Error on signing outbound SAML message
Bogdan Albei
bogdan.albei at callsign.com
Wed Jan 6 09:58:07 EST 2016
Hi Cantor,
Please let me know what settings you would like to see. By the way, I found
a workaround for this by disabling encryptAsserions in relying-party.xml:
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
..
<bean parent="SAML2.SSO" p:encryptAssertions="false" />
..
</list>
</property>
</bean>
Also have a look at what the logs for this, this might be an Opensaml bug
that could be reproduced in isolation from Shibboleth:
2016-01-06 14:54:25,427 - DEBUG
[org.opensaml.saml.saml2.profile.impl.EncryptAssertions:132] - Profile
Action EncryptAssertions: Assertion before encryption:
<?xml version="1.0" encoding="UTF-8"?>
<saml2:Assertion ID="_ef7d814399cb80e4b2e1f57b128d51ca"
IssueInstant="2016-01-06T14:54:25.272Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Issuer>http://localhost:8080/saml/2e/shibboleth</saml2:Issuer>
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="http://localhost:8080/saml/2e/shibboleth"
SPNameQualifier="https://sp.testshib.org/shibboleth-sp
">AAdzZWNyZXQxqRBl3Sg7BBVo4Lo8DqCAXCAfxVz/J9h+dBql/Bt4ve1Oh5JH9cvkC6k3T1vruV9ABomcloBerFecMwNShIOj1MsVmUMcE+M2U34Zj/ek7yHsVk+2MgSV2Xj4T6cOjkrhD6vNhm+E</saml2:NameID>
<saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="0:0:0:0:0:0:0:1"
InResponseTo="_ffb3e770316afe20b8c0d7872bf69d10"
NotOnOrAfter="2016-01-06T14:59:25.344Z" Recipient="
https://sp.testshib.org/Shibboleth.sso/SAML2/POST"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2016-01-06T14:54:25.272Z"
NotOnOrAfter="2016-01-06T14:59:25.272Z">
<saml2:AudienceRestriction>
<saml2:Audience>https://sp.testshib.org/shibboleth-sp
</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2016-01-06T14:54:25.055Z"
SessionIndex="_8dac33a1922f57bdac1d8567263bc75e">
<saml2:SubjectLocality Address="0:0:0:0:0:0:0:1"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="lastname" Name="lastname"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">Albei</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="firstname" Name="firstname"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">Bogdan</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="callsign" Name="callsign"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">gigi3</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
2016-01-06 14:54:25,429 - DEBUG
[org.opensaml.saml.saml2.encryption.Encrypter:329] - Assertion before
encryption:
<?xml version="1.0" encoding="UTF-8"?>
<saml2:Assertion ID="_ef7d814399cb80e4b2e1f57b128d51ca"
IssueInstant="2016-01-06T14:54:25.272Z" Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Issuer>http://localhost:8080/saml/2e/shibboleth</saml2:Issuer>
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="http://localhost:8080/saml/2e/shibboleth"
SPNameQualifier="https://sp.testshib.org/shibboleth-sp
">AAdzZWNyZXQxqRBl3Sg7BBVo4Lo8DqCAXCAfxVz/J9h+dBql/Bt4ve1Oh5JH9cvkC6k3T1vruV9ABomcloBerFecMwNShIOj1MsVmUMcE+M2U34Zj/ek7yHsVk+2MgSV2Xj4T6cOjkrhD6vNhm+E</saml2:NameID>
<saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="0:0:0:0:0:0:0:1"
InResponseTo="_ffb3e770316afe20b8c0d7872bf69d10"
NotOnOrAfter="2016-01-06T14:59:25.344Z" Recipient="
https://sp.testshib.org/Shibboleth.sso/SAML2/POST"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2016-01-06T14:54:25.272Z"
NotOnOrAfter="2016-01-06T14:59:25.272Z">
<saml2:AudienceRestriction>
<saml2:Audience>https://sp.testshib.org/shibboleth-sp
</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2016-01-06T14:54:25.055Z"
SessionIndex="_8dac33a1922f57bdac1d8567263bc75e">
<saml2:SubjectLocality Address="0:0:0:0:0:0:0:1"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="lastname" Name="lastname"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">Albei</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="firstname" Name="firstname"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">Bogdan</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="callsign" Name="callsign"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xsd:string">gigi3</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
2016-01-06 14:54:25,478 - DEBUG
[org.opensaml.saml.saml2.encryption.Encrypter:441] - Placing EncryptedKey
elements inline inside EncryptedData
2016-01-06 14:54:25,486 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile
Action PopulateAuditContext: Adding 1 value for field 'bb'
2016-01-06 14:54:25,487 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile
Action PopulateAuditContext: Skipping field 'DD' not included in audit
format
2016-01-06 14:54:25,487 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile
Action PopulateAuditContext: Skipping field 'II' not included in audit
