SAML 1 TransientID Canonicalization

[Klingenstein, Nate]

We're trying to migrate servers and we have one service that still uses SAML 1.1.  In the change, subject canonicalization started failing.  This is one contiguous log from one server.

All other services are apparently functional.

2017-02-02 20:32:36,641 - INFO [Shibboleth-Audit.SSO:241] - 20170203T043236Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest|_057bfaec-29b8-4b5f-8056-24f5ef5128e9|https://authenticate.bvdep.com/incommon|http://shibboleth.net/ns/profiles/saml1/sso/browser|https://idp-co.calstate.edu/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_1a4a836665bfb8c55b00f802c8791235|CO\nklingenstein|urn:oasis:names:tc:SAML:1.0:am:password||AAdzZWNyZXQxGkA4pWQwr7mYIrn3ZVCi1fY5jpc7MnVgRjUQJy9KdCH+NIPsDEVA8oNucOTQl7YQkXzBP2r1mE1BReYrLPTDAQt5j6Nlls4eD5fiMV6H21dG4toFqkISmLbdfmWHp77bnRmjHrsT7Tr203HBL0f7z6zeieU=|_72782e20e0b2b56f3fbab2b7691026fa|
2017-02-02 20:32:37,438 - DEBUG [PROTOCOL_MESSAGE:127] -
<?xml version="1.0" encoding="UTF-8"?>
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
    <S:Body>
        <samlp:Request IssueInstant="2017-02-03T04:32:37Z"
            MajorVersion="1" MinorVersion="1"
            RequestID="_4af44d1721212cab063b03121d0e1a17" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol">
            <samlp:AttributeQuery Resource="https://authenticate.bvdep.com/incommon">
                <saml:Subject xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion">
                    <saml:NameIdentifier
                        Format="urn:mace:shibboleth:1.0:nameIdentifier" NameQualifier="https://idp-co.calstate.edu/idp/shibboleth">AAdzZWNyZXQxGkA4pWQwr7mYIrn3ZVCi1fY5jpc7MnVgRjUQJy9KdCH+NIPsDEVA8oNucOTQl7YQkXzBP2r1mE1BReYrLPTDAQt5j6Nlls4eD5fiMV6H21dG4toFqkISmLbdfmWHp77bnRmjHrsT7Tr203HBL0f7z6zeieU=</saml:NameIdentifier>
                </saml:Subject>
            </samlp:AttributeQuery>
        </samlp:Request>
    </S:Body>
</S:Envelope>
2017-02-02 20:32:37,454 - INFO [net.shibboleth.idp.saml.nameid.impl.BaseTransientDecoder:96] - Transient Decoder 'net.shibboleth.idp.saml.nameid.impl.TransientNameIdentifierDecoder#790e0bdd': Could not find transient identifier
2017-02-02 20:32:37,454 - INFO [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:62] - Profile Action SelectSubjectCanonicalizationFlow: Moving incomplete flow c14n/SAML1Transient to intermediate set, reselecting a different one


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170203/3961fa2d/attachment-0001.html>