CAS proxy validation failing
Andrew Morgan
morgan at orst.edu
Fri Mar 1 18:27:33 EST 2019
I am attempting to upgrade from v3.4.1 to v3.4.3 of the IDP. CAS proxy
validation was working in v3.4.1 using the CASProxyTrustedCertificates
list in cas-protocol.xml. Here is that configuration:
<util:list id="shibboleth.CASProxyTrustedCertificates">
<!-- This cert is the issuer for lum-admin's cert -->
<bean class="net.shibboleth.ext.spring.factory.X509CertificateFactoryBean"
p:resource="%{idp.home}/credentials/InCommon_RSA_Server_CA.pem" />
<!-- This cert is the issuer for login.o.e's cert -->
<bean class="net.shibboleth.ext.spring.factory.X509CertificateFactoryBean"
p:resource="%{idp.home}/credentials/COMODO_RSA_Extended_Validation_Secure_Server_CA.pem" />
</util:list>
lum-admin.ucsadm.oregonstate.edu is the proxy callback hostname.
login.oregonstate.edu is our Shibboleth server hostname.
I converted this to the new style configuration:
<util:list id="shibboleth.CASProxyTrustedCertificates" value-type="java.lang.String">
<!-- This cert is the issuer for login.o.e's cert -->
<value>%{idp.home}/credentials/COMODO_RSA_Extended_Validation_Secure_Server_CA.pem</value>
<!-- This cert is the issuer for lum-admin's cert -->
<value>%{idp.home}/credentials/InCommon_RSA_Server_CA.pem</value>
</util:list>
I ended up setting org.opensaml.security to DEBUG to get some more
logging:
2019-03-01 15:00:21,052 - INFO [net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:117] - Successfully validated ST-AAFHGZLDOJSXIMJRGY4NC3IC5MVXS4EZ56KTCSICQ7LF56CUIYC2XY2XSWA47W5NLMKPWJFHQCF36FYQ55JAH4INCG6X7PRAWXK5J3S6LIIAB2TG6IM5OIUZ5XBFKHWBEB6KKDRHNTYMHZR7PTVSE4JJUMNQTDG5CNG77XZ6EDXJ7YZALULZ3WMOAUYHEJDXYGAOZHEIAWEG5LFG2W7YBPIGUUTRMT6RE636RVCH346PDTERDMQCK2VXAO4QE6MT74O5DZ7WMA4WP7N6D5GPG4QXEVB3ZHAWRELI4DSVN7NKCNYVQD2YPPFVHI3GLDPGTZYUW4O3MEOUCMTND7YDOWL42QQALTKUUIGDVKRRQQCRK6AZYV3KO3KPMCZRNA6AKBOVN4CRLCQFOXFT for https://myosu.oregonstate.edu:443/c/portal/login
2019-03-01 15:00:21,078 - DEBUG [org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory:284] - Attempting to evaluate server TLS credential against supplied TrustEngine and CriteriaSet
2019-03-01 15:00:21,078 - DEBUG [org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine:83] - Attempting to validate untrusted credential
2019-03-01 15:00:21,079 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:81] - Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion for criteria class org.opensaml.security.criteria.UsageCriterion
2019-03-01 15:00:21,080 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.security.x509.TrustedNamesCriterion
2019-03-01 15:00:21,080 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:81] - Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableEntityIDCredentialCriterion for criteria class org.opensaml.core.criterion.EntityIdCriterion
2019-03-01 15:00:21,082 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.EntityRoleCriterion
2019-03-01 15:00:21,082 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.ProtocolCriterion
2019-03-01 15:00:21,082 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:137] - Attempting PKIX validation of untrusted credential
2019-03-01 15:00:21,082 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:184] - Beginning PKIX validation using trusted validation information
2019-03-01 15:00:21,083 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:253] - Checking trusted names against credential: [subjectName='CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US']
2019-03-01 15:00:21,083 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:255] - Trusted names being evaluated are: [https://myosu.oregonstate.edu:443/c/portal/login, lum-admin.ucsadm.oregonstate.edu]
2019-03-01 15:00:21,083 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:386] - Processing subject alt names
2019-03-01 15:00:21,137 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:392] - Extracted subject alt names from certificate: [lum-admin.ucsadm.oregonstate.edu]
