seemingly inconsistent responses to SP requests

[IAM David Bantz]

Having just switched our production IdP to V3, I'm monitoring the logs. I
see several errors generated from requests like this:

DEBUG [PROTOCOL_MESSAGE:121] -
> <?xml version="1.0" encoding="UTF-8"?>
> <samlp:AuthnRequest
>     AssertionConsumerServiceURL="
> https://community.uaf.edu/Shibboleth.sso/SAML2/POST"
>     Destination="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO"
>     ID="_7b673b4a261f8c734c5daf95676a2851"
>     IssueInstant="2016-12-28T21:32:37Z"
>     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>     Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
>     <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
> https://community.uaf.edu/shibboleth</saml:Issuer>
>     <samlp:NameIDPolicy AllowCreate="1"/>
> </samlp:AuthnRequest>




triggered this error in V3:

ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action
DecodeMessage: Unable to decode incoming request

org.opensaml.messaging.decoder.MessageDecodingException: No SAMLRequest or
SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message

at
org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:73)


I then went back to my V2 logs, and was surprised (because I've received no
user reports) to see parallel requests triggering this WARN:

WARN
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:217] -
No login context available, unable to proceed with authentication

00:11:38.163 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] -
Processing incoming request

00:11:38.163 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:339] -
LoginContext key cookie was not present in request

00:11:38.163 - WARN
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:217] -
No login context available, unable to proceed with authentication


but a few minutes later, a request that looks to me substantially the same:

> DEBUG [PROTOCOL_MESSAGE:121] -
> <?xml version="1.0" encoding="UTF-8"?>
> <samlp:AuthnRequest
>     AssertionConsumerServiceURL="
> https://community.uaf.edu/Shibboleth.sso/SAML2/POST"
>     Destination="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO"
>     ID="_8dcd8f6d80296b404cdd6a6c726b0496"
>     IssueInstant="2016-12-28T21:50:02Z"
>     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>     Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
>     <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
> https://community.uaf.edu/shibboleth</saml:Issuer>
>     <samlp:NameIDPolicy AllowCreate="1"/>
> </samlp:AuthnRequest>

is processed and leads to appropriate assertion issued by the V3 IdP.


How should I interpret these results?

David Bantz

UA OIT IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161228/449e21bf/attachment.html>