[Non-DoD Source] Re: Move application from Shibboleth idp v2 to idp v3 errors

[Lueders, Paul T CIV (US)]

There is not any reason that we are using queries.  I will look at the
metadata file.

Paul

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, March 07, 2017 4:06 PM
To: Shib Users <users at shibboleth.net>
Subject: [Non-DoD Source] Re: Move application from Shibboleth idp v2 to idp
v3 errors

All active links contained in this email were disabled.  Please verify the
identity of the sender, and confirm the authenticity of all links contained
within the message prior to copying and pasting the address to a Web
browser.  




----

On 3/7/17, 3:59 PM, "users on behalf of Lueders, Paul T CIV (US)"
<users-bounces at shibboleth.net on behalf of paul.t.lueders.civ at mail.mil>
wrote:

> I have updated the IDP server from to IDP version 3.2.1 and I am using

The error in the log, which has nothing to do with your actual issue, is
because you're on an out of date version.

>  This application has multiple end points and the user credentials 
> need to be rendered to the application server.

I don't know what any of that is meant to refer to.

> The errors that are being reported in the application server shibd.log  
> are ERROR Shibboleth.ArrtibuteResolver.Query: exception during SAML 
> query to
> Caution-https://idpu/idp/profile/SAML2/SPAO/AttributeQuery: 
> CURLSOAPTransport Failed

Do you have some reason to be using queries? If not, you're just not
releasing any attributes to that SP, and you have bad metadata indicating
you support attribute queries that you should fix, assuming you don't
actually support them.

>while contacting SOAP Endpoint
>(Caution-https://idpu/idp/profile/SAML2/SPAO/AttributeQuery) : The 
>requested URL

That also strongly looks like a broken URL in metadata, the default endpoint
for queries is /SAML2/SOAP/AttributeQuery. It's possible that would cause a
400.

>The error reported on the idp server is:

I don't know where that SEVERE thing comes from, but that doesn't look like
anything we log, though the messages themselves are, and are from a bug
that's been fixed.

-- Scott


--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5431 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170307/550301eb/attachment-0001.p7s>