ERROR in LOGS IdPv3
John Morrison
john.morrison at uadm.uu.se
Wed Aug 24 11:59:25 EDT 2016
On Wed, 2016-08-24 at 14:54 +0000, Cantor, Scott wrote:
> On 8/24/16, 10:36 AM, "users on behalf of John Morrison" <users-bounces at shibboleth.net on behalf of john.morrison at uadm.uu.se> wrote:
>
> > OK, but what I don't get, I've enabled CAS on our IDP v3 server and
> > every CAS'd login is recored into the shibboleth/shibpid database, this
> > shouldn't be the case by default?
>
> By default, there are no SAML persistent IDs in the IdP.
>
> If you configure your attribute resolver to produce peristent IDs via the StoredIdConnector, then any resolver run is going to hit that connector, and the relying party identifier is what it is. In SAML, it's an entityID, with CAS it's a location.
>
> > How do I stop this from happening, as you pointed out, using attributes
> > to derive persistentIDs, I have no Idea if our IdP is doing this or not.
>
> Well, it self-evidently is, but if you don't know, certainly nobody else should.
>
> > I don't want CAS'd auths to be recorded in the shibpid at all.
>
> Then you'd have to do something to conditionalize the use of that connector based on whether it's a CAS request, or you move the persistentID support out of the resolver into the non-deprecated NameID generation layer, which replaces the old connector, and I don't think runs when CAS does.
I am using the new method of nameid generation and not using the
resolver data connector as previously in version2.
attribute-resolver.xml:
<resolver:AttributeDefinition xsi:type="ad:SAML2NameID"
id="eduPersonTargetedID"
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
sourceAttributeID="persistentId">
<resolver:Dependency ref="StoredId" />
<resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
<resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="eduPersonTargetedID" />
</resolver:AttributeDefinition>
<resolver:DataConnector id="StoredId"
xsi:type="dc:StoredId"
sourceAttributeID="uid"
salt="SOME SALT PLEASE"
generatedAttributeID="persistentId">
<resolver:Dependency ref="uid" />
<dc:BeanManagedConnection>shibboleth.JPAStorageService.DataSource</dc:BeanManagedConnection>
</resolver:DataConnector>
saml-nameid.properties:
idp.nameid.saml2.default =
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier
idp.nameid.saml2.default =
urn:oasis:names:tc:SAML:2.0:NameID-format:persistent
idp.persistentId.salt = SOME SALT PLEASE
idp.persistentId.generator = shibboleth.StoredPersistentIdGenerator
idp.persistentId.store = IdPPersistentIdStore
saml-nameid.xml:
<!-- SAML 2 NameID Generation -->
<util:list id="shibboleth.SAML2NameIDGenerators">
<ref bean="shibboleth.SAML2TransientGenerator" />
<!-- Uncommenting this bean requires configuration in
saml-nameid.properties. -->
<ref bean="shibboleth.SAML2PersistentGenerator" />
<!--bean parent="shibboleth.SAML2AttributeSourcedGenerator"
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
p:attributeSourceIds="#{ {'email'} }" /-->
</util:list>
<!-- SAML 1 NameIdentifier Generation -->
<util:list id="shibboleth.SAML1NameIdentifierGenerators">
<ref bean="shibboleth.SAML1TransientGenerator" />
<!--bean parent="shibboleth.SAML1AttributeSourcedGenerator"
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
p:attributeSourceIds="#{ {'email'} }" /-->
</util:list>
<!-- A DataSource bean suitable for use in the
idp.persistentId.dataSource property. -->
<bean id="MyDataSource" class="org.apache.commons.dbcp2.BasicDataSource"
p:driverClassName="org.mariadb.jdbc.Driver"
p:url="jdbc:mariadb://127.0.0.1:3306/shibboleth?autoReconnect=true&localSocketAddress=127.0.0.1&connectTimeout=1800&initialTimeout=2&logSlowQueries=true&autoReconnectForPools=true"
p:username="shibboleth"
p:password="XXXXXXXXX"
p:maxIdle="5"
p:maxWaitMillis="15000"
p:testOnBorrow="true"
p:validationQuery="select 1"
p:validationQueryTimeout="5" />
<!-- A "store" bean suitable for use in the idp.persistentId.store
property. -->
<bean id="IdPPersistentIdStore"
parent="shibboleth.JDBCPersistentIdStore"
p:dataSource-ref="MyDataSource"
p:queryTimeout="PT2S"
p:retryableErrors="#{{'23000'}}" />
</beans>
cas-protocol.xml:
<bean id="reloadableServiceRegistry"
class="%{idp.cas.serviceRegistryClass:net.shibboleth.idp.cas.service.PatternServiceRegistry}">
<property name="definitions">
<list>
<!--
<bean
class="net.shibboleth.idp.cas.service.ServiceDefinition"
c:regex="https://([A-Za-z0-9_-]+\.)*example\.org(:
\d+)?/.*"
p:group="proxying-services"
p:authorizedToProxy="true"
p:singleLogoutParticipant="true" />
<bean
class="net.shibboleth.idp.cas.service.ServiceDefinition"
c:regex="http://([A-Za-z0-9_-]+\.)*example\.org(:
\d+)?/.*"
p:group="non-proxying-services"
p:authorizedToProxy="false" /
-->
<bean
class="net.shibboleth.idp.cas.service.ServiceDefinition"
c:regex="https://([A-Za-z0-9_-]+\.)*uu\.se(:\d
+)?/.*"
p:group="cas"
p:authorizedToProxy="false"
p:singleLogoutParticipant="true" />
</list>
</property>
</bean>
relying-party.xml:
<bean id="shibboleth.UnverifiedRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
<!-- <bean parent="SAML2.SSO" p:encryptAssertions="false" />
-->
</list>
</property>
</bean>
<!--
Default configuration, with default settings applied for all
profiles, and enables
the attribute-release consent flow.
-->
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
<bean parent="Shibboleth.SSO"
p:includeAttributeStatement="true"
p:postAuthenticationFlows="terms-of-use" />
<ref bean="SAML1.AttributeQuery" />
<ref bean="SAML1.ArtifactResolution" />
<bean parent="SAML2.SSO"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" p:postAuthenticationFlows="terms-of-use" />
<ref bean="SAML2.ECP" />
<ref bean="SAML2.Logout" />
<ref bean="SAML2.AttributeQuery" />
<ref bean="SAML2.ArtifactResolution" />
<ref bean="CAS.LoginConfiguration"/>
<!--ref bean="CAS.ProxyConfiguration" /-->
<ref bean="CAS.ValidateConfiguration" />
</list>
</property>
</bean>
<!-- Container for any overrides you want to add. -->
<util:list id="shibboleth.RelyingPartyOverrides">
<!--
Override example that identifies a single RP by name and
configures it
for SAML 2 SSO without encryption. This is a common "vendor"
scenario.
-->
<!--
<bean parent="RelyingPartyByName"
c:relyingPartyIds="https://sp.example.org">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO"
p:encryptAssertions="false" />
</list>
</property>
</bean>
-->
</util:list>
Cheers,
//John
>
> > How did I get into this mess in the first place :)
>
> You configured two features that have never been used together by anybody else, or at least nobody's noted it. The use of databases for this is mostly a non-US thing, and the CAS support is mostly a US thing, so the overlap isn't common.
>
> -- Scott
>
>
More information about the users
mailing list