Error NoCredentials in IDP3

Mon Mar 21 10:29:54 EDT 2016

Hello,

Admin of a service provider reported to us that occasionally he saw authentication failure in his server log. During investigation  I found corresponding NoCredentials error in idp_process log which I don’t understand how this happened. Our IDP use remote user for authentication. User are redirected to our central authentication system to enter user name/password. I don’t understand why user wasn’t redirected to central authentication system in this case.

Apache configuration:
<Location /idp/Authn/RemoteUser>

    AuthType all
    AuthName CORNELL
    require valid-user

</Location>

Apache log for a failed authentication:

10.145.141.230 9396 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZFBSwMxEIX%2Fyt5y2k2y29YauoViL4WK0FUPXiTNjmwwm8RMIv58s5ViC%2BJxMu89vnlZoRyNF5sUB3uAjwQYiw0ihKidvXMW0wihg%2FCpFTwd9i0ZYvQoKJXZUXndSxwq5YIFYyroE03Zi6ctnaKpksYcpXonxTZnayun4N8YHPRR975SOl7F5Dfqg3vTBmi3ud%2FX9AC9DqAi7boHUuy2LXllx9lSLpasVApuS8abplwsb%2BqS1bNaKs4ZY02WIibYWYzSxpbUjC9K1pR8%2FshnopkLzl5I8ZyhT1x1xUjxNRqLYsJvSQpWOIkahZUjoIhKTDwiC4U8F3Vp8f978lHRKWfIejWpxYkurM99%2FNEo%2BhW9lP5M13%2B2%2FgY%3D HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko)"

10.145.141.230 1442 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=6E98202755850B6500EBC6EB90F783D5?execution=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko)"

10.145.141.230 2193 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/Authn/RemoteUser;jsessionid=6E98202755850B6500EBC6EB90F783D5?conversation=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko)"

10.145.141.230 17042 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=6E98202755850B6500EBC6EB90F783D5?execution=e1s1&_eventId_proceed=1 HTTP/1.1" 200 4910 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko)"

10.145.141.230 8259 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZHNTsMwEIRfJTefEtvpD9RqKlX0UqkIqQEOXJDrLIqFYxuvjXh8nKCKVkIc1zsz%2Bna8RjkYL7Yp9vYIHwkwFltECFE7e%2BcspgFCC%2BFTK3g6HhrSx%2BhRUCqzo%2FK6k9hXygULxlTQJZqyF6ctHaOpksacpHonxS5nayvH4N8Y7PVJd75SOl7F5Dfqg3vTBmi7vT%2FU9AidDqAibdsHUux3DXllpxvJV5KVSsGqZHw2K%2Flyfluyel5LxTljTGUpYoK9xShtbEjN%2BLJkWbh45HMxWwjOXkjxnKEnrrpipPgajEUx4jckBSucRI3CygFQRCVGHpGFQp6LurT4%2Fz35qOiUM2SzHtViogubcx9%2FNIp%2BTS%2BlP9P1n22%2BAQ%3D%3D HTTP/1.1" 302 - "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4"

10.145.141.230 1321 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=697A4F0DA4F01EF4379CBF4C1F92349A?execution=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4"

10.145.141.230 2025 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/Authn/RemoteUser;jsessionid=697A4F0DA4F01EF4379CBF4C1F92349A?conversation=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4"

10.145.141.230 15845 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=697A4F0DA4F01EF4379CBF4C1F92349A?execution=e1s1&_eventId_proceed=1 HTTP/1.1" 200 4910 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4"

IDP process log:
2016-03-15 10:35:10,198|10.145.141.230 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:257] - User identity not found in request
2016-03-15 10:35:10,212|10.145.141.230 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:121] - Profile Action ValidateExternalAuthentication: External authentication failed, no user identity or error information returned
2016-03-15 10:35:10,213|10.145.141.230 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: NoCredentials
2016-03-15 10:35:10,227|10.145.141.230 - INFO [Shibboleth-Audit.SSO:241] - 20160315T143510Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_0b48a680-cce9-0133-6872-0242ac110003|https://pidash.cornell.edu/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibidp.cit.cornell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_ebc878e876ee2f2bc492e4daa11b425f|||||
2016-03-15 10:35:10,484|10.145.141.230 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:257] - User identity not found in request
2016-03-15 10:35:10,501|10.145.141.230 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:121] - Profile Action ValidateExternalAuthentication: External authentication failed, no user identity or error information returned
2016-03-15 10:35:10,503|10.145.141.230 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: NoCredentials
2016-03-15 10:35:10,516|10.145.141.230 - INFO [Shibboleth-Audit.SSO:241] - 20160315T143510Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_0b7a19a0-cce9-0133-1648-0242ac11000c|https://pidash.cornell.edu/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibidp.cit.cornell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f1a9d6cbb5c9d9bc90113ab0eb421a83|||||

For comparison, here is the apache log for a success authentication:

