Internal Server Error when calling AssertionConsumerService on IIS
Per-Ake Dahl Ejemark
perake.dahlejemark at holmedal.se
Thu Oct 4 06:00:07 EDT 2018
When this, http://195.216.48.193:60666/Shibboleth.sso/SAML2/POST, is called from the testshib IdP I get 500 Internal Server Error. I'm assuming that I have screwed up the config somehow. Nothing is logged anywhere. I have checked the log on testshib, nothing. The iis log give me nothing except that I can see that the request is made. The shibboleth logs have nothing. Has anyone else had this problem?
I'm currently on a test system so pay no attention to the fact that I'm using http and ip addresses please.
My shibboleth2.xml
<!--
This is an example shibboleth2.xml generated for you by TestShib. It's reduced and recommended
specifically for testing. You don't need to change anything, but you may want to explore the file
to learn about how your SP works. Uncomment attributes in your attribute-map.xml file to test them.
If you want to test advanced functionality, start from the distribution shibboleth2.xml and add the
MetadataProvider, the right entityID, and a properly configured SSO element. More information:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfiguration
-->
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="1800">
<!-- Windows RequestMapper -->
<!--
The RequestMap defines portions of the webspace to protect; localhost/secure here.
-->
<!--
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap
-->
<OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />
<!--
The InProcess section contains settings affecting web server modules.
Required for IIS, but can be removed when using other web servers.
-->
<InProcess>
<ISAPI normalizeRequest="true" safeHeaderNames="true">
<!--
Maps IIS Instance ID values to the host scheme/name/port. The name is
required so that the proper <Host> in the request map above is found without
having to cover every possible DNS/IP combination the user might enter.
-->
<Site id="1" name="195.216.48.193" port="60666"/>
<!--<Site id="4" name="localhost" port="8082"/>-->
<!--
When the port and scheme are omitted, the HTTP request's port and scheme are used.
If these are wrong because of virtualization, they can be explicitly set here to
ensure proper redirect generation.
-->
<!--
<Site id="42" name="virtual.example.org" scheme="https" port="443"/>
-->
</ISAPI>
</InProcess>
<RequestMapper type="Native">
<RequestMap applicationId="default">
<Host name="195.216.48.193" port="60666">
<Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>
</RequestMap>
</RequestMapper>
<!--
The entityID is the name TestShib made for your SP.
-->
<ApplicationDefaults entityID="holmedal_test">
<!--
You should use secure cookies if at all possible. See cookieProps in this Wiki article.
-->
<!--
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions
-->
<Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="false">
<!--
Triggers a login request directly to the TestShib IdP.
-->
<!--
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO
-->
<SSO entityID="https://idp.testshib.org/idp/shibboleth"> SAML2 SAML1 </SSO>
<!-- SAML and local-only logout. -->
<!--
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout
-->
<Logout>SAML2 Local</Logout>
<!--
Handlers allow you to interact with the SP and gather more information. Try them out!
Attribute values received by the SP through SAML will be visible at:
http://localhost/Shibboleth.sso/Session
-->
<!--
Extension service that generates "approximate" metadata based on SP configuration.
-->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<!--
Error pages to display to yourself if something goes horribly wrong.
-->
<Errors supportContact="root at localhost" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/>
<!--
Loads and trusts a metadata file that describes only the Testshib IdP and how to communicate with it.
-->
<MetadataProvider type="XML" uri="http://www.testshib.org/metadata/testshib-providers.xml" backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000"/>
<!--
Attribute and trust options you shouldn't need to change.
-->
<AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<!--
Your SP generated these credentials. They're used to talk to IdP's.
-->
<CredentialResolver type="File" use="signing"
key="c:/etc/sp_sign_key.pem" certificate="c:/etc/sp_sign_cert.pem"/>
<CredentialResolver type="File" use="encryption"
key="c:/etc/sp_enc_key.pem" certificate="c:/etc/sp_enc_cert.pem"/>
</ApplicationDefaults>
<!--
Security policies you shouldn't change unless you know what you're doing.
-->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<!--
Low-level configuration about protocols and bindings available for use.
-->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
Best regards/ Med Vänliga Hälsningar
Per-Åke Dahl Ejemark
System Developer
[HOLMEDAL_black-red_logo-2011_3]
Holmedal Data AB
Flintvägen 4 | 269 41 Östra Karup | Sweden
Tel: +46 (0)431- 686 55
E-mail: perake.dahlejemark at holmedal.se<mailto:perake.dahlejemark at holmedal.se>
WebEx: https://trapezegroup.webex.com/meet/perake.dahlejemark
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181004/15149589/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1899 bytes
Desc: image001.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20181004/15149589/attachment.jpg>
More information about the users
mailing list