users Digest, Vol 65, Issue 16

Fri Nov 4 09:51:16 EDT 2016

Hello Scott:
Thanks for the update, right now we are running IDP V2.4.3, JAVA1.8, do you know is the bug fixed in this version?

I think you are referring to this bug:
https://issues.shibboleth.net/jira/browse/SC-199

Just to confirm we are talking about the same bug, we have 8 script attributes, calling the same web service, since the one script can only assign value to one attribute in V2 (In our V3 instance we can defined 1 connector and assign values to multiple attributes), for each login our idp calls the web service 8 times. So right now when we have multiple users login at the same time, their attributes get mixed.

Thanks,
Bin

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of users-request at shibboleth.net
Sent: November-03-16 12:21 PM
To: users at shibboleth.net
Subject: users Digest, Vol 65, Issue 16

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than "Re: Contents of users digest..."

Today's Topics:

   1. RE: users Digest, Vol 65, Issue 9 (Cantor, Scott)
   2. Metadata document did not contain a descriptor for entity 
      (rune.piselli at eleven-project.it)

----------------------------------------------------------------------

Message: 1
Date: Thu, 3 Nov 2016 16:02:46 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: users Digest, Vol 65, Issue 9
Message-ID:
	<9846A6064BD102419D06814DD0D78DE112A81D77 at CIO-TNC-D2MBX02.osuad.osu.edu>

Content-Type: text/plain; charset="us-ascii"

> Is there a patch for the "Sript Attributes definition" bug?

The bug in Jira is SC-199. It wasn't even fixed in the final *minor* release (2.5), it was fixed in one of the 2.4.x versions.

-- Scott

------------------------------

Message: 2
Date: Thu,  3 Nov 2016 17:20:42 +0100
From: "rune.piselli at eleven-project.it"
	<rune.piselli at eleven-project.it>
To: users at shibboleth.net
Subject: Metadata document did not contain a descriptor for entity
Message-ID:
	<OG2QQI$CB149C25CA8AB8F8D162DBD3EE680237 at eleven-project.it>
Content-Type: text/plain; charset="utf-8"

Hi,

I'm trying to configure shibboletth I fixed the redirect url but now I got a strange error.

On the idp I got the following log:
?
2016-11-03 17:03:06,088 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder:64] - Decoded RelayState: ss:mem:ea40c8a762fa9c38b14a864135f1815be9ffb3702bdc2c55e5ce7d149ad84303
2016-11-03 17:03:06,089 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder:96] - Base64 decoding and inflating SAML message
2016-11-03 17:03:06,090 - DEBUG [org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder:79] - Decoded SAML message
2016-11-03 17:03:06,091 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler' on INBOUND message context
2016-11-03 17:03:06,091 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-11-03 17:03:06,091 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml1.binding.impl.SAML1ArtifactRequestIssuerHandler' on INBOUND message context
2016-11-03 17:03:06,091 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-11-03 17:03:06,092 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler' on INBOUND message context
2016-11-03 17:03:06,093 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-11-03 17:03:06,093 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler' on INBOUND message context
2016-11-03 17:03:06,094 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-11-03 17:03:06,094 - DEBUG [org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver:198] - Metadata document did not contain a descriptor for entity http://sp.mysaml.org/Shibboleth.sso
2016-11-03 17:03:06,094 - DEBUG [org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver:281] - Metadata document did not contain any role descriptors of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity http://sp.mysaml.org/Shibboleth.sso
2016-11-03 17:03:06,094 - DEBUG [org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver:252] - Metadata document does not contain a role of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol urn:oasis:names:tc:SAML:2.0:protocol for entity http://sp.mysaml.org/Shibboleth.sso
2016-11-03 17:03:06,094 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:128] - Message Handler: ?No metadata returned for http://sp.mysaml.org/Shibboleth.sso in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2016-11-03 17:03:06,095 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context
2016-11-03 17:03:06,095 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2016-11-03 17:03:06,095 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler:110] - Message Handler: ?No metadata context found, nothing to do
2016-11-03 17:03:06,095 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer http://sp.mysaml.org/Shibboleth.sso
2016-11-03 17:03:06,096 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293] - Resolving relying party configuration
2016-11-03 17:03:06,096 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:299] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty
2016-11-03 17:03:06,096 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for request
2016-11-03 17:03:06,097 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for relying party configuration shibboleth.UnverifiedRelyingParty
2016-11-03 17:03:06,097 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: InvalidProfileConfiguration2016-11-03 17:03:06,098 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:154] - No SAMLBindingContext or binding URI available, error must be handled locally?

Now the part that I can't Understand is why it complains about Metadata document did not contain a descriptor for entity http://sp.mysaml.org/Shibboleth.sso. when the returned metadata follows:

?

