Box.com and Shibboleth
Chad Sutton
casutton at noctrl.edu
Mon Feb 29 12:52:32 EST 2016
Wow thanks for all the feedback everyone!
This is a good point. I'm downloading their metadatafile and it is not
using that as entityID and is different for some reason than their
InCommon version. I'm not using InCommon metadata on my test server at
this point. This is one of the things we noticed early on that was
weird, but changing it to use https://services.box.com/sp didn't seem to
make a difference. I'll check into this again right away though.
Here is there boxmetadata-encrypted.xml file that i am using link
https://cloud.app.box.com/shared/static/7spo68nzg9. It has "box.net" set
as the entityID.
I did find a problem earlier in the log file with LDAP that I fixed, but
now that it is fixed, I'm still getting the same problem. Here is my
idp-proccess.log from boot through a test login.
2016-02-29 11:41:45,260 - INFO
[net.shibboleth.idp.log.LogbackLoggingService:240] - Shibboleth IdP
Version 3.2.1
2016-02-29 11:41:45,267 - INFO
[net.shibboleth.idp.log.LogbackLoggingService:241] - Java
version='1.7.0_95' vendor='Oracle Corporation'
2016-02-29 11:41:45,269 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.LoggingService': Reload time set to: 300000,
starting refresh thread
2016-02-29 11:41:45,352 - INFO
[org.opensaml.core.config.InitializationService:48] - Initializing
OpenSAML using the Java Services API
2016-02-29 11:41:47,532 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2009/xmlenc11#aes128-gcm
2016-02-29 11:41:47,535 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2009/xmlenc11#aes192-gcm
2016-02-29 11:41:47,538 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2009/xmlenc11#aes256-gcm
2016-02-29 11:41:47,541 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2001/04/xmlenc#ripemd160
2016-02-29 11:41:47,548 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160
2016-02-29 11:41:47,556 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2009/xmlenc11#rsa-oaep
2016-02-29 11:41:47,576 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160
2016-02-29 11:41:48,420 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.AttributeFilterService': Performing initial load
2016-02-29 11:41:48,424 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.AttributeFilterService': Reloading service
configuration
2016-02-29 11:41:48,449 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/attribute-filter.xml]
2016-02-29 11:41:48,675 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.AttributeFilterService:
startup date [Mon Feb 29 11:41:48 CST 2016]; parent: Root
WebApplicationContext
2016-02-29 11:41:48,859 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.AttributeFilterService': Completed reload and
swapped in latest configuration for service
'shibboleth.AttributeFilterService'
2016-02-29 11:41:48,864 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.AttributeFilterService': Reload complete
2016-02-29 11:41:48,866 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.AttributeFilterService': Reload time set to:
900000, starting refresh thread
2016-02-29 11:41:48,907 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.AttributeResolverService': Performing initial load
2016-02-29 11:41:48,908 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.AttributeResolverService': Reloading service
configuration
2016-02-29 11:41:48,921 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml]
2016-02-29 11:41:49,242 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id:
eduPersonPrincipalName
2016-02-29 11:41:49,249 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-02-29 11:41:49,290 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: uid
2016-02-29 11:41:49,297 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-02-29 11:41:49,299 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: mail
2016-02-29 11:41:49,305 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-02-29 11:41:49,306 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: sn
2016-02-29 11:41:49,317 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-02-29 11:41:49,318 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: givenName
2016-02-29 11:41:49,319 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-02-29 11:41:49,344 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for DataConnector plugin with id: myLDAP
2016-02-29 11:41:49,440 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.AttributeResolverService:
startup date [Mon Feb 29 11:41:49 CST 2016]; parent: Root
WebApplicationContext
2016-02-29 11:41:50,682 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.AttributeResolverService': Completed reload and
swapped in latest configuration for service
'shibboleth.AttributeResolverService'
2016-02-29 11:41:50,688 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.AttributeResolverService': Reload complete
2016-02-29 11:41:50,689 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.AttributeResolverService': Reload time set to:
900000, starting refresh thread
