SAML1.1 attribute release on Shib 3

[Steve Glover]

Hi Andi,

If the IdP's backchannel is configured correctly, then the next thing to check is whether you've got a firewall blocking port 8443....

$ nmap -A -P0 -p8443 idp3.dev.cardiffmet.ac.uk

Starting Nmap 6.40 ( http://nmap.org ) at 2017-02-15 16:49 GMT
Nmap scan report for idp3.dev.cardiffmet.ac.uk (193.62.97.13)
Host is up (0.037s latency).
PORT     STATE SERVICE    VERSION
8443/tcp open  https-alt?

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.54 seconds

Nope - not that.

Maybe it's your configuration after all....

$ openssl s_client -connect idp3.dev.cardiffmet.ac.uk:8443 -showcerts
CONNECTED(00000003)
139985115449248:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 247 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

I think that might be your problem....

Cheers

Steve




> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Morris, Andi
> Sent: 15 February 2017 16:35
> To: Shib Users
> Subject: RE: SAML1.1 attribute release on Shib 3
> 
> Hi Rod thanks for your swift response,
> We configured the backchannel as per the Jetty config page on the Shib wiki, so
> I would hope it is correct. I'll definitely look further at that, as well as the
> metadata. We just used the default metadata created during the install (this is
> just a dev server).
> 
> Cheers,
> Andi
> 
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rod
> Widdowson
> Sent: 15 February 2017 16:30
> To: 'Shib Users' <users at shibboleth.net>
> Subject: RE: SAML1.1 attribute release on Shib 3
> 
> Is your backchannel configured correctly? That would be my go to suggestion.
> Indeed does your metadata even support attribute query? Can you get the UK
> Fed support guys to mail you the SP log for when it's trying to do the query.  That
> will help you debug it.
> 
> Alternatively have you configured for attribute push in SAML1?  This is not the
> default because it involves a complete change in your trust model.
> 
> R
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> ________________________________
> 
> [Cardiff Metropolitan University - Queens Anniversary Prizes
> 2015]<http://www.cardiffmet.ac.uk/news/Pages/Cardiff-Met-research-
> recognised-in-Queens-Anniversary-Prizes-for-Higher-and-Further-
> Education.aspx>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net