SLO Request Not Signed
Brian Moon
bmoon at scu.edu
Thu Apr 13 17:30:33 EDT 2017
Hello all,
I am trying to get the Single Logout to propagate to my SPs, but I am
running into an issue where the request being sent to an SP is not signed
(and thus being rejected by the SP). I found that previously someone had
set idp.logout.authenticated to false, so I have both set it back to true
and also commented it out (since the documentation seems to indicate that
true is the default value), but still no signature in the request. I've
also tried setting an override for the SP in relying-party.xml with the
following:
<bean parent="SAML2.Logout" p:signAssertions="true" p:signResponses="true"
p:signRequests="true" />
but still no luck. Any other places you all would recommend looking to see
why this request is not being signed? If it helps at all, below is the
skeleton of the request being sent to the SP:
<saml2p:LogoutRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
Destination="My SP" ID="XXXX" IssueInstant="2017-04-13T20:59:24.915Z"
Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">My
IdP</saml2:Issuer>
<saml2:EncryptedID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Id="XXXX" Type="http://www.w3.org/2001/04/xmlenc#Element">
<xenc:EncryptionMethod xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Id="XXXX" Recipient="My SP">
<xenc:EncryptionMethod xmlns:xenc="
http://www.w3.org/2001/04/xmlenc#" Algorithm="
http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">
<ds:DigestMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
</xenc:EncryptionMethod>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>Cert of the SP
removed</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
<xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:CipherValue>Cipher value removed</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedKey>
</ds:KeyInfo>
<xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
<xenc:CipherValue>Cipher value removed</xenc:CipherValue>
</xenc:CipherData>
</xenc:EncryptedData>
</saml2:EncryptedID>
<saml2p:SessionIndex>XXXX</saml2p:SessionIndex>
</saml2p:LogoutRequest>
And below is sanitized information from the idp-process.log with debug
turned on:
2017-04-13 13:59:24,576 - DEBUG
[net.shibboleth.idp.session.impl.PopulateLogoutPropagationContext:176] -
Profile Action PopulateLogoutPropagationContext: Got session to propagate
logout: SAML2SPSession{NameID=<?xml version="1.0" encoding="UTF-8"?>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="https://myidp/idp/shibboleth" SPNameQualifier="
https://mysp/sp"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">AssertionRemoved</saml2:NameID>,
SessionIndex=XXXX}
2017-04-13 13:59:24,590 - DEBUG
[net.shibboleth.idp.session.impl.SelectLogoutPropagationFlow:101] - Profile
Action SelectLogoutPropagationFlow: Selecting logout propagation flow
logoutprop/saml2
2017-04-13 13:59:24,842 - DEBUG
[net.shibboleth.idp.saml.session.impl.PrepareInboundMessageContext:116] -
Profile Action PrepareInboundMessageContext: Initialized inbound message
context for logout of https://mysp/sp
2017-04-13 13:59:24,850 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler' on
INBOUND message context
2017-04-13 13:59:24,858 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler' on
INBOUND message context
2017-04-13 13:59:24,863 - DEBUG
[net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132]
- Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching
RelyingPartyContext based on SAML peer https://mysp/sp
2017-04-13 13:59:24,868 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293]
- Resolving relying party configuration
2017-04-13 13:59:24,869 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:305]
- Checking if relying party configuration EntityNames[https://mysp/sp,] is
applicable
2017-04-13 13:59:24,869 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:307]
- Relying party configuration EntityNames[https://mysp/sp,] is applicable
2017-04-13 13:59:24,870 - DEBUG
[net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] -
Profile Action SelectRelyingPartyConfiguration: Found relying party
configuration EntityNames[https://mysp/sp,] for request
2017-04-13 13:59:24,886 - DEBUG
[net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext:149]
- Profile Action InitializeOutboundMessageContext: Initialized outbound
message context
2017-04-13 13:59:24,894 - DEBUG
[net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:375]
- Profile Action PopulateBindingAndEndpointContexts: Attempting to resolve
endpoint of type {urn:oasis:names:tc:SAML:2.0:metadata}SingleLogoutService
for outbound message
2017-04-13 13:59:24,895 - DEBUG
[net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:418]
- Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint at
location https://mysp/sp/logoutURL using binding
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
2017-04-13 13:59:24,907 - WARN
[net.shibboleth.idp.profile.config.AbstractProfileConfiguration:283] -
ProfileConfiguration http://shibboleth.net/ns/profiles/saml2/logout: No
ProfileRequestContext in request
2017-04-13 13:59:24,907 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:305]
- Profile Action PopulateEncryptionParameters: Encryption for assertions
(false), identifiers (true), attributes(false)
2017-04-13 13:59:24,907 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:315]
- Profile Action PopulateEncryptionParameters: Resolving
EncryptionParameters for request
2017-04-13 13:59:24,907 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:380]
- Profile Action PopulateEncryptionParameters: Adding entityID to
resolution criteria
2017-04-13 13:59:24,908 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:391]
- Profile Action PopulateEncryptionParameters: Adding role metadata to
resolution criteria
2017-04-13 13:59:24,909 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:331]
- Profile Action PopulateEncryptionParameters: Resolved EncryptionParameters
2017-04-13 13:59:24,917 - DEBUG
[net.shibboleth.idp.saml.session.impl.AddLogoutRequest:249] - Profile
Action AddLogoutRequest: Setting Issuer to https://myidp/idp/shibboleth
2017-04-13 13:59:24,943 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:179] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on
OUTBOUND message context
2017-04-13 13:59:24,943 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.LogoutRequestImpl'
2017-04-13 13:59:24,947 - DEBUG
[net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100]
- Looking up message encoder based on binding URI:
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
2017-04-13 13:59:24,969 - DEBUG
[net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile
Action RecordResponseComplete: Record response complete
2017-04-13 13:59:24,974 - INFO [Shibboleth-Audit.LogoutPropagation:241] -
20170413T205924Z|||
https://mysp/sp|http://shibboleth.net/ns/profiles/saml2/logout|https://myidp/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|Value
Removed||||Value Removed||
2017-04-13 13:59:35,094 - ERROR
[org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:76]
-
org.springframework.webflow.execution.repository.NoSuchFlowExecutionException:
No flow execution could be found with key 'e3s3' -- perhaps this executing
flow has ended or expired? This could happen if your users are relying on
browser history (typically via the back button) that references ended flows.
at
org.springframework.webflow.execution.repository.support.AbstractFlowExecutionRepository.getConversation(AbstractFlowExecutionRepository.java:172)
Caused by:
org.springframework.webflow.conversation.NoSuchConversationException: No
conversation could be found with id '3' -- perhaps this conversation has
ended?
at
org.springframework.webflow.conversation.impl.ConversationContainer.getConversation(ConversationContainer.java:126)
Thanks!
Brian Moon
Senior System Administrator
Enterprise Systems
Santa Clara University
Office: 408.554.4830
bmoon at scu.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170413/3c00ee7a/attachment-0001.html>
More information about the users
mailing list