2019-03-01 15:00:21,137 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:396] - Matched subject alt name to trusted names: lum-admin.ucsadm.oregonstate.edu
2019-03-01 15:00:21,137 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:274] - Credential [subjectName='CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US'] passed name check based on subject alt names
2019-03-01 15:00:21,138 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:135] - Attempting PKIX path validation on untrusted credential: [subjectName='CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US']
2019-03-01 15:00:21,157 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:417] - Built valid PKIX cert path
2019-03-01 15:00:21,158 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:418] - Target certificate: CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US
2019-03-01 15:00:21,158 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:420] - CertPath certificate: CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US
2019-03-01 15:00:21,158 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:425] - TrustAnchor: CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US
2019-03-01 15:00:21,159 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:148] - PKIX validation succeeded for untrusted credential: [subjectName='CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US']
2019-03-01 15:00:21,159 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:194] - Credential trust established via PKIX validation
2019-03-01 15:00:21,159 - DEBUG [org.opensaml.security.trust.impl.ChainingTrustEngine:81] - Token was trusted by chain member: org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine
2019-03-01 15:00:21,159 - DEBUG [org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory:318] - Credential evaluated as trusted
2019-03-01 15:00:21,316 - DEBUG [org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory:284] - Attempting to evaluate server TLS credential against supplied TrustEngine and CriteriaSet
2019-03-01 15:00:21,317 - DEBUG [org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine:83] - Attempting to validate untrusted credential
2019-03-01 15:00:21,317 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:81] - Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion for criteria class org.opensaml.security.criteria.UsageCriterion
2019-03-01 15:00:21,318 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.security.x509.TrustedNamesCriterion
2019-03-01 15:00:21,318 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:81] - Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableEntityIDCredentialCriterion for criteria class org.opensaml.core.criterion.EntityIdCriterion
2019-03-01 15:00:21,318 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.EntityRoleCriterion
2019-03-01 15:00:21,318 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.ProtocolCriterion
2019-03-01 15:00:21,318 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:137] - Attempting PKIX validation of untrusted credential
2019-03-01 15:00:21,318 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:184] - Beginning PKIX validation using trusted validation information
2019-03-01 15:00:21,319 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:253] - Checking trusted names against credential: [subjectName='CN=login.oregonstate.edu,OU=COMODO EV SSL,OU=IS IT Infrastructure,O=Oregon State University,STREET=121 Valley Library,L=Corvallis,ST=OR,2.5.4.17=#13053937333331,C=US,2.5.4.15=#1311476f7665726e6d656e7420456e74697479,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.5=#13023030']
2019-03-01 15:00:21,319 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:255] - Trusted names being evaluated are: [https://myosu.oregonstate.edu:443/c/portal/login, lum-admin.ucsadm.oregonstate.edu]
