IDPv3 and ECP

Fri Nov 6 09:50:14 EST 2015

Ok, I found this old thread out here about using the testecp.sh from Jim Basney at NSCA
to verify my ECP configuration in IDP 3. I'm getting the same SOAP parsing error as mentioned 
here. Was there any resolution for this ? I didn't find one in my searching ?

Thanks,

Robert
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Edwards, Wendy A [wedwards at illinois.edu]
Sent: Monday, April 13, 2015 3:15 PM
To: Shib Users
Subject: Re: IDPv3 and ECP

Thanks, Scott.

We¹re actually using Apache Tomcat, not Jetty.  The error message when I
run the script is Error: "Unable to log in to IdP
'https://shibber.ncsa.illinois.edu/idp/profile/SAML2/SOAP/ECP' at ecp.pl
line 641."  We¹re also using AJP with Apache and we have this line in the
proxy_ajp.conf file, which seems to forward requests to the IDP
successfully.

ProxyPass /idp/ ajp://localhost:8009/idp/

Below are some excerpts from the shib logs.  It looks like whatever is
coming back doesn¹t make sense to the XML parser (seems like this might be
the case with a SOAP error).

idp-process.log:

2015-04-13 14:05:09,765 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver
:306] - Next refresh cycle for metadata provider
'http://www.testshib.org/metadata/testshib-providers.xml' will occur on
'2015-04-13T22:05:09.725Z' ('2015-04-13T17:05:09.725-05:00' local time)
2015-04-13 14:19:56,946 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 14:34:56,947 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 14:49:56,948 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 14:51:10,921 - ERROR
[net.shibboleth.utilities.java.support.xml.BasicParserPool:50] - XML
Parsing Error
org.xml.sax.SAXParseException: Premature end of file.
        at
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,944 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDec
oder:151] - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse inputstream, it contained invalid XML
        at
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
        at
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,946 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling message from input stream
        at
org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDeco
der.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:152)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable to parse inputstream, it contained invalid XML
        at
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
        at
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,974 - INFO [Shibboleth-Audit.SSO:241] -
20150413T195110Z||||http://shibboleth.net/ns/profiles/saml2/sso/ecp||||||||
2015-04-13 14:52:06,599 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDec
oder:151] - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse inputstream, it contained invalid XML
        at
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
        at
com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:2
57)
2015-04-13 14:52:06,605 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling message from input stream
        at
org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDeco
der.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:152)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable to parse inputstream, it contained invalid XML
        at
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
        at
com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:2
57)
2015-04-13 14:52:06,622 - INFO [Shibboleth-Audit.SSO:241] -
20150413T195206Z||||http://shibboleth.net/ns/profiles/saml2/sso/ecp||||||||
2015-04-13 15:04:56,950 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 15:19:56,960 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 15:34:56,951 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1
2015-04-13 15:49:56,971 - INFO
[net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:32
7] - Default key version has not changed, still secret1

>From idp-warn.log:
2015-04-13 14:51:10,921 - ERROR
[net.shibboleth.utilities.java.support.xml.Basic
ParserPool:50] - XML Parsing Error
org.xml.sax.SAXParseException: Premature end of file.
        at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAX
ParseException(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,944 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttp
ServletRequestXMLMessageDecoder:151] - Error unmarshalling message from
input st
ream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse in
putstream, it contained invalid XML
        at net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(Basic
ParserPool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
        at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAX
ParseException(ErrorHandlerWrapper.java:203)
2015-04-13 14:51:10,946 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:
73] - Profile Action DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling mes
sage from input stream
        at org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessa
geDecoder.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:15
2)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable
to parse inputstream, it contained invalid XML
        at
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
        at
com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseE
xception(ErrorHandlerWrapper.java:203)
2015-04-13 14:52:06,599 - ERROR
[org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDec
oder:151] - Error unmarshalling message from input stream
net.shibboleth.utilities.java.support.xml.XMLParserException: Unable to
parse inputstream, it contained invalid XML
        at
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
        at
com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:2
57)
2015-04-13 14:52:06,605 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: Error
unmarshalling message from input stream
        at
org.opensaml.messaging.decoder.servlet.BaseHttpServletRequestXMLMessageDeco
der.unmarshallMessage(BaseHttpServletRequestXMLMessageDecoder.java:152)
Caused by: net.shibboleth.utilities.java.support.xml.XMLParserException:
Unable to parse inputstream, it contained invalid XML
        at
net.shibboleth.utilities.java.support.xml.BasicParserPool.parse(BasicParser
Pool.java:240)
Caused by: org.xml.sax.SAXParseException: Premature end of file.
        at
com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:2
57)

On 4/13/15, 3:49 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 4/13/15, 4:39 PM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:
>>
>>At this point, I¹m just trying to get my IDP v 3 to work successfully
>>with
>>the scripts at http://www.cilogon.org/ecp (testecp.sh and ecp.pl) so I¹m
>>not trying to implement a client.
>
>Those are the clients then. I didn't know what you were trying to run.
>But those clients don't do SPNEGO unless the libcurl command is
>manipulated to do it, I guess.
>
>>It sounds like implementing ECP in IDP v3 is supposed to be simpler than
>>in IDP v2, but I¹m a little confused about what specific steps need to be
>>taken.  Is there something I missed?
>
>No. REMOTE_USER isn't set, I guess. You didn't give me any log trace to
>work from, but I would imagine that's what's happening.
>
>-- Scott
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net