Problem with deleting user consent at login

[Krinetzki, Stephan]

Dear Shibboleth users,

I've got some problems with the user consent. If the user accepts the
consent and then wants to review this consent, this does not work. So the
box at the login, which is deleting the consent, isn't working. Maybe it's
just a configuration error, so here are the details:

* 2 shibboleth IdP 3.3 servers on CentOS 7
* Tomcat 8 on both servers
* apache httpd Server
* as database backend MariaDB in a Galera Cluster

idp.properties:

idp.additionalProperties= /conf/ldap.properties,
/conf/saml-nameid.properties, /conf/services.properties
idp.entityID= https://login.rz.rwth-aachen.de/shibboleth
idp.scope= rwth-aachen.de
idp.cookie.secure = true
idp.cookie.httpOnly = true
idp.cookie.maxAge = 31536000
idp.sealer.storeResource= %{idp.home}/credentials/sealer.jks
idp.sealer.versionResource= %{idp.home}/credentials/sealer.kver
idp.sealer.storePassword= <PASS>
idp.sealer.keyPassword= <PASS>
idp.signing.key=/etc/httpd/ssl/sso.rwth-aachen.de.key
idp.signing.cert=/etc/httpd/ssl/sso.rwth-aachen.de.crt
idp.encryption.key=/etc/httpd/ssl/sso.rwth-aachen.de.key
idp.encryption.cert=/etc/httpd/ssl/sso.rwth-aachen.de.crt
idp.session.StorageService = shibboleth.JPAStorageService
idp.session.trackSPSessions = true
idp.session.secondaryServiceIndex = true
idp.authn.flows= Password
idp.consent.StorageService = shibboleth.JPAStorageService
idp.consent.userStorageKey = shibboleth.consent.AttributeConsentStorageKey
idp.consent.userStorageKeyAttribute = uid
idp.consent.allowDoNotRemember = true
idp.consent.allowGlobal = false
idp.consent.allowPerAttribute = false
idp.consent.compareValues = true
idp.consent.storageRecordLifetime = P1Y
idp.logout.elaboration = true
idp.status.accessPolicy= AccessByIPAddress
idp.resolvertest.accessPolicy= AccessByIPAddress
idp.reload.accessPolicy= AccessByIPAddress
idp.ui.fallbackLanguages= de,en
mysql.class = org.apache.tomcat.jdbc.pool.DataSource
mysql.url = jdbc:mariadb://localhost:3306/shibboleth
mysql.username = <DB_USER>
mysql.password = <DB_PASS>

Beans from conf/global.xml:

    <bean id="shibboleth.MySQLDataSource"
          class="%{mysql.class}"
          p:driverClassName="org.mariadb.jdbc.Driver"
          p:url="%{mysql.url}"
          p:username="%{mysql.username}"
          p:password="%{mysql.password}"
          p:maxWait="15000"
          p:validationQuery="select 1" />

    <bean id="shibboleth.JPAStorageService"
          class="org.opensaml.storage.impl.JPAStorageService"
          p:cleanupInterval="%{idp.storage.cleanupInterval:PT10M}"
          c:factory-ref="shibboleth.JPAStorageService.EntityManagerFactory"
/>

    <bean id="shibboleth.JPAStorageService.EntityManagerFactory"
 
class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
        <property name="packagesToScan" value="org.opensaml.storage.impl"/>
        <property name="dataSource" ref="shibboleth.MySQLDataSource"/>
        <property name="jpaVendorAdapter"
ref="shibboleth.JPAStorageService.JPAVendorAdapter"/>
        <property name="jpaDialect">
            <bean
class="org.springframework.orm.jpa.vendor.HibernateJpaDialect" />
        </property>
    </bean>

    <bean id="shibboleth.JPAStorageService.JPAVendorAdapter"
 
class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter"
          p:generateDdl="true"
          p:database="MYSQL"
          p:databasePlatform="org.hibernate.dialect.MySQL5Dialect" />

Sessions & Consent are stored in the Database.

Your help is greatly appreciated.

Greetings from Germany and sorry for bad English

Stephan Krinetzki

--
Stephan Krinetzki
Fachinformatiker

IT Center
Abteilung: Systeme und Betrieb
RWTH Aachen University
Seffenter Weg 23
52074 Aachen
Tel: +49 241 80-24866
Fax: +49 241 80-22134


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5849 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20161205/2627487f/attachment.p7s>