IPv4 / IPv6 Problem?

[Ottenhus, Thomas]

Hi all,

I'm trying to setup a shibboleth server as federation gateway and protocol transitioning server.
Essentially its: local app -> shib-server (/w open-id) -> Federation IDPs

I got to the point, that the authentication will be triggered, I choose the IDP I want to use via WAYF (or Discovery) and got a SAML Token, that can be decoded back in my Federation-Gateway (or IDP Proxy or whatever you want to call it).

There I'm stuck and found the following debug messages after which I get the error message:


DEBUG [org.opensaml.saml.saml2.assertion.impl.AssertionValidationSupport:65] - Evaluating SubjectConfirmationData/@Address value of: 134.93.179.74
DEBUG [org.opensaml.saml.saml2.assertion.impl.AssertionValidationSupport:79] - SubjectConfirmationData/@Address was resolved to addresses: [/134.93.179.74]
DEBUG [org.opensaml.saml.saml2.assertion.impl.AssertionValidationSupport:108] - Failed to match SubjectConfirmationData/@Address to any supplied valid addresses: [/2001:4c80:40:4b3:b25c:daff:fe34:1495]
DEBUG [org.opensaml.saml.saml2.assertion.SAML20AssertionValidator:896] - No subject confirmation methods were met for assertion with ID '_edc867b30d74a4e18d42859b28dfff91'
DEBUG [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:299] - Profile Action ValidateAssertions: Assertion validation result was: INVALID
INFO [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:301] - Profile Action ValidateAssertions: Assertion validation failure msg was: No subject confirmation methods were met for assertion with ID '_edc867b30d74a4e18d42859b28dfff91'
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:217] - Profile Action ProcessAssertionsForAuthentication: Removing 1 non-valid Assertions from Response
INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:228] - Profile Action ProcessAssertionsForAuthentication: No valid SAML Assertions suitable for authentication were found
NFO [Shibboleth-Audit.SSO:338] - 2001:4c80:40:4b3:b25c:daff:fe34:1495||2023-03-15T09:06:36.863292Z||https://shib.uni-mainz.de/idp/shibboleth||||||||false||Redirect||InvalidCredentials||||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41
INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set
DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:274] - Profile Action SelectAuthenticationFlow: No specific Principals requested
DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:312] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractBuildErrorResponseFromEvent:159] - Profile Action BuildAuthenticationErrorResponseFromEvent: No mapped event found for NoPotentialFlow, creating general invalid_request
DEBUG [net.shibboleth.idp.plugin.oidc.op.profile.impl.AbstractBuildErrorResponseFromEvent:166] - Profile Action BuildAuthenticationErrorResponseFromEvent: ErrorResponse successfully set as the outbound message
WARN [DEPRECATED:128] - Java class method 'setHttpServletResponse', (net.shibboleth.idp.plugin.oidc.op.encoding.impl.NimbusResponseEncoder): This will be removed in the next major version of this software; replacement is setHttpServletResponseSupplier
INFO [Shibboleth-Audit.OIDC.SSO:338] - 2001:4c80:40:4b3:b25c:daff:fe34:1495|2023-03-15T09:06:35.315488Z,2023-03-15T09:06:32.121212Z|2023-03-15T09:06:36.933848Z||OIDC-test-client||||||||||AuthenticationRequest|AuthenticationErrorResponse|NoPotentialFlow||||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41
DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile Action RecordResponseComplete: Record response complete


The IPAddressees above both resolve to the same (my browser) machine - so this looks like a problem with IPAddress resolving to me

Thomas Ottenhus (geb. Glatzer)
Zentrum für Datenverarbeitung (ZDV)
Leiter Softwareentwicklung

Johannes Gutenberg-Universität Mainz
Anselm-Franz-von-Bentzel-Weg 12, 55128 Mainz

Tel: +49 6131 39 26487
ottenhus at uni-mainz.de<mailto:ottenhus at uni-mainz.de>
zdvdev at uni-mainz.de<mailto:zdvdev at uni-mainz.de>
https://www.zdv.uni-mainz.de<https://www.zdv.uni-mainz.de/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230315/4fc93efe/attachment.htm>