[IdP 3] Clustering and Backchannel

[Krinetzki, Stephan]

Dear all,

 

at the RWTH Aachen University we have 2 IdP 3 Clusters: One behind a
Forefront Threat Management Gateway (TMG) instance and one behind a BIG-IP
f5 instance (for testing). Both clusters store their sessions and the user
consent data in an MariaDB cluster. 

Now we are trying to get the backchannel (the artifact resolution service)
working. We have changed the storage service for this service to mamcached
(idp.replayCache.StorageService = shibboleth.MemcachedStorageService and
idp.artifact.StorageService = shibboleth.MemcachedStorageService), but the
artifact resolution doesn't work.

 

In The SP Log:

ERROR OpenSAML.MessageDecoder.SAML2Artifact [2]: ArtifactResponse message
did not contain a protocol message

 

In the IdP Server 1 Log:

 

WARN [org.opensaml.saml.common.binding.SAMLBindingSupport:93] - IP:<IPv6> |
Relay state exceeds 80 bytes: https://<SP
URL>/7762616E6D656C64756E672E6C6F67696E52656469726563743F7055726C3D2670496E4
672616D653D4F50454E5F44455441494C

INFO [Shibboleth-Audit.SSO:241] - IP:<Client IPv6>
|20170405T104725Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_4d79a5
6259e3d339db7710435337657e|<SP
URL>|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://login-test.
rz.rwth-aachen.de/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artif
act|_38dc212b6dbb8e44d917bf728fde5074|gi201606|urn:oasis:names:tc:SAML:2.0:a
c:classes:PasswordProtectedTransport|rwthSystemIDs,transientId|AAdzZWNyZXQyv
oaP8Mg7DkhPg0f4481+FBodfSGROucK9e/5Lh96qePsOuLPqlPdxsYruSQBqZraEjzfFNCyD4bto
cyThj6sjKT9AXYYrWUlhtO0Xmkt60/vXIxA+ABRNnPst9hjbwYGImhZgBVerM9bF7KeMbhDzU+T|
_4618380528fdab6be8d9f0063b618ad6|

 

In the IdP Server 2 Log:

 

WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:202] -
IP:<IP of SP> | Profile Action WebFlowMessageHandlerAdaptor: Exception
handling message org.opensaml.messaging.handler.MessageHandlerException:
Message context was

not authenticated

                at

org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication.doInvoke(Ch
eckMandatoryAuthentication.java:70)

WARN [org.opensaml.profile.action.impl.LogEvent:105] - IP:<IP of SP> | A
non-proceed event occurred while processing the request:
MessageAuthenticationError

INFO [Shibboleth-Audit.ArtifactResolution:241] - IP:<IP of SP>
|20170405T104726Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_d82ce3e0c767a83
c73e77f02d3e20eea|<SP>|http://shibboleth.net/ns/profiles/saml2/query/artifac
t|https://login-test.rz.rwth-aachen.de/shibboleth|urn:oasis:names:tc:SAML:2.
0:bindings:SOAP|_d31fd73d97ae23aa684b7b607a48eabd||||||

 

 

Is this an issue with our backchannel configuration? Or maybe with the
SSL/TLS termination at the loadbalancer?

--

Stephan Krinetzki

Fachinformatiker

 

IT Center

Abteilung: Systeme und Betrieb

RWTH Aachen University

Seffenter Weg 23

52074 Aachen

Tel: +49 241 80-24866

Fax: +49 241 80-22134

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170407/bf9e8566/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5849 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170407/bf9e8566/attachment-0001.p7s>