128.253.101.159 8433 - - [21/Mar/2016:09:52:44 -0400] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZHNTsMwEIRfJTefEttJyo%2FVVKropVIRUgMcuCDXWRQLxzZeG%2FH4OEUVrYQ4rndm9O14iXIyXqxTHO0ePhJgLNaIEKJ29s5ZTBOEHsKnVvC033VkjNGjoFRmR%2BX1IHGslAsWjKlgSDRlLx63dI6mShpzkOqdFJucra2cg39jcNQHPfhK6XgRk9%2BoD%2B5NG6D9%2Bn5X0z0MOoCKtO8fSLHddOSVq4W6lgMrB34rS8abprwFuClZ3dZScc4Ya7MUMcHWYpQ2dqRm%2FKpkTVnzR96IRS3a9oUUzxn6yFVXjBRfk7EoZvyOpGCFk6hRWDkBiqjEzCOyUMhTUecW%2F78nHxWdcoaslrNaHOnC6tTHH42iX9Jz6c90%2BWerbw%3D%3D HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"

128.253.101.159 771 - - [21/Mar/2016:09:52:44 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=5A521B6F91A110B5DF2FDFB9CC10C8BC?execution=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"

128.253.101.159 641 - - [21/Mar/2016:09:52:44 -0400] "GET /idp/Authn/RemoteUser;jsessionid=5A521B6F91A110B5DF2FDFB9CC10C8BC?conversation=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"

128.253.101.159 15555 - - [21/Mar/2016:09:52:44 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=5A521B6F91A110B5DF2FDFB9CC10C8BC?execution=e1s1&_eventId_proceed=1 HTTP/1.1" 200 4910 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"

128.253.101.159 13217 - - [21/Mar/2016:09:52:56 -0400] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZHNasMwEIRfxTedbP04SbGwA6G5BFIKcdtDL0WRN1hUllytXPr4lVNCEyg9rnZm%2BHZUoxrsKDdT7N0BPibAmG0QIUTj3b13OA0QWgifRsPzYd%2BQPsYRJaUqOYrRdAr7QvvgwNoCuolOyYvnLZ2jqVbWHpV%2BJ9k2ZRun5uDfGOzN0XRjoU28iUlvdAz%2BZCzQdvOwF%2FQAnQmgI23bR5Lttg15E2V3Kqs7lne8UjnjZZlXAFXOxEIozTljbJGkiBPsHEblYkME46uclbngT7yUSyGXq1eSvSToM5coGMm%2BButQzvgNmYKTXqFB6dQAKKOWM49MQqkuRV1bxv896ajotbdkXc9qeaYL60sffzSKY02vpT%2FT7Z%2BtvwE%3D HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"

128.253.101.159 1016 - - [21/Mar/2016:09:52:56 -0400] "GET /idp/profile/SAML2/Redirect/SSO?execution=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"

128.253.101.159 101069 - - [21/Mar/2016:09:52:56 -0400] "GET /idp/Authn/RemoteUser?conversation=e1s1 HTTP/1.1" 302 845 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"

128.253.101.159 5359 - - [21/Mar/2016:09:52:57 -0400] "GET /idp/Authn/RemoteUser?conversation=e1s1 HTTP/1.1" 302 254 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"

128.253.101.159 1037 - hy93 [21/Mar/2016:09:52:57 -0400] "GET /idp/Authn/RemoteUser?conversation=e1s1 HTTP/1.1" 302 - "https://web1.login.cornell.edu/?SID=CBD40C21E2E68EC7&WAK0Service=https/shibidp.cit.cornell.edu@CIT.CORNELL.EDU&WAK2Name=&WAK0Realms=&ReturnURL=https://shibidp.cit.cornell.edu/CBD40C21E2E68EC7/cuwal2.c0ntinue&VerP=3&VerC=2.3.0.229/idmbuild@fox02.serverfarm.cornell.edu/RedHat6-64bit-229/2.2.27&VerS=Apache%2020160313-1003&VerO=Linux%20cork57.serverfarm.cornell.edu%202.6.32-573.7.1.el6.x86_64%20%231%20SMP%20Thu%20Sep%2010%2013:42:16%20EDT%202015%20x86_64%20x86_64%20x86_64%20GNU/Linux%20Red%20Hat%20Enterprise%20Linux%20Server%20release%206.7%20%20Santiago%20&Accept=K2&WANow=1458568376&WAK2Flags=0&WAreason=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"
1
128.253.101.159 504767 - - [21/Mar/2016:09:52:57 -0400] "GET /idp/profile/SAML2/Redirect/SSO?execution=e1s1&_eventId_proceed=1 HTTP/1.1" 200 16542 "https://web1.login.cornell.edu/?SID=CBD40C21E2E68EC7&WAK0Service=https/shibidp.cit.cornell.edu@CIT.CORNELL.EDU&WAK2Name=&WAK0Realms=&ReturnURL=https://shibidp.cit.cornell.edu/CBD40C21E2E68EC7/cuwal2.c0ntinue&VerP=3&VerC=2.3.0.229/idmbuild@fox02.serverfarm.cornell.edu/RedHat6-64bit-229/2.2.27&VerS=Apache%2020160313-1003&VerO=Linux%20cork57.serverfarm.cornell.edu%202.6.32-573.7.1.el6.x86_64%20%231%20SMP%20Thu%20Sep%2010%2013:42:16%20EDT%202015%20x86_64%20x86_64%20x86_64%20GNU/Linux%20Red%20Hat%20Enterprise%20Linux%20Server%20release%206.7%20%20Santiago%20&Accept=K2&WANow=1458568376&WAK2Flags=0&WAreason=1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0”

Thanks,

Hong
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160321/76669e45/attachment-0001.html>