IdPv3 Issues with non-closed browsers

Wed Sep 16 06:04:10 EDT 2015

Dear Scott,

So I ran in DEBUG for a while on the live server, this is the tail end of the debug messages from a login from myself that hung with no response:

2015-09-16 09:23:18,372 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.WriteProfileInterceptorResultToStorage:68] - Profile Action WriteProfileInterceptorResultToStorage: No results available from interceptor context, nothing to store
2015-09-16 09:23:18,373 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.FilterFlowsByNonBrowserSupport:52] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2015-09-16 09:23:18,374 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:65] - Profile Action SelectProfileInterceptorFlow: Moving completed flow intercept/security-policy/saml2-sso to completed set, selecting next one
2015-09-16 09:23:18,374 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:80] - Profile Action SelectProfileInterceptorFlow: No flows available to choose from
2015-09-16 09:23:18,375 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext:149] - Profile Action InitializeOutboundMessageContext: Initialized outbound message context
2015-09-16 09:23:18,377 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:367] - Profile Action PopulateBindingAndEndpointContexts: Attempting to resolve endpoint of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService for out
bound message
2015-09-16 09:23:18,377 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:505] - Profile Action PopulateBindingAndEndpointContexts: Populating template endpoint for resolution from SAML AuthnRequest
2015-09-16 09:23:18,378 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:409] - Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint at location https://www.structuralbiology.eu/Shibboleth.sso/SAML2/POST using binding urn:oa
sis:names:tc:SAML:2.0:bindings:HTTP-POST
2015-09-16 09:23:18,382 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:304] - Profile Action PopulateEncryptionParameters: Encryption for assertions (true), identifiers (false), attributes(false)
2015-09-16 09:23:18,382 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:314] - Profile Action PopulateEncryptionParameters: Resolving EncryptionParameters for request
2015-09-16 09:23:18,383 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:376] - Profile Action PopulateEncryptionParameters: Adding entityID to resolution criteria
2015-09-16 09:23:18,383 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:387] - Profile Action PopulateEncryptionParameters: Adding role metadata to resolution criteria
2015-09-16 09:23:18,384 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:330] - Profile Action PopulateEncryptionParameters: Resolved EncryptionParameters
2015-09-16 09:23:18,391 - DEBUG [net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:144] - Profile Action ExtractSubjectFromRequest: No Subject NameID or NameIdentifier in message
2015-09-16 09:23:18,393 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:101] - Profile Action InitializeAuthenticationContext: Created authentication context AuthenticationContext{initiationInstant=2015-09-16T09:23:18.393+01:00, isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, resultCacheable=true, completionInstant=1970-01-01T01:00:00.000+01:00}
2015-09-16 09:23:18,394 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:111] - Profile Action InitializeRequestedPrincipalContext: Profile configuration does not include any default authentication methods
2015-09-16 09:23:18,395 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:114] - Profile Action ProcessRequestedAuthnContext: AuthnRequest did not contain a RequestedAuthnContext, nothing to do
2015-09-16 09:23:18,397 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:125] - Profile Action PopulateAuthenticationContext: Installing custom PrincipalEvalPredicateFactoryRegistry into AuthenticationContext
2015-09-16 09:23:18,398 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:158] - Profile Action PopulateAuthenticationContext: Installed 1 authentication flows into AuthenticationContext
2015-09-16 09:23:18,399 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:675] - Performing primary lookup on session ID 93747d3da55494aab0ff8d55cfeee6c56b32d8be52c419c747f27badb4b714b0
2015-09-16 09:23:18,400 - INFO [net.shibboleth.utilities.java.support.security.DataSealer:216] - Unwrapped data has expired
2015-09-16 09:23:18,401 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:683] - Primary lookup failed for session ID 93747d3da55494aab0ff8d55cfeee6c56b32d8be52c419c747f27badb4b714b0
2015-09-16 09:23:18,402 - DEBUG [net.shibboleth.idp.session.impl.PopulateSessionContext:131] - Profile Action PopulateSessionContext: No session found for client
2015-09-16 09:23:18,403 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
2015-09-16 09:23:18,404 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByPassivity:53] - Profile Action FilterFlowsByPassivity: Request does not have passive requirement, nothing to do
2015-09-16 09:23:18,405 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2015-09-16 09:23:18,406 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:241] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2015-09-16 09:23:18,407 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:267] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
2015-09-16 09:23:18,407 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:309] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/Password
2015-09-16 09:23:18,409 - DEBUG [net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth:115] - Profile Action ExtractUsernamePasswordFromBasicAuth: No appropriate Authorization header found
2015-09-16 09:23:18,428 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:360] - Found matching scheme, returning name of 'www.structuralbiology.eu'

I can't see anything with my untrained eye as to what might be going wrong, possibly you may have more insight? Thanks for your help here!

Regards,

Callum Smith
Instruct & Strubi Web Developer
University of Oxford
e. callum at strubi.ox.ac.uk
p. +44 (0)1865 2 87782

> On 15 Sep 2015, at 14:41, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 9/15/15, 7:11 AM, "users on behalf of Callum Smith" <users-bounces at shibboleth.net on behalf of callum at strubi.ox.ac.uk> wrote:
> 
>> Running latest IdP v3.1.2 on Tomcat 8.
>> Service sits behind reverse proxy over ajp
>> OpenJDK 1.7.0_85 on CentOS 5.11
>> No errors in the logs.
> 
> I don't know how to diagnose it if there's no error. The container's not logging anything?
> 
>> The server does run memcached with a paired node, both nodes have the IdP setup and running, with the second server set up as a hot swap by the front-end reverse proxy. This feels like the potential cause of issues, should I be looking to change the shibboleth storage engine to something on the disk?
> 
> Don't have any familiarity with memcache. My advice is always to use client side sessions, not server-side state. Unless you absolutely have to have it, there's no advantage to it.
> 
> Since nobody has reported anything like that with the default configuration, I would tend to assume it's storage related.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150916/b512b22d/attachment-0001.html>