2016-02-29 11:41:50,717 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.NameIdentifierGenerationService': Performing
initial load
2016-02-29 11:41:50,722 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.NameIdentifierGenerationService': Reloading
service configuration
2016-02-29 11:41:50,733 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/saml-nameid.xml]
2016-02-29 11:41:50,848 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/system/conf/saml-nameid-system.xml]
2016-02-29 11:41:50,959 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing
ApplicationContext:shibboleth.NameIdentifierGenerationService: startup
date [Mon Feb 29 11:41:50 CST 2016]; parent: Root WebApplicationContext
2016-02-29 11:41:51,382 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.NameIdentifierGenerationService': Completed reload
and swapped in latest configuration for service
'shibboleth.NameIdentifierGenerationService'
2016-02-29 11:41:51,383 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.NameIdentifierGenerationService': Reload complete
2016-02-29 11:41:51,384 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.NameIdentifierGenerationService': Reload time set
to: 900000, starting refresh thread
2016-02-29 11:41:51,402 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.RelyingPartyResolverService': Performing initial load
2016-02-29 11:41:51,403 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.RelyingPartyResolverService': Reloading service
configuration
2016-02-29 11:41:51,417 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/relying-party.xml]
2016-02-29 11:41:51,535 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/credentials.xml]
2016-02-29 11:41:51,572 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/system/conf/relying-party-system.xml]
2016-02-29 11:41:51,654 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.RelyingPartyResolverService:
startup date [Mon Feb 29 11:41:51 CST 2016]; parent: Root
WebApplicationContext
2016-02-29 11:41:52,503 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.MetadataResolverService': Performing initial load
2016-02-29 11:41:52,504 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.MetadataResolverService': Reloading service
configuration
2016-02-29 11:41:52,508 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/metadata-providers.xml]
2016-02-29 11:41:52,673 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/system/conf/metadata-providers-system.xml]
2016-02-29 11:41:52,715 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.MetadataResolverService:
startup date [Mon Feb 29 11:41:52 CST 2016]; parent: Root
WebApplicationContext
2016-02-29 11:41:53,859 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:465]
- New metadata successfully loaded for
'http://www.testshib.org/metadata/testshib-providers.xml'
2016-02-29 11:41:53,916 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:306]
- Next refresh cycle for metadata provider
'http://www.testshib.org/metadata/testshib-providers.xml' will occur on
'2016-02-29T20:41:53.585Z' ('2016-02-29T14:41:53.585-06:00' local time)
2016-02-29 11:41:54,002 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:465]
- New metadata successfully loaded for
'/opt/shibboleth-idp/metadata/boxmetadata.xml'
2016-02-29 11:41:54,003 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:306]
- Next refresh cycle for metadata provider
'/opt/shibboleth-idp/metadata/boxmetadata.xml' will occur on
'2016-02-29T20:41:53.956Z' ('2016-02-29T14:41:53.956-06:00' local time)
2016-02-29 11:41:54,012 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.MetadataResolverService': Completed reload and
swapped in latest configuration for service
'shibboleth.MetadataResolverService'
2016-02-29 11:41:54,013 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.MetadataResolverService': Reload complete
2016-02-29 11:41:54,377 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.RelyingPartyResolverService': Completed reload and
swapped in latest configuration for service
'shibboleth.RelyingPartyResolverService'
2016-02-29 11:41:54,380 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.RelyingPartyResolverService': Reload complete
2016-02-29 11:41:54,386 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.RelyingPartyResolverService': Reload time set to:
900000, starting refresh thread
2016-02-29 11:41:54,412 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.ReloadableAccessControlService': Performing
initial load
2016-02-29 11:41:54,421 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.ReloadableAccessControlService': Reloading service
configuration
2016-02-29 11:41:54,434 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/access-control.xml]
2016-02-29 11:41:54,561 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/system/conf/access-control-system.xml]
2016-02-29 11:41:54,623 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing
ApplicationContext:shibboleth.ReloadableAccessControlService: startup
date [Mon Feb 29 11:41:54 CST 2016]; parent: Root WebApplicationContext