2019-03-01 15:00:21,319 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:386] - Processing subject alt names
2019-03-01 15:00:21,319 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:392] - Extracted subject alt names from certificate: [login.oregonstate.edu]
2019-03-01 15:00:21,319 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:317] - Processing subject DN common name
2019-03-01 15:00:21,320 - DEBUG [org.opensaml.security.x509.X509Support:169] - Extracting CNs from the following DN: CN=login.oregonstate.edu, OU=COMODO EV SSL, OU=IS IT Infrastructure, O=Oregon State University, STREET=121 Valley Library, L=Corvallis, ST=OR, OID.2.5.4.17=97331, C=US, OID.2.5.4.15=Government Entity, OID.1.3.6.1.4.1.311.60.2.1.2=Oregon, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=00
2019-03-01 15:00:21,338 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:326] - Extracted common name from certificate: login.oregonstate.edu
2019-03-01 15:00:21,338 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:347] - Processing subject DN
2019-03-01 15:00:21,339 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:351] - Extracted X500Principal from certificate: CN=login.oregonstate.edu,OU=COMODO EV SSL,OU=IS IT Infrastructure,O=Oregon State University,STREET=121 Valley Library,L=Corvallis,ST=OR,2.5.4.17=#13053937333331,C=US,2.5.4.15=#1311476f7665726e6d656e7420456e74697479,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.5=#13023030
2019-03-01 15:00:21,339 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:368] - Trusted name was not a DN or could not be parsed: https://myosu.oregonstate.edu:443/c/portal/login
2019-03-01 15:00:21,340 - DEBUG [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:368] - Trusted name was not a DN or could not be parsed: lum-admin.ucsadm.oregonstate.edu
2019-03-01 15:00:21,340 - ERROR [org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:301] - Credential failed name check: [subjectName='CN=login.oregonstate.edu,OU=COMODO EV SSL,OU=IS IT Infrastructure,O=Oregon State University,STREET=121 Valley Library,L=Corvallis,ST=OR,2.5.4.17=#13053937333331,C=US,2.5.4.15=#1311476f7665726e6d656e7420456e74697479,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.5=#13023030']
2019-03-01 15:00:21,341 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:187] - Evaluation of credential against trusted names failed. Aborting PKIX validation
2019-03-01 15:00:21,341 - DEBUG [org.opensaml.security.httpclient.impl.SecurityEnhancedTLSSocketFactory:327] - Credential evaluated as untrusted, failure indicated as fatal
2019-03-01 15:00:21,341 - INFO [net.shibboleth.idp.cas.flow.impl.ValidateProxyCallbackAction:139] - Proxy authentication failed for https://lum-admin.ucsadm.oregonstate.edu:443/proxy/receptor: javax.security.auth.login.CredentialException: Untrusted certificate presented by CAS proxy callback endpoint
2019-03-01 15:00:21,354 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: ProxyCallbackAuthenticationFailure
2019-03-01 15:00:21,404 - INFO [Shibboleth-Audit.SSO:275] - 20190301T230021Z|128.193.133.53|||https://myosu.oregonstate.edu:443/c/portal/login|https://www.apereo.org/cas/protocol/serviceValidate||||||||ST-AAFHGZLDOJSXIMJRGY4NC3IC5MVXS4EZ56KTCSICQ7LF56CUIYC2XY2XSWA47W5NLMKPWJFHQCF36FYQ55JAH4INCG6X7PRAWXK5J3S6LIIAB2TG6IM5OIUZ5XBFKHWBEB6KKDRHNTYMHZR7PTVSE4JJUMNQTDG5CNG77XZ6EDXJ7YZALULZ3WMOAUYHEJDXYGAOZHEIAWEG5LFG2W7YBPIGUUTRMT6RE636RVCH346PDTERDMQCK2VXAO4QE6MT74O5DZ7WMA4WP7N6D5GPG4QXEVB3ZHAWRELI4DSVN7NKCNYVQD2YPPFVHI3GLDPGTZYUW4O3MEOUCMTND7YDOWL42QQALTKUUIGDVKRRQQCRK6AZYV3KO3KPMCZRNA6AKBOVN4CRLCQFOXFT|
Here is the same chunk of logs for v3.4.1:
2019-03-01 15:14:52,705 - INFO [net.shibboleth.idp.cas.flow.impl.ValidateTicketAction:117] - Successfully validated ST-AAFHGZLDOJSXIMJRGY3QDEZLWPRWYV22U5MPHPN7ALMQKIIIIW33BVYMTIAC4MHTLCFLZ4GZLBA3CYCUZKEFB7EL4JO4LWGTGVOCGIXJXVJO3NDHQ7DHHM6HGFYHU6JRKANXRWSHMESRAGLEO7MMPIRGN7FI4TQGBX4A7EE3E7KDDWX456CSDKZ6WJURABE56ZPILA7XV6AUYNZLKLFESAC5HK6TQBDKIFVCMKRWIRYO7IOSIEY7EKQDMWUHZPUQWJ2ASAA4AEYRIQHOPEELWP5J4S2GKXPYD3UQLKDHWP7KZNSKA2ZHDW4HICD6FVONUUJRUVMA4OCTCDNCUIWARGEKTQPH47UCLF6HOCEFEVXOMZEDF27Y72APOV2GFZ45IO344IUHHXFRD62D for https://myosu.oregonstate.edu:443/c/portal/login
