NoPotentialFlow issue with a specific SP with IdP 3.2.1

Mon Jul 4 12:07:29 EDT 2016

Hi,

I'm in the process of going through which SPs work and which ones don't
with Shib 3 before we can go live. One of our SPs seems to be dropping
the RemoteUser flow but I can't see why. Checking the Apache and tomcat
logs it is receiving the REMOTE_USER variable and it's being picked up
by tomcat.

This SP works fine with Shib 2 and has no special configuration other
than some additional attributes being released.

This is the error below- I've attached the complete debug log of the
transaction

2016-07-04 15:09:07,450 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:269] - Profile
Action SelectAuthenticationFlow: Forced authentication requested,
selecting an inactive flow
2016-07-04 15:09:07,452 - ERROR
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:273] - Profile
Action SelectAuthenticationFlow: No potential flows left to choose from,
authentication will fail
2016-07-04 15:09:07,457 - WARN
[org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
while processing the request: NoPotentialFlow

Any ideas? Does the issue lie with the SP or with the IdP?

-- 
/****************************

Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk
PGP: 0x435A9621

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.
-------------- next part --------------
2016-07-04 15:09:07,264 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder:64] - Decoded RelayState: ss:mem:cd102ce44adc672a25951b82b69c7409b5e677dcc54a099cd3863f4c00c8f9ad
2016-07-04 15:09:07,265 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder:96] - Base64 decoding and inflating SAML message
2016-07-04 15:09:07,268 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder:79] - Decoded SAML message
2016-07-04 15:09:07,272 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler' on INBOUND message context
2016-07-04 15:09:07,272 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,274 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml1.binding.impl.SAML1ArtifactRequestIssuerHandler' on INBOUND message context
2016-07-04 15:09:07,274 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,276 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler' on INBOUND message context
2016-07-04 15:09:07,277 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,280 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler' on INBOUND message context
2016-07-04 15:09:07,280 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,281 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:144] - Message Handler:  org.opensaml.saml.common.messaging.context.SAMLMetadataContext added to MessageContext as child of org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext
2016-07-04 15:09:07,283 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context
2016-07-04 15:09:07,283 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,284 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler:130] - Message Handler:  Selecting default AttributeConsumingService, if any
2016-07-04 15:09:07,284 - DEBUG [org.opensaml.saml.metadata.support.AttributeConsumingServiceSelector:186] - Resolving AttributeConsumingService candidates from SPSSODescriptor
2016-07-04 15:09:07,285 - DEBUG [org.opensaml.saml.metadata.support.AttributeConsumingServiceSelector:141] - AttributeConsumingService candidate list was empty, can not select service
2016-07-04 15:09:07,285 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler:138] - Message Handler:  No AttributeConsumingService selected
2016-07-04 15:09:07,286 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer https://uoe-shib.hosted.exlibrisgroup.com/shib
2016-07-04 15:09:07,287 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293] - Resolving relying party configuration
2016-07-04 15:09:07,288 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:305] - Checking if relying party configuration EntityNames[https://b2access.eudat.eu:8443/unitygw/saml-sp-metadata,] is applicable
2016-07-04 15:09:07,288 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:310] - Relying party configuration EntityNames[https://b2access.eudat.eu:8443/unitygw/saml-sp-metadata,] is not applicable
2016-07-04 15:09:07,289 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:314] - No relying party configurations are applicable, returning the default configuration shibboleth.DefaultRelyingParty
2016-07-04 15:09:07,289 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.DefaultRelyingParty for request
2016-07-04 15:09:07,295 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:126] - Profile Action PopulateProfileInterceptorContext: Installing flow intercept/security-policy/saml2-sso into interceptor context
2016-07-04 15:09:07,297 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.FilterFlowsByNonBrowserSupport:52] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2016-07-04 15:09:07,299 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:101] - Profile Action SelectProfileInterceptorFlow: Checking flow intercept/security-policy/saml2-sso for applicability...
2016-07-04 15:09:07,299 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:84] - Profile Action SelectProfileInterceptorFlow: Selecting flow intercept/security-policy/saml2-sso
