No conversation state found

Andrew Morgan morgan at orst.edu
Tue Dec 15 19:18:59 EST 2015 

We are testing our upgrade to IDP v3.2.0, trying to make sure all of our 
local mods are in place.  I tried something our users frequently do - 
bookmark our login page.

We are using the RemoteUser auth handler to delegate IDP authentication to 
Jasig CAS.  The bookmarked login page URL is:

   https://login.oregonstate.edu/cas-dev/login?service=https%3A%2F%2Flogin.oregonstate.edu%2Fidp-dev%2FAuthn%2FRemoteUser%3Fconversation%3De1s1

When I delete all my browser cookies, go to this URL, and authenticate, I 
am redirected to:

   https://login.oregonstate.edu/idp-dev/Authn/RemoteUser;jsessionid=67404FFE18ACB6DE59DF45B86516DFFE?conversation=e1s1

Instead of getting a pretty error page, I get a stack trace in the 
browser:

HTTP Status 500 - Error processing external authentication request

type Exception report

message Error processing external authentication request

description The server encountered an internal error that prevented it from fulfilling this request.

exception

javax.servlet.ServletException: Error processing external authentication request
 	net.shibboleth.idp.authn.impl.RemoteUserAuthServlet.service(RemoteUserAuthServlet.java:303)
 	javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
 	org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
 	net.shibboleth.idp.log.SLF4JMDCServletFilter.doFilter(SLF4JMDCServletFilter.java:72)
 	net.shibboleth.utilities.java.support.net.RequestResponseContextFilter.doFilter(RequestResponseContextFilter.java:60)
 	org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
 	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
 	org.jasig.cas.client.util.HttpServletRequestWrapperFilter.doFilter(HttpServletRequestWrapperFilter.java:70)
 	org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:238)
 	org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:152)

root cause

net.shibboleth.idp.authn.ExternalAuthenticationException: No conversation state found in session for key (e1s1)
 	net.shibboleth.idp.authn.ExternalAuthentication.startExternalAuthentication(ExternalAuthentication.java:132)
 	net.shibboleth.idp.authn.impl.RemoteUserAuthServlet.service(RemoteUserAuthServlet.java:211)
 	javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
 	org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
 	net.shibboleth.idp.log.SLF4JMDCServletFilter.doFilter(SLF4JMDCServletFilter.java:72)
 	net.shibboleth.utilities.java.support.net.RequestResponseContextFilter.doFilter(RequestResponseContextFilter.java:60)
 	org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
 	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
 	org.jasig.cas.client.util.HttpServletRequestWrapperFilter.doFilter(HttpServletRequestWrapperFilter.java:70)
 	org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:238)
 	org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:152)

note The full stack trace of the root cause is available in the Apache Tomcat/8.0.26 logs.



Here is the stack trace from catalina.out:

Dec 15, 2015 3:41:58 PM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet [RemoteUserAuthHandler] in context with path [/idp-dev] threw exception [Error processing external authentication request] with root cause
net.shibboleth.idp.authn.ExternalAuthenticationException: No conversation state found in session for key (e1s1)
         at net.shibboleth.idp.authn.ExternalAuthentication.startExternalAuthentication(ExternalAuthentication.java:132)
         at net.shibboleth.idp.authn.impl.RemoteUserAuthServlet.service(RemoteUserAuthServlet.java:211)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at net.shibboleth.idp.log.SLF4JMDCServletFilter.doFilter(SLF4JMDCServletFilter.java:72)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at net.shibboleth.utilities.java.support.net.RequestResponseContextFilter.doFilter(RequestResponseContextFilter.java:60)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
         at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at org.jasig.cas.client.util.HttpServletRequestWrapperFilter.doFilter(HttpServletRequestWrapperFilter.java:70)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:238)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at org.jasig.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:152)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
         at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:203)
         at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
         at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)
         at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)
         at com.googlecode.psiprobe.Tomcat80AgentValve.invoke(Tomcat80AgentValve.java:41)
         at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
         at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616)
         at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
         at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:518)
         at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:844)
         at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:673)
         at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2503)
         at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2492)
         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
         at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
         at java.lang.Thread.run(Thread.java:745)


Why isn't this error trapped and managed by a pretty error page?  Is there 
a way to do that?

I think this is a common error condition our users will see, but please 
correct me if I'm wrong!

Thanks,
 	Andy

More information about the users mailing list