2019-03-01 15:14:52,728 - DEBUG [org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine:83] - Attempting to validate untrusted credential
2019-03-01 15:14:52,729 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:81] - Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion for criteria class org.opensaml.security.criteria.UsageCriterion
2019-03-01 15:14:52,730 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:81] - Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableEntityIDCredentialCriterion for criteria class org.opensaml.core.criterion.EntityIdCriterion
2019-03-01 15:14:52,730 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.EntityRoleCriterion
2019-03-01 15:14:52,731 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.ProtocolCriterion
2019-03-01 15:14:52,731 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:137] - Attempting PKIX validation of untrusted credential
2019-03-01 15:14:52,731 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:184] - Beginning PKIX validation using trusted validation information
2019-03-01 15:14:52,732 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:220] - No credential name evaluator was available, skipping trusted name evaluation
2019-03-01 15:14:52,732 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:135] - Attempting PKIX path validation on untrusted credential: [subjectName='CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US']
2019-03-01 15:14:52,771 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:417] - Built valid PKIX cert path
2019-03-01 15:14:52,771 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:418] - Target certificate: CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US
2019-03-01 15:14:52,772 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:420] - CertPath certificate: CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US
2019-03-01 15:14:52,772 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:425] - TrustAnchor: CN=InCommon RSA Server CA,OU=InCommon,O=Internet2,L=Ann Arbor,ST=MI,C=US
2019-03-01 15:14:52,772 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:148] - PKIX validation succeeded for untrusted credential: [subjectName='CN=lum-admin.ucsadm.oregonstate.edu,OU=IS Enterprise Computing,O=Oregon State University,L=Corvallis,ST=Oregon,C=US']
2019-03-01 15:14:52,772 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:194] - Credential trust established via PKIX validation
2019-03-01 15:14:52,772 - DEBUG [org.opensaml.security.trust.impl.ChainingTrustEngine:81] - Token was trusted by chain member: org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine
2019-03-01 15:14:52,942 - DEBUG [org.opensaml.security.trust.impl.ExplicitX509CertificateTrustEngine:83] - Attempting to validate untrusted credential
2019-03-01 15:14:52,943 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:81] - Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion for criteria class org.opensaml.security.criteria.UsageCriterion
2019-03-01 15:14:52,943 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:81] - Registry located evaluable criteria class org.opensaml.security.credential.criteria.impl.EvaluableEntityIDCredentialCriterion for criteria class org.opensaml.core.criterion.EntityIdCriterion
2019-03-01 15:14:52,944 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.EntityRoleCriterion
2019-03-01 15:14:52,944 - DEBUG [org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry:96] - Registry could not locate evaluable criteria for criteria class org.opensaml.saml.criterion.ProtocolCriterion
2019-03-01 15:14:52,944 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:137] - Attempting PKIX validation of untrusted credential