2016-02-29 11:41:54,722 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.ReloadableAccessControlService': Completed reload
and swapped in latest configuration for service
'shibboleth.ReloadableAccessControlService'
2016-02-29 11:41:54,728 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.ReloadableAccessControlService': Reload complete
2016-02-29 11:41:54,732 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.ReloadableAccessControlService': Reload time set
to: 300000, starting refresh thread
2016-02-29 11:41:54,767 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.ReloadableCASServiceRegistry': Performing initial load
2016-02-29 11:41:54,776 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.ReloadableCASServiceRegistry': Reloading service
configuration
2016-02-29 11:41:54,788 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/cas-protocol.xml]
2016-02-29 11:41:54,866 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.ReloadableCASServiceRegistry:
startup date [Mon Feb 29 11:41:54 CST 2016]; parent: Root
WebApplicationContext
2016-02-29 11:41:54,932 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.ReloadableCASServiceRegistry': Completed reload and
swapped in latest configuration for service
'shibboleth.ReloadableCASServiceRegistry'
2016-02-29 11:41:54,933 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.ReloadableCASServiceRegistry': Reload complete
2016-02-29 11:41:54,934 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.ReloadableCASServiceRegistry': Reload time set to:
900000, starting refresh thread
2016-02-29 11:41:55,980 - INFO
[net.shibboleth.ext.spring.context.DelimiterAwareApplicationContext:577]
- Refreshing WebApplicationContext for namespace 'idp-servlet': startup
date [Mon Feb 29 11:41:55 CST 2016]; parent: Root WebApplicationContext
2016-02-29 11:41:58,015 - INFO
[net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] -
RemoteUserAuthServlet will process REMOTE_USER, along with attributes []
and headers []
2016-02-29 11:42:51,508 - INFO [org.ldaptive.auth.Authenticator:259] -
Authentication succeeded for dn: cn=casutton,ou=Admstr,ou=Napvil,o=NCC
2016-02-29 11:42:51,512 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139]
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
'casutton' succeeded
2016-02-29 11:42:55,191 - INFO [Shibboleth-Audit.SSO:241] -
20160229T174255Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|ETAvfkI-wEW8YuADoFou._WfUBc|box.net|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://logintest.noctrl.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_817d94c987361e29bb9f9d5750d3f6bd|casutton|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||AAdzZWNyZXQxIl7AAkBipqOzRaFi2ruv/mKaluWx49H0QdvSe+D97Cm/Y2+ZCtX6fQrq+KeKL96l8NifbRbp/ZxQjHW3krEwePUcISHFcx9frC3wD6OQ|_aa4fb83994af539580ee74cc88c064e3|
Regards,
Chad Sutton - North Central College ITS
casutton at noctrl.edu
630-637-5448
On 02/29/2016 10:38 AM, Rob Gorrell wrote:
> Is your filter matching the Box SP? The AttributeRequesterString value
> we match against is "box.net <http://box.net>" but you have
> "https://services.box.com/sp".
>
> Looking at your audit trace...
> 016-02-29 08:40:02,513 - INFO [Shibboleth-Audit.SSO:241] -
> 20160229T144002Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|aTaVxkNsrMagR4Tsw3dkh5l-TGR|*box.net
> <http://box.net>*|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://logintest.noctrl.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f3849b289760d44449f9bfe62d6f459e|casutton|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||AAdzZWNyZXQxxxKquNVPpR5LnofTIk0ea6li7WEdmUEbq73t1trVyy0qmhwrpQqqRs93c3KvN2CKOCYhfPgpkI+m6tk9A3s0lgwRsyjjyWfzgPj5TKvI|_12beaf680eaf737d7b4d9ef639e27a4f|
> <http://shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps://logintest.noctrl.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_f3849b289760d44449f9bfe62d6f459e%7Ccasutton%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7C%7CAAdzZWNyZXQxxxKquNVPpR5LnofTIk0ea6li7WEdmUEbq73t1trVyy0qmhwrpQqqRs93c3KvN2CKOCYhfPgpkI+m6tk9A3s0lgwRsyjjyWfzgPj5TKvI%7C_12beaf680eaf737d7b4d9ef639e27a4f%7C>
>
>
> -Rob
>
> On Mon, Feb 29, 2016 at 11:21 AM, Rod Widdowson
> <rdw at steadingsoftware.com <mailto:rdw at steadingsoftware.com>> wrote:
>
> > 2016-02-29 08:40:00,327 - ERROR
> > [net.shibboleth.idp.profile.impl.ResolveAttributes:240] -
> Profile Action
> > ResolveAttributes: Error resolving attributes: Invalid Attribute
> > resolver configuration
>
> > I'm assuming that this is a problem with my attribute-filter.xml file?
>
> No, with your attribute-resolver file.
>
> Look earlier in the log (like when tomcat starts) and you'll get
> more info.
>
> Rod
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> <mailto:users-unsubscribe at shibboleth.net>
>
>
>
>
> --
> Robert W. Gorrell
> Systems Architect, Identity and Access Management
> University of NC at Greensboro
> 336-334-5954
> PGP Key ID B36DB0CA
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160229/c09bf14e/attachment-0001.html>
More information about the users
mailing list