2016-07-04 15:09:07,303 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler' on INBOUND message context
2016-07-04 15:09:07,304 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,304 - DEBUG [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:157] - Message Handler:  Checking SAML message intended destination endpoint against receiver endpoint
2016-07-04 15:09:07,305 - DEBUG [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:190] - Message Handler:  Intended message destination endpoint: https://idp.ed.ac.uk/idp/profile/SAML2/Redirect/SSO
2016-07-04 15:09:07,306 - DEBUG [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:191] - Message Handler:  Actual message receiver endpoint: https://idp.ed.ac.uk/idp/profile/SAML2/Redirect/SSO
2016-07-04 15:09:07,307 - DEBUG [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:204] - Message Handler:  SAML message intended destination endpoint matched recipient endpoint
2016-07-04 15:09:07,310 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler' on INBOUND message context
2016-07-04 15:09:07,311 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,312 - DEBUG [org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler:152] - Message Handler:  Evaluating message replay for message ID '_9e096a252fbf5e349bca071cca3df673', issue instant '2016-07-04T14:08:58.000Z', entityID 'https://uoe-shib.hosted.exlibrisgroup.com/shib'
2016-07-04 15:09:07,324 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler' on INBOUND message context
2016-07-04 15:09:07,325 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,328 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler' on INBOUND message context
2016-07-04 15:09:07,328 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,329 - DEBUG [org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler:80] - SPSSODescriptor for entity ID 'https://uoe-shib.hosted.exlibrisgroup.com/shib' does not require AuthnRequests to be signed
2016-07-04 15:09:07,331 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler' on INBOUND message context
2016-07-04 15:09:07,332 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,333 - DEBUG [org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler:102] - Message Handler:  SAML protocol message was not signed, skipping XML signature processing
2016-07-04 15:09:07,335 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler' on INBOUND message context
2016-07-04 15:09:07,336 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,337 - DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:148] - Message Handler:  Evaluating simple signature rule of type: org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler
2016-07-04 15:09:07,338 - DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:157] - Message Handler:  HTTP request was not signed via simple signature mechanism, skipping
2016-07-04 15:09:07,341 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler' on INBOUND message context
2016-07-04 15:09:07,342 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,343 - DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:148] - Message Handler:  Evaluating simple signature rule of type: org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler
2016-07-04 15:09:07,343 - DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:151] - Message Handler:  Handler can not handle this request, skipping processing
2016-07-04 15:09:07,347 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.CheckMandatoryIssuer' on INBOUND message context
2016-07-04 15:09:07,348 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-07-04 15:09:07,349 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.WriteProfileInterceptorResultToStorage:68] - Profile Action WriteProfileInterceptorResultToStorage: No results available from interceptor context, nothing to store
2016-07-04 15:09:07,351 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.FilterFlowsByNonBrowserSupport:52] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2016-07-04 15:09:07,352 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:65] - Profile Action SelectProfileInterceptorFlow: Moving completed flow intercept/security-policy/saml2-sso to completed set, selecting next one
2016-07-04 15:09:07,353 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:80] - Profile Action SelectProfileInterceptorFlow: No flows available to choose from
2016-07-04 15:09:07,354 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext:149] - Profile Action InitializeOutboundMessageContext: Initialized outbound message context
2016-07-04 15:09:07,357 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:369] - Profile Action PopulateBindingAndEndpointContexts: Attempting to resolve endpoint of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService for outbound message
2016-07-04 15:09:07,358 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:507] - Profile Action PopulateBindingAndEndpointContexts: Populating template endpoint for resolution from SAML AuthnRequest
2016-07-04 15:09:07,359 - DEBUG [org.opensaml.saml.common.binding.AbstractEndpointResolver:220] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Returning 4 candidate endpoints of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService
2016-07-04 15:09:07,360 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:411] - Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint at location https://uoe-shib.hosted.exlibrisgroup.com/Shibboleth.sso/SAML2/POST using binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2016-07-04 15:09:07,361 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:392] - No AttributeConsumingService was resolved, won't be able to determine delegation requested status via metadata
2016-07-04 15:09:07,362 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:525] - No AttributeConsumingService was available
2016-07-04 15:09:07,363 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:510] - Delegation request was not explicitly indicated, using default value: NOT_REQUESTED
2016-07-04 15:09:07,364 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:294] - Issuance of a delegated Assertion is not in effect, skipping further processing
2016-07-04 15:09:07,366 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:184] - Profile Action PopulateSignatureSigningParameters: Signing enabled
2016-07-04 15:09:07,367 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:197] - Profile Action PopulateSignatureSigningParameters: Resolving SignatureSigningParameters for request
2016-07-04 15:09:07,368 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:229] - Profile Action PopulateSignatureSigningParameters: Adding metadata to resolution criteria for signing/digest algorithms
2016-07-04 15:09:07,369 - DEBUG [org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:108] - Resolved signature algorithm URI from SAML metadata SigningMethod: http://www.w3.org/2001/04/xmldsig-more#rsa-sha512
2016-07-04 15:09:07,370 - DEBUG [org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:189] - Resolved reference digest method algorithm URI from SAML metadata DigestMethod: http://www.w3.org/2001/04/xmlenc#sha512
2016-07-04 15:09:07,371 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:237] - Profile Action PopulateSignatureSigningParameters: Resolved SignatureSigningParameters
2016-07-04 15:09:07,376 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:187] - Profile Action PopulateSignatureSigningParameters: Signing not enabled
2016-07-04 15:09:07,378 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:304] - Profile Action PopulateEncryptionParameters: Encryption for assertions (true), identifiers (false), attributes(false)
2016-07-04 15:09:07,379 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:314] - Profile Action PopulateEncryptionParameters: Resolving EncryptionParameters for request
2016-07-04 15:09:07,380 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:376] - Profile Action PopulateEncryptionParameters: Adding entityID to resolution criteria
2016-07-04 15:09:07,381 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:387] - Profile Action PopulateEncryptionParameters: Adding role metadata to resolution criteria
2016-07-04 15:09:07,382 - DEBUG [org.opensaml.saml.security.impl.MetadataCredentialResolver:259] - Resolving credentials from supplied RoleDescriptor using usage: ENCRYPTION.  Effective entityID was: https://uoe-shib.hosted.exlibrisgroup.com/shib
2016-07-04 15:09:07,383 - DEBUG [org.opensaml.saml.security.impl.MetadataCredentialResolver:350] - Resolved cached credentials from KeyDescriptor object metadata
2016-07-04 15:09:07,384 - DEBUG [org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver:381] - Resolved data encryption algorithm URI from SAML metadata EncryptionMethod: http://www.w3.org/2001/04/xmlenc#aes128-cbc
2016-07-04 15:09:07,385 - DEBUG [org.opensaml.saml.security.impl.SAMLMetadataEncryptionParametersResolver:335] - Resolved key transport algorithm URI from SAML metadata EncryptionMethod: http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p
2016-07-04 15:09:07,386 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:330] - Profile Action PopulateEncryptionParameters: Resolved EncryptionParameters
2016-07-04 15:09:07,419 - DEBUG [net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:144] - Profile Action ExtractSubjectFromRequest: No Subject NameID/NameIdentifier in message needs inbound processing
2016-07-04 15:09:07,421 - DEBUG [org.opensaml.saml.common.profile.impl.VerifyChannelBindings:154] - Profile Action VerifyChannelBindings: No channel bindings found to verify, nothing to do
2016-07-04 15:09:07,430 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2016-07-04T15:09:07.430+01:00, isPassive=false, forceAuthn=true, hintedName=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, initialAuthenticationResult=null, authenticationResult=null, completionInstant=1970-01-01T01:00:00.000+01:00}
2016-07-04 15:09:07,431 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:111] - Profile Action InitializeRequestedPrincipalContext: Profile configuration does not include any default authentication methods
2016-07-04 15:09:07,434 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:146] - Profile Action ProcessRequestedAuthnContext: AuthnRequest did not contain a RequestedAuthnContext, nothing to do
2016-07-04 15:09:07,437 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:126] - Profile Action PopulateAuthenticationContext: Installing custom PrincipalEvalPredicateFactoryRegistry into AuthenticationContext
2016-07-04 15:09:07,439 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:167] - Profile Action PopulateAuthenticationContext: Installed 1 authentication flows into AuthenticationContext
2016-07-04 15:09:07,441 - DEBUG [net.shibboleth.idp.session.impl.PopulateSessionContext:131] - Profile Action PopulateSessionContext: No session found for client
2016-07-04 15:09:07,444 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:75] - Profile Action FilterFlowsByForcedAuthn: Removing flow authn/RemoteUser, it does not support forced authentication
2016-07-04 15:09:07,445 - INFO [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:82] - Profile Action FilterFlowsByForcedAuthn: No potential authentication flows remain after filtering
2016-07-04 15:09:07,446 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByPassivity:53] - Profile Action FilterFlowsByPassivity: Request does not have passive requirement, nothing to do
2016-07-04 15:09:07,447 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2016-07-04 15:09:07,449 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:257] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2016-07-04 15:09:07,450 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:269] - Profile Action SelectAuthenticationFlow: Forced authentication requested, selecting an inactive flow
2016-07-04 15:09:07,452 - ERROR [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:273] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication will fail
2016-07-04 15:09:07,457 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: NoPotentialFlow
2016-07-04 15:09:07,459 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] - Error event NoPotentialFlow will be handled with response
2016-07-04 15:09:07,463 - DEBUG [org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:217] - Profile Action AddStatusResponseShell: Setting Issuer to https://idp.ed.ac.uk/shibboleth
2016-07-04 15:09:07,469 - DEBUG [org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:110] - Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to outgoing Response
2016-07-04 15:09:07,519 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:195] - Profile Action AddStatusToResponse: Detailed errors are disabled
2016-07-04 15:09:07,520 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:224] - Profile Action AddStatusToResponse: Setting StatusMessage to defaulted value
2016-07-04 15:09:07,529 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:159] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message context
2016-07-04 15:09:07,530 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2016-07-04 15:09:07,531 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] - Adding destination to outbound SAML 2 protocol message: https://uoe-shib.hosted.exlibrisgroup.com/Shibboleth.sso/SAML2/POST
2016-07-04 15:09:07,533 - DEBUG [org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52] - Message Handler:  Checking outbound endpoint for allowed URL scheme: https://uoe-shib.hosted.exlibrisgroup.com/Shibboleth.sso/SAML2/POST
2016-07-04 15:09:07,535 - DEBUG [org.opensaml.saml.common.SAMLObjectSupport:56] - Examing signed object for content references with exclusive canonicalization transform
2016-07-04 15:09:07,536 - DEBUG [org.opensaml.saml.common.SAMLObjectSupport:70] - Saw exclusive transform, declaring non-visible namespaces on signed object
2016-07-04 15:09:07,540 - DEBUG [org.opensaml.saml.common.SAMLObjectContentReference:165] - Adding list of inclusive namespaces for signature exclusive canonicalization transform
2016-07-04 15:09:07,572 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2016-07-04 15:09:07,574 - DEBUG [org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:159] - Invoking Velocity template to create POST body
2016-07-04 15:09:07,575 - DEBUG [org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:192] - Encoding action url of 'https://uoe-shib.hosted.exlibrisgroup.com/Shibboleth.sso/SAML2/POST' with encoded value 'https&#x3a;&#x2f;&#x2f;uoe-shib.hosted.exlibrisgroup.com&#x2f;Shibboleth.sso&#x2f;SAML2&#x2f;POST'
2016-07-04 15:09:07,577 - DEBUG [org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:198] - Marshalling and Base64 encoding SAML message
2016-07-04 15:09:07,579 - DEBUG [org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:220] - Setting RelayState parameter to: 'ss:mem:cd102ce44adc672a25951b82b69c7409b5e677dcc54a099cd3863f4c00c8f9ad', encoded as 'ss&#x3a;mem&#x3a;cd102ce44adc672a25951b82b69c7409b5e677dcc54a099cd3863f4c00c8f9ad'
2016-07-04 15:09:07,591 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action RecordResponseComplete: Record response complete
2016-07-04 15:09:07,594 - INFO [Shibboleth-Audit.SSO:241] - 20160704T140907Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_9e096a252fbf5e349bca071cca3df673|https://uoe-shib.hosted.exlibrisgroup.com/shib|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp.ed.ac.uk/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f234852a8a611572a98a5a5f015a563c|||||
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20160704/ffdaf176/attachment-0001.sig>