2019-03-01 15:14:52,945 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:184] - Beginning PKIX validation using trusted validation information
2019-03-01 15:14:52,945 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:220] - No credential name evaluator was available, skipping trusted name evaluation
2019-03-01 15:14:52,946 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:135] - Attempting PKIX path validation on untrusted credential: [subjectName='CN=login.oregonstate.edu,OU=COMODO EV SSL,OU=IS IT Infrastructure,O=Oregon State University,STREET=121 Valley Library,L=Corvallis,ST=OR,2.5.4.17=#13053937333331,C=US,2.5.4.15=#1311476f7665726e6d656e7420456e74697479,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.5=#13023030']
2019-03-01 15:14:52,955 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:417] - Built valid PKIX cert path
2019-03-01 15:14:52,955 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:418] - Target certificate: CN=login.oregonstate.edu,OU=COMODO EV SSL,OU=IS IT Infrastructure,O=Oregon State University,STREET=121 Valley Library,L=Corvallis,ST=OR,2.5.4.17=#13053937333331,C=US,2.5.4.15=#1311476f7665726e6d656e7420456e74697479,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.5=#13023030
2019-03-01 15:14:52,955 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:420] - CertPath certificate: CN=login.oregonstate.edu,OU=COMODO EV SSL,OU=IS IT Infrastructure,O=Oregon State University,STREET=121 Valley Library,L=Corvallis,ST=OR,2.5.4.17=#13053937333331,C=US,2.5.4.15=#1311476f7665726e6d656e7420456e74697479,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.5=#13023030
2019-03-01 15:14:52,955 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:425] - TrustAnchor: CN=COMODO RSA Extended Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
2019-03-01 15:14:52,955 - DEBUG [org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator:148] - PKIX validation succeeded for untrusted credential: [subjectName='CN=login.oregonstate.edu,OU=COMODO EV SSL,OU=IS IT Infrastructure,O=Oregon State University,STREET=121 Valley Library,L=Corvallis,ST=OR,2.5.4.17=#13053937333331,C=US,2.5.4.15=#1311476f7665726e6d656e7420456e74697479,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.5=#13023030']
2019-03-01 15:14:52,956 - DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:194] - Credential trust established via PKIX validation
2019-03-01 15:14:52,957 - DEBUG [org.opensaml.security.trust.impl.ChainingTrustEngine:81] - Token was trusted by chain member: org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine
2019-03-01 15:14:53,265 - INFO [Shibboleth-Audit.SSO:275] - 20190301T231453Z|128.193.133.53|||https://myosu.oregonstate.edu:443/c/portal/login|https://www.apereo.org/cas/protocol/serviceValidate||||morgana||commonName,firstname,osuprimarymail,eduPersonAffiliation,osupidm,givenName,osuuid,lastname,uid,eduPersonPrimaryAffiliation,UDC_IDENTIFIER,surname,eduPersonPrincipalName,fullname,email|morgana|ST-AAFHGZLDOJSXIMJRGY3QDEZLWPRWYV22U5MPHPN7ALMQKIIIIW33BVYMTIAC4MHTLCFLZ4GZLBA3CYCUZKEFB7EL4JO4LWGTGVOCGIXJXVJO3NDHQ7DHHM6HGFYHU6JRKANXRWSHMESRAGLEO7MMPIRGN7FI4TQGBX4A7EE3E7KDDWX456CSDKZ6WJURABE56ZPILA7XV6AUYNZLKLFESAC5HK6TQBDKIFVCMKRWIRYO7IOSIEY7EKQDMWUHZPUQWJ2ASAA4AEYRIQHOPEELWP5J4S2GKXPYD3UQLKDHWP7KZNSKA2ZHDW4HICD6FVONUUJRUVMA4OCTCDNCUIWARGEKTQPH47UCLF6HOCEFEVXOMZEDF27Y72APOV2GFZ45IO344IUHHXFRD62D|
Comparing them, this stands out in the v3.4.1 logs:
DEBUG [org.opensaml.security.x509.impl.PKIXX509CredentialTrustEngine:220] - No credential name evaluator was available, skipping trusted name evaluation
It appears that v3.4.1 didn't try to validate the names...
However, I also notice that it seems to be trying to validate the
certificate for login.oregonstate.edu (the IDP hostname) in both versions.
Why is that being checked?
Thanks,
Andy
More information about the users
mailing list