Shibd not sending attributes
Sachin Kadam
sachin.nihcas at gmail.com
Thu Jun 16 13:37:02 EDT 2016
Hello Peter,
Thanks for the guidance. All we have done is take the apps from data center
and move them to cloud. I am totally new to shib and shib SP setup.
PFB details and let me know if you need more info.
12:58:58.445(06/16) INFO Shibboleth.Application : adding SessionInitiator
of type (SAML2) to chain (/Login)
12:58:58.445(06/16) INFO Shibboleth.Application : adding SessionInitiator
of type (Shib1) to chain (/Login)
12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2 : supporting
outgoing binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect)
12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2 : supporting
outgoing binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST)
12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2 : supporting
outgoing binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign)
12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2 : supporting
outgoing binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact)
12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2 : supporting
outgoing binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect)
12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2 : supporting
outgoing binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST)
12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2 : supporting
outgoing binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign)
12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2 : supporting
outgoing binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact)
12:58:58.447(06/16) DEBUG Shibboleth.PropertySet : added property Location
(/Session)
12:58:58.447(06/16) DEBUG Shibboleth.PropertySet : added property type
(Session)
12:58:58.448(06/16) DEBUG Shibboleth.PropertySet : added nested property
set: {urn:mace:shibboleth:2.0:native:sp:config}Sessions
12:58:58.448(06/16) INFO Shibboleth.Application : adding SessionInitiator
of type (Shib1) to chain (/Login)
nk/lNgFT/d8y7topbOcZxhaK/lzwOJcrCxw=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="
https://federation/idp3/shibboleth" SPNameQualifier="
https://auth.domain.com/">_cc1a057008ce7af25acc9a05897819d2</saml2:NameID><saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData
Address="192.168.222.171" InResponseTo="_968fd4d5f9a4334d2aa72ab9bce0ad08"
NotOnOrAfter="2016-06-16T13:32:00.795Z" Recipient="
https://HOST/SHIRE/SAML2/POST"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions
NotBefore="2016-06-16T13:27:00.795Z"
NotOnOrAfter="2016-06-16T13:32:00.795Z"><saml2:AudienceRestriction><saml2:Audience>
https://sdauth.sciencedirect.com/</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement
AuthnInstant="2016-06-16T13:27:00.402Z"
SessionIndex="17aec448b03b8a41802d3405af3438c900067f333e3cbed9a9e626ea488d811b"><saml2:SubjectLocality
Address="192.168.222.171"/><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><saml2:Attribute
FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">
v.a at email.com</saml2:AttributeValue></saml2:Attribute><saml2:Attribute
FriendlyName="eduPersonPrincipalName"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">Test001 at idp3</saml2:AttributeValue></saml2:Attribute><saml2:Attribute
FriendlyName="sn" Name="urn:oid:2.5.4.4"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">SD</saml2:AttributeValue></saml2:Attribute><saml2:Attribute
FriendlyName="givenName" Name="urn:oid:2.5.4.42"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">Test001</saml2:AttributeValue></saml2:Attribute><saml2:Attribute
FriendlyName="eduPersonEntitlement" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">TestEntitlement</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion>
13:26:31.626(06/16) DEBUG Shibboleth.AttributeResolver.Query : found
AttributeStatement in input to new session, skipping query
13:26:31.626(06/16) DEBUG Shibboleth.SessionCache : creating new session
13:26:31.626(06/16) DEBUG Shibboleth.SessionCache : storing new session...
13:26:31.626(06/16) DEBUG XMLTooling.StorageService : inserted record
(session) in context (_9b685984837b48ae789856c161d29d10) with expiration
(1466087191)
13:26:31.626(06/16) INFO Shibboleth.SessionCache : new session created: ID
(_9b685984837b48ae789856c161d29d10) IdP (
https://elsevier.test.federation/idp3/shibboleth)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (10.168.126.251)
13:26:31.626(06/16) INFO Shibboleth-TRANSACTION : New session (ID:
_9b685984837b48ae789856c161d29d10) with (applicationId: new_shib) for
principal from (IdP: https://elsevier.test.federation/idp3/shibboleth) at
(ClientAddress: 10.168.126.251) with (NameIdentifier:
_cc1a057008ce7af25acc9a05897819d2) using (Protocol:
urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID:
_076c038355db166cda8db30fbf0cb108)
13:26:31.626(06/16) INFO Shibboleth-TRANSACTION : Cached the following
attributes with session (ID: _9b685984837b48ae789856c161d29d10) for
(applicationId: new_shib) {
Shibboleth.xml:
<RequestMapper type="Native">
<RequestMap applicationId="default" requireSession="true">
<Host applicationId="new_shib" name="hostUrl.domain.com"
requireSession="true" scheme="http">
<Path authType="shibboleth" exportAssertion="true" name="hbeat"
requireSession="false"/>
</Host>
<Host applicationId="new_shib" name="hostUrl.domain.com"
requireSession="true" scheme="https">
<Path authType="shibboleth" exportAssertion="true" name="hbeat"
requireSession="false"/>
</Host>
<Host applicationId="old_shib" name="hostUrl.domain.com"
requireSession="true" scheme="http">
<Path authType="shibboleth" exportAssertion="true" name="hbeat"
requireSession="false"/>
</Host>
<Host applicationId="old_shib" name="hostUrl.domain.com"
requireSession="true" scheme="https">
<Path authType="shibboleth" exportAssertion="true" name="hbeat"
requireSession="false"/>
</Host>
</RequestMap>
</RequestMapper>
<ApplicationDefaults attributePrefix="ELS_" connectTimeout="10"
encryption="false" entityID="https://auth.domain/" homeURL="
https://hostUrl2.domain.com/ShibAuth/deliverInstCredentials" id="default"
policyId="default" signing="false" timeout="20">
<Sessions checkAddress="false" cookieName="elsevier" cookieProps=";
path=/; domain=.domain.com" handlerSSL="false" handlerURL="
https://hostUrl.domain.com/SHIRE" lifetime="28800" relayState="cookie"
timeout="3600">
<SSO discoveryProtocol="SAMLDS">
SAML2 SAML1
</SSO>
When I dump all the headers in java (iterate over all headers and print) I
do see attributes. I receive them in a servlet on
/ShibAuth/deliverInstCredentials
Headers received: {RED-REMOTE-HOST=10.172.35.189,
accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
ELS_Shib-AuthnContext-Class=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,
X-Forwarded-Host=cdc316-auth.domain,
ELS_Shib-Session-Index=c747076dc1232ee7770efc70f85fbf82389bfdb5b7e32ef11818a05dd14de2cb,
ELS_Shib-Identity-Provider=https:// federation/idp3/shibboleth,
Accept-Language=en-US,en;q=0.5, ELS_givenName=Test001,
ELS_eduPersonPrincipalName=SD_Test001 at idp3, ELS_Shib-Assertion-Count=,
ELS_eduPersonOrgDN=, ELS_eduServPersonUName=,
ELS_eduPersonPrimaryOrgUnitDN=, X-RE-ClientHTTPReqVersion=1.1,
ELS_eduServPersonGroups=, OrigHTTPReqVersion=1.1, ELS_organisationId=,
ELS_sn=SD, connection=Keep-Alive, host=be-cdc316a, ELS_memberOf=,
ELS_Shib-Authentication-Instant=2016-06-07T20:27:31.120Z, ELS_mail=v.a at email,
cookie=JSESSIONID=40EE940075DD152BB4315188AC582006.abMwSNTPpUYpoqhsQuMBw;
appRetURL=http%3A%2F%2Fwww.ABC.com%2Fsc%2F;
BIGipServerels-es-cdc-tc-http-80=1411058826.20480.0000;
BIGipServerels-es-cdc316-sdauth-http-25007=3173231626.44897.0000;
_shibsession_elsevier=_1140878066a62c061a8de7738f4acb71,
ELS_campusPermanentId=,
ELS_Shib-Authentication-Method=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,
X-Forwarded-For-Received=198.185.23.225, 192.168.222.171,
X-Forwarded-For-Chain=8.8.8.8, 198.185.23.225, 198.185.23.225,
192.168.222.171, 10.172.35.189, ELS_eduPersonNickname=, content-length=0,
RED-PATH=/ShibAuth/deliverInstCredentials,
ELS_eduPersonPrimaryAffiliation=, Accept-Encoding=gzip, deflate, br,
ELS_eduPersonAffiliation=, referer=
https://REF.domain/idp3/profile/SAML2/Redirect/SSO,
ELS_eduPersonTargetedID=, ELS_subjectAssertionTargetedID=,
ELS_eduServOrgID=, ELS_eduServPersonACType=, ELS_eduServOrgName=,
ELS_eduServPersonRole=, ELS_eduServOrgSubType=, ELS_eduServOrgCountry=,
RED-REMOTE-ADDR=10.172.35.189, X-RE-FEproxy=
russpf-bec-lvela.telecom.regn.net, X-RE-Ref=1 1465331251721429 1
1465331252138596, ELS_eduServOrgType=, user-agent=Mozilla/5.0 (Windows NT
6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0,
ELS_eduPersonEntitlement=TestEntitlement, ELS_eduPersonScopedAffiliation=,
ELS_eduPersonOrgUnitDN=, ELS_Shib-Application-ID=new_shib,
ELS_Shib-AuthnContext-Decl=, REMOTE_USER=, X-Forwarded-For=10.172.35.189,
ELS_Shib-Session-ID=_1140878066a62c061a8de7738f4acb71,
ELS_eduServPersonPUID=}
Honestly, I am not sure if we are using AJP or proxy. Please let me know
which configuration can tell this for sure.
On Tue, Jun 14, 2016 at 6:16 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:
> * Sachin Kadam <sachin.nihcas at gmail.com> [2016-06-14 23:53]:
> > Following are my log messages. I am not getting attributes from SP -> my
> > Java application
>
> I don't see what those logs have to do with anything. Also haven't you
> asked that same question at least twice before in recent weeks?
>
> Anyway, first make sure the attributes are there in the SP, by
> checking the Session handler and the transaction log. Also look for
> "skip" messages in shibd.log. Only continue to look at Java once all
> the expected attributes are visible in the Session handler.
> Then make sure the location tunnelled/proxied to Java is enabled at
> least for passive protection from the SP.
>
> None of those things require DEBUG logging from the SP, btw, and you
> don't need to debug the inner workings of the SP when passing
> attributes on to Java from httpd is the issue.
>
> How exactly are you integrating with Java? Tunnelling AJP and request
> attributes (and with the AJP- prefix set in the Shib SP, as per the
> documentation)? Or reverse proxying HTTP Request Headers?
>
> Also, how are you determining that the attributes are missing?
> Referencing them by name (using what name) or looping over any
> available ones (the latter doesn't work with Tomcat)?
> What methods are you using on the Java side to access the attributes?
> getHeader? getAttribute?
>
> *All* of the above needs to be correct in order to get the attributes
> into Java. Unless you start providing concrete technical details all
> that's left is referring you to the documentation:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPJavaInstall
>
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160616/cf000c91/attachment-0001.html>
More information about the users
mailing list