format
2016-01-06 14:54:25,487 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile
Action PopulateAuditContext: Skipping field 'SS' not included in audit
format
2016-01-06 14:54:25,488 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile
Action PopulateAuditContext: Skipping field 's' not included in audit format
2016-01-06 14:54:25,488 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile
Action PopulateAuditContext: Skipping field 'S' not included in audit format
2016-01-06 14:54:25,488 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile
Action PopulateAuditContext: Adding 1 value for field 'u'
2016-01-06 14:54:25,489 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile
Action PopulateAuditContext: Skipping field 'HASHEDu' not included in audit
format
2016-01-06 14:54:25,489 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile
Action PopulateAuditContext: Adding 1 value for field 'III'
2016-01-06 14:54:25,489 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile
Action PopulateAuditContext: Skipping field 'SM' not included in audit
format
2016-01-06 14:54:25,490 - TRACE
[net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:206] - Profile
Action PopulateAuditContext: Adding 3 value(s) for field 'attr'
2016-01-06 14:54:25,541 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:159] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on
OUTBOUND message context
2016-01-06 14:54:25,541 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2016-01-06 14:54:25,542 - DEBUG
[org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] -
Adding destination to outbound SAML 2 protocol message:
https://sp.testshib.org/Shibboleth.sso/SAML2/POST
2016-01-06 14:54:25,542 - DEBUG
[org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52]
- Message Handler: Checking outbound endpoint for allowed URL scheme:
https://sp.testshib.org/Shibboleth.sso/SAML2/POST
2016-01-06 14:54:25,546 - DEBUG
[org.opensaml.saml.common.SAMLObjectSupport:56] - Examing signed object for
content references with exclusive canonicalization transform
2016-01-06 14:54:25,547 - DEBUG
[org.opensaml.saml.common.SAMLObjectSupport:70] - Saw exclusive transform,
declaring non-visible namespaces on signed object
2016-01-06 14:54:25,555 - DEBUG
[org.opensaml.saml.common.SAMLObjectContentReference:165] - Adding list of
inclusive namespaces for signature exclusive canonicalization transform
2016-01-06 14:54:25,568 - ERROR
[org.opensaml.core.xml.io.AbstractXMLObjectMarshaller:426] - Unable to root
namespaces of cached DOM element, {
http://www.w3.org/2001/04/xmlenc#}EncryptionMethod
org.w3c.dom.DOMException: Unable to resolve namespace prefix ds found on
element {http://www.w3.org/2000/09/xmldsig#}DigestMethod
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)
2016-01-06 14:54:25,582 - WARN
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:182] -
Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: Error signing
outbound protocol message
at
org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler.doInvoke(SAMLOutboundProtocolMessageSigningHandler.java:81)
at
org.opensaml.messaging.handler.AbstractMessageHandler.invoke(AbstractMessageHandler.java:95)
Caused by: org.opensaml.core.xml.io.MarshallingException: Unable to root
namespaces of cached DOM element, {
http://www.w3.org/2001/04/xmlenc#}EncryptionMethod
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:427)
at
org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:144)
Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix ds
found on element {http://www.w3.org/2000/09/xmldsig#}DigestMethod
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)
at
net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)
On 6 January 2016 at 14:41, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 1/6/16, 3:58 AM, "users on behalf of Bogdan Albei" <
> users-bounces at shibboleth.net on behalf of bogdan.albei at callsign.com>
> wrote:
>
>
>
> >I am upgrading to Shibboleth 3 and I'm getting the following error just
> before the attribute release, meaning that the redirect to the relying
> party is not taking place. I'm using shibboleth 3.2.1 and opensaml 3.2.0.
>
> You're going to have to provide an explanation of what unusual settings
> were used. Nobody else has reported a bug of that nature, so it can't be a
> routine scenario.
>
> If you can't provide that, then you'll have to basically provide all of
> your configuration in a bug report.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
--
Bogdan Albei
Senior Platform Engineer
Callsign Inc.
[C] bogdan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160106/2524cd1c/attachment-0001.html>
More information about the users
mailing list