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_c76cd6d29798e4a6764fcb6c29d66697eb5d6ddf" entityID="http://sp.mysaml.org/Shibboleth.sso">

? <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
? ? <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
? ? <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
? ? <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
? ? <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
? ? <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
? ? <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
? </md:Extensions>

? <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
? ? <md:Extensions>
? ? ? <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://sp.mysaml.org/Shibboleth.sso/Login"/>
? ? ? <idpdisc:DiscoveryResponse xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://sp.mysaml.org/Shibboleth.sso/Login" index="1"/> ? ? </md:Extensions> ? ? <md:KeyDescriptor> ? ? ? <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
? ? ? ? <ds:KeyName>wdgai04-6313.intranet.mae.dom</ds:KeyName>
? ? ? ? <ds:X509Data>
? ? ? ? ? <ds:X509SubjectName>CN=wdgai04-6313.intranet.mae.dom</ds:X509SubjectName>
? ? ? ? ? <ds:X509Certificate>MIIEHjCCAoagAwIBAgIJAJ+tFZTSSMA1MA0GCSqGSIb3DQEBCwUAMCgxJjAkBgNV
BAMTHXdkZ2FpMDQtNjMxMy5pbnRyYW5ldC5tYWUuZG9tMB4XDTE2MTAyNzA5MzMx
OVoXDTI2MTAyNTA5MzMxOVowKDEmMCQGA1UEAxMdd2RnYWkwNC02MzEzLmludHJh
bmV0Lm1hZS5kb20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDQlBWE
55ctDB+OBisqFeYMDIMEEhS4U9yzlVIQDvLclyIBlTv2fXV7U+WNEX9QBFr/CWHw
DHZf3abLWD5ihSQsYm6LMTdMOr0JizTpHo6lifMLTPdDIKmjJqBTnj523hNAWbHE
nlp50FdYQzMFtwO7Bck1WIhgRu+zLRhRZGgTCXt5U4hlOIVXatQgv0/XUe/o4jut
o/I8qf04v0i4gmE4wJkR46jB2pALpWUH6DSVwezoZ5++igPt7nr3N3mCnTghGkjI
e/PRvB0hBjTbR0jspLhJj+7K6L+HKZffmXdY4/dbfAodEqm+8ChPLXVDwTvB2fEX
d8t8b7/WIiL3pvaFOsj+Z4uUOejMGxpdvEuZCIFvHdv5Xhj7WlR+0JG31vRrCrzF
xv0plWnwxOqxIKAoeKLteV1VGPgqGfDBPS+VJmvry80X5iMOBX8vxWM/toIfHFUv
q0eb35PgrUzecb2OMkcTg0lUr8Ai1WuT8EuHpfICHkCidITGtWIgmzcUYEECAwEA
AaNLMEkwKAYDVR0RBCEwH4Idd2RnYWkwNC02MzEzLmludHJhbmV0Lm1hZS5kb20w
HQYDVR0OBBYEFJ+CPdKGHGvLw7rk9br8NxuVOWE8MA0GCSqGSIb3DQEBCwUAA4IB
gQCzbb699lDGjKS5JkOtq0XCnkcjLj/PnuFkrQEd5jBBO9y0a00l/Db6N7FEoif9
p1tYoN55AnSoNljDUlZ2NFt7ov7mOZCax6ema/rcv0KaFcql3mXdmsvQKsFBxU6U
mjFXk3f2DpyM1rOeZtSThbOSnqkHRwlC6pNxZOhEzOQQEv+EU+VDdk909fGch4IY
vCFnJVFztuPsw0zBFayE+yD7bAGbx7ZvXKUj0vnWYuPOY/DB8ZyIbaKl140JFt4d
808xZAosOKAHzMypqEOgDt0zMC2eg908Qrt1rT3cmh1NP4qdBNgwY0bYRhiIs0H8
nH9993UH9n7y23GsP7dxSetDUYYmMMNT48tO9xP0uftlB2brX0PuxcHOJQwTK744
tndNjpwfzKedEKqRt+e3D8YNl5q9O1J/3I2K+tYCjYj3UzrSaOFxPb6l4eUTJ557
dv/oiYZnfFAVhekCojlg0wTNTlETLZ8D45JGBRfs3WWhkwAuomzdx+AkbydRMgVu
2k4=
</ds:X509Certificate>
? ? ? ? </ds:X509Data>
? ? ? </ds:KeyInfo>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes192-gcm"/>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep"/>
? ? ? <md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
? ? </md:KeyDescriptor>
? ? <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://sp.mysaml.org/Shibboleth.sso/Artifact/SOAP" index="1"/> ? ? <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://sp.mysaml.org/Shibboleth.sso/SLO/SOAP"/>
? ? <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sp.mysaml.org/Shibboleth.sso/SLO/Redirect"/>
? ? <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sp.mysaml.org/Shibboleth.sso/SLO/POST"/>
? ? <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://sp.mysaml.org/Shibboleth.sso/SLO/Artifact"/>
? ? <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sp.mysaml.org/Shibboleth.sso/SAML2/POST" index="1"/> ? ? <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://sp.mysaml.org/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/> ? ? <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://sp.mysaml.org/Shibboleth.sso/SAML2/Artifact" index="3"/> ? ? <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://sp.mysaml.org/Shibboleth.sso/SAML2/ECP" index="4"/> ? ? <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://sp.mysaml.org/Shibboleth.sso/SAML/POST" index="5"/> ? ? <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://sp.mysaml.org/Shibboleth.sso/SAML/Artifact" index="6"/> ? </md:SPSSODescriptor>

</md:EntityDescriptor>

What's wrong?

Thanks in advance,

Rune?

??
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161103/c23f9967/attachment.html>

------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 65, Issue 16
*************************************