sp trying to contact the idp directly

[Jeremy Shapiro]

In my organization we have a set of machines running apache2 and
shibboleth-sp.  These machines are behind a firewall and cannot connect
directly to the idp.

On newly authenticated requests the shibd daemon is trying to contact the
IdP directly.  What in my config could be causing this?  All of our
attributes should be resolved in the response from the idp to the sp.

2015-09-22 19:02:58 DEBUG Shibboleth.SSO.SAML2 [1]: extracting pushed
attributes...

2015-09-22 19:02:58 DEBUG Shibboleth.AttributeExtractor.XML [1]: unable to
extract attributes, unknown XML object type: saml2p:Response

2015-09-22 19:02:58 DEBUG Shibboleth.AttributeDecoder.NameID [1]: decoding
NameIDAttribute (persistent-id) from SAML 2 NameID with Format
(urn:oasis:names:tc:SAML:2.0:nameid-format:persistent)

2015-09-22 19:02:58 DEBUG Shibboleth.AttributeExtractor.XML [1]: unable to
extract attributes, unknown XML object type: saml2:AuthnStatement

2015-09-22 19:02:58 DEBUG Shibboleth.AttributeFilter [1]: filtering 1
attribute(s) from (https://idp.xyz.com/idp/shibboleth)

2015-09-22 19:02:58 DEBUG Shibboleth.AttributeFilter [1]: applying
filtering rule(s) for attribute (persistent-id) from (
https://idp.xyz.com/idp/shibboleth)

2015-09-22 19:02:58 DEBUG Shibboleth.SSO.SAML2 [1]: resolving attributes...

2015-09-22 19:02:58 DEBUG Shibboleth.AttributeResolver.Query [1]:
attempting SAML 2.0 attribute query

2015-09-22 19:02:58 DEBUG XMLTooling.SOAPTransport.CURL [1]: getting
connection handle to
https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery

2015-09-22 19:02:58 DEBUG XMLTooling.SOAPTransport.CURL [1]: nothing free
in pool, returning new connection handle

2015-09-22 19:02:58 DEBUG Shibboleth.SOAPClient [1]: prepping SOAP
transport for use by application (t-saml-auth-jer)

2015-09-22 19:02:58 DEBUG XMLTooling.SOAPClient [1]: marshalled
envelope:<S:Envelope
xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"><S:Body><samlp:AttributeQuery
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
ID="_e5b24995a8bebb0061bc91c3c1855039" IssueInstant="2015-09-22T19:02:58Z"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">my-service.abc.com/</saml:Issuer><saml:Subject
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:NameID
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
NameQualifier="https://idp.xyz.com/idp/shibboleth" SPNameQualifier="
my-service.abc.com/
">testuser</saml2:NameID></saml:Subject></samlp:AttributeQuery></S:Body></S:Envelope>

2015-09-22 19:02:58 DEBUG XMLTooling.SOAPTransport.CURL [1]: sending SOAP
message to https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery

2015-09-22 19:02:58 ERROR Shibboleth.AttributeResolver.Query [1]: exception
during SAML query to
https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery:
CURLSOAPTransport failed while contacting SOAP endpoint (
https://idp.xyz.com:8443/idp/profile/SAML2/SOAP/AttributeQuery): couldn't
connect to host

2015-09-22 19:02:58 ERROR Shibboleth.AttributeResolver.Query [1]: unable to
obtain a SAML response from attribute authority

Here's my attribute-map.xml.

<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance">
   <!-- SAML 2.0 NameID Format: -->
   <Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
id="persistent-id">
       <AttributeDecoder xsi:type="NameIDAttributeDecoder"
formatter="$Name" defaultQualifiers="true"/>
   </Attribute>
</Attributes>

Thanks,
  Jeremy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150922/0e1259d5/attachment-0001.html>