: Error resolving principal name

I believe I have worked out the cause of the invalid transientId and I think it's down to the way I setup high-availability on our Shibboleth IdPs.

We are running a pair of identical IdPs. Same config, same metadata and internal certificates etc. These are then setup as a web farm on our TMG servers and published to the web via reverse proxy.  A separate pair of protocol publishing rules pointing 8443 to each individual server for the incoming 8443 requests is also setup. This seems to work with no issues at all, and I could drain and stop one shib server, make config changes, restart the tomcat service and bring it back online without any outage for the end user.

However, it appears that this was causing the described issue if a SAML1 attribute query came in to a different server than the authentication request originated from. Cookie-based session affinity within TMG was maintaining the same server for the auth requests, however the direct requests to the 8443 port were always hitting the same server as that rule sat higher in the list of firewall rules.

If f I disable all access to the secondary server by draining the web farm and disabling the 8443 publishing rule the SAML1 authentication is successful and attributes are passed. Likewise for draining the primary server.

At least, that's my slightly layman's way of deciphering what is happening.

For the time being I've disabled the secondary server and the associated reverse proxy 8443 rules, and all seems to be ok. I'll look resilience further from here.

Cheers,
Andi
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: 16 April 2015 13:51
To: 'Shib Users'
Subject: RE: Error resolving principal name

> Any ideas?

Well the first thing to check is that you really did issue that transientId.
If you didn't nothing on your side is broken.  If you did issue it then you need to chase up why it has become invalid.

/Rod


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net ________________________________

[Cardiff Metropolitan University - 150 years of nurturing talent]<http://www.cardiffmet.ac.uk/cardiffmet150>
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT