Single Sign On (SSO) no longer working

[King, David]

Hi,

Single-sign on no longer works with the 3.2.1 that I am testing.  It was working a few days ago before I worked on fixing some NameID issues.  It appears to be a session issue and here is the log data after somone logs in:

2016-03-03 03:37:53,545 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
2016-03-03 03:37:53,546 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByPassivity:53] - Profile Action FilterFlowsByPassivity: Request does not have passive requirement, nothing to do
2016-03-03 03:37:53,547 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2016-03-03 03:37:53,548 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:257] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2016-03-03 03:37:53,549 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:350] - Profile Action SelectAuthenticationFlow: Reusing active result authn/Password
2016-03-03 03:37:53,550 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:144] - Profile Action FinalizeAuthentication: Canonical principal name established from session as 'dsmk'
2016-03-03 03:37:53,550 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:186] - Profile Action FinalizeAuthentication: Request did not have explicit authentication requirements, result is accepted
2016-03-03 03:37:53,551 - DEBUG [net.shibboleth.idp.session.impl.UpdateSessionWithAuthenticationResult:205] - Profile Action UpdateSessionWithAuthenticationResult: Updating activity time on reused AuthenticationResult for flow authn/Pass
word in existing session 67003782855ebd58df489b229583ce286d0823782f986e4c6201ea8a5f7432ac
2016-03-03 03:37:53,552 - WARN [net.shibboleth.idp.session.impl.StorageBackedIdPSession:257] - Skipping update, AuthenticationResult for flow authn/Password in session 67003782855ebd58df489b229583ce286d0823782f986e4c6201ea8a5f7432ac not
found in storage

My NameID work touched the following files: attribute-filter.xml, attribute-resolver.xml, saml-nameid.xml, saml-nameid.properties, and relying-party.xml.  I have reviewed those and don't see anything that should affect SSO behavior.

I get the same behavior with both the client and server memory session storage mechanisms so it does not appear to be a client session issue.  I also reviewed the web requests and I do see the cookies.

My main question is how to approach debugging this type of issue as I did not see any debugging tips online around session store debugging.

Thanks,
David

PS:  The relying party.xml changes are only to add elements of the form:

        <bean parent="RelyingPartyByName"
          c:relyingPartyIds="#{ {
            'https://www.concursolutions.com'
          } }">
          <property name="profileConfigurations">
            <list>
              <bean parent="SAML2.SSO"
                p:signAssertions="always"
                p:encryptAssertions="false"
                p:encryptNameIDs="false"
                p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'}}"
                />
            </list>
          </property>
        </bean>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160303/442804e9/attachment.html>