[EXTERNAL] Using Azure Application Gateway in front of IDPv4 - Stale Request error
Timothy Enders
tenders at loyola.edu
Tue Apr 25 14:58:59 UTC 2023
In reference to my last email, here's a debug log dump from an IDP node for one of the tests through samltest.id that generates the Stale Request error:
2023-04-25 14:41:50,579 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler' on INBOUND message context
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml1.binding.impl.SAML1ArtifactRequestIssuerHandler' on INBOUND message context
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler' on INBOUND message context
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler' on INBOUND message context
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:131] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer https://samltest.id/saml/sp
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:253] - Resolving relying party configuration
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:265] - Checking if relying party configuration EntityNames[https://samltest.id/saml/sp,] is applicable
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:267] - Relying party configuration EntityNames[https://samltest.id/saml/sp,] is applicable
2023-04-25 14:41:50,594 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:174] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration EntityNames[https://samltest.id/saml/sp,] for request
2023-04-25 14:41:50,610 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:147] - Profile Action PopulateProfileInterceptorContext: No inbound interceptor flows active for this request
2023-04-25 14:41:50,610 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler' on INBOUND message context
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler' on INBOUND message context
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler' on INBOUND message context
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler' on INBOUND message context
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler' on INBOUND message context
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler' on INBOUND message context
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler' on INBOUND message context
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.CheckMandatoryIssuer' on INBOUND message context
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2023-04-25 14:41:50,625 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext:153] - Profile Action InitializeOutboundMessageContext: Initialized outbound message context
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:401] - Profile Action PopulateBindingAndEndpointContexts: Attempting to resolve endpoint of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService for outbound message
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:542] - Profile Action PopulateBindingAndEndpointContexts: Populating template endpoint for resolution from SAML AuthnRequest
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:452] - Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint at location https://samltest.id/Shibboleth.sso/SAML2/POST using binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:382] - No AttributeConsumingService was resolved, won't be able to determine delegation requested status via metadata
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:515] - No AttributeConsumingService was available
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:500] - Delegation request was not explicitly indicated, using default value: NOT_REQUESTED
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:289] - Issuance of a delegated Assertion is not in effect, skipping further processing
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:290] - Profile Action PopulateEncryptionParameters: No encryption requested, nothing to do
2023-04-25 14:41:50,641 - DEBUG [net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:143] - Profile Action ExtractSubjectFromRequest: No Subject NameID/NameIdentifier in message needs inbound processing
2023-04-25 14:41:50,657 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.impl.ExtractProxiedRequestersHandler' on INBOUND message context
2023-04-25 14:41:50,657 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
Any thoughts from anyone? I am very rusty with Shib.
Thank you!
-Tim
Tim Enders
Associate Director, IT Infrastructure
Servers and Storage
[1518788691975_Loyola.jpg]
4501 N. Charles Street
Baltimore, MD 21210
tenders at loyola.edu<mailto:tenders at loyola.edu>
Office- 410-617-2542
www.loyola.edu
<http://www.twitter.com/LoyolaMaryland>
<http://www.twitter.com/LoyolaMaryland>
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Timothy Enders via users <users at shibboleth.net>
Sent: Tuesday, April 25, 2023 10:30 AM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Timothy Enders <tenders at loyola.edu>
Subject: [EXTERNAL] Using Azure Application Gateway in front of IDPv4 - Stale Request error
Sender is external to Loyola
Hi all:
We are trying to put our (Windows) Shibboleth IDP servers in Azure, behind an Azure Application Gateway v2.
We have the Application Gateway configured, and it properly passes traffic to the Shibboleth nodes, has session stickiness, etc. If you visit https://idpurlgoeshere/idp/shibboleth you get the metadata page as expected.
However, when we try to test an auth flow (using samltest.id) Shibboleth immediately returns a Stale Request error, before it tries to process an auth flow or do anything else.
My suspicion is that there's something that the App Gateway is doing when it passes the request from the user to Shibboleth that's causing Shibboleth to think the request is invalid and so it's throwing the Stale Request, but I don't know what.
Has anyone else here done this config before? Any thoughts?
Thank you!
Tim Enders
Associate Director, IT Infrastructure
Servers and Storage
[1518788691975_Loyola.jpg]
4501 N. Charles Street
Baltimore, MD 21210
tenders at loyola.edu<mailto:tenders at loyola.edu>
Office- 410-617-2542
www.loyola.edu
<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.twitter.com%2FLoyolaMaryland&data=05%7C01%7Ctenders%40loyola.edu%7Cd0355446d216482d575308db4599a9c3%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C0%7C638180298511338271%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ammGRWF0%2Fb9f6lBibNZ4JOVh92FFwnvjggnNIeimfjk%3D&reserved=0>
<https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.twitter.com%2FLoyolaMaryland&data=05%7C01%7Ctenders%40loyola.edu%7Cd0355446d216482d575308db4599a9c3%7C30ae0a8f3cdf44fdaf34278bf639b85d%7C0%7C0%7C638180298511338271%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ammGRWF0%2Fb9f6lBibNZ4JOVh92FFwnvjggnNIeimfjk%3D&reserved=0>
Loyola University Maryland Internal Use Only
Loyola University Maryland Internal Use Only
Loyola University Maryland Internal Use Only
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230425/9c17f03f/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-1518788691.jpg
Type: image/jpeg
Size: 8726 bytes
Desc: Outlook-1518788691.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20230425/9c17f03f/attachment.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-1518788691.jpg
Type: image/jpeg
Size: 8726 bytes
Desc: Outlook-1518788691.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20230425/9c17f03f/attachment-0001.jpg>
More information about the users
mailing list