SSO Session Cookies

Wed Feb 5 06:45:38 UTC 2025

Thanks both for answer. Browser is a private window.
I see a cookie named "__Host-JSESSIONID" which correct domain and Path of "/"

No errors in logs. This is the snippet from idp-process.log upon the 2nd attempt to another SP after user has logged in.

Don't know how to debug this further since this is also related to the browser.

2025-02-05 08:39:56,482 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler' on INBOUND message context
2025-02-05 08:39:56,482 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,483 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml1.binding.impl.SAML1ArtifactRequestIssuerHandler' on INBOUND message context
2025-02-05 08:39:56,483 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,483 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler' on INBOUND message context
2025-02-05 08:39:56,484 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,485 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler' on INBOUND message context
2025-02-05 08:39:56,485 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,485 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:126] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer https://delos365.grnet.gr/shibboleth
2025-02-05 08:39:56,486 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:178] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.DefaultRelyingParty for request
2025-02-05 08:39:56,487 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'net.shibboleth.idp.saml.messaging.impl.AddAttributeConsumingServiceHandler' on INBOUND message context
2025-02-05 08:39:56,487 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,489 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:138] - Profile Action PopulateProfileInterceptorContext: No inbound interceptor flows active for this request
2025-02-05 08:39:56,491 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.FunctionMessageHandler' on INBOUND message context
2025-02-05 08:39:56,491 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,491 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler' on INBOUND message context
2025-02-05 08:39:56,491 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,495 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler' on INBOUND message context
2025-02-05 08:39:56,495 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,496 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler' on INBOUND message context
2025-02-05 08:39:56,496 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,497 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'net.shibboleth.idp.saml.messaging.impl.SAML2AuthnRequestsSignedSecurityHandler' on INBOUND message context
2025-02-05 08:39:56,497 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,497 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler' on INBOUND message context
2025-02-05 08:39:56,497 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,498 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler' on INBOUND message context
2025-02-05 08:39:56,498 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,499 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler' on INBOUND message context
2025-02-05 08:39:56,499 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,500 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.CheckMandatoryIssuer' on INBOUND message context
2025-02-05 08:39:56,500 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,500 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext:147] - Profile Action InitializeOutboundMessageContext: Initialized outbound message context
2025-02-05 08:39:56,501 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:399] - Profile Action PopulateBindingAndEndpointContexts: Attempting to resolve endpoint of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService for outbound message
2025-02-05 08:39:56,502 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:553] - Profile Action PopulateBindingAndEndpointContexts: Populating template endpoint for resolution from SAML AuthnRequest
2025-02-05 08:39:56,503 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:457] - Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint at location https://delos365.grnet.gr/Shibboleth.sso/SAML2/POST using binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2025-02-05 08:39:56,506 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:297] - Profile Action PopulateEncryptionParameters: Encryption for assertions (true), identifiers (false), attributes(false)
2025-02-05 08:39:56,506 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:307] - Profile Action PopulateEncryptionParameters: Resolving EncryptionParameters for request
2025-02-05 08:39:56,506 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:376] - Profile Action PopulateEncryptionParameters: Adding entityID to resolution criteria
2025-02-05 08:39:56,507 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:388] - Profile Action PopulateEncryptionParameters: Adding role metadata to resolution criteria
2025-02-05 08:39:56,508 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:324] - Profile Action PopulateEncryptionParameters: Resolved EncryptionParameters
2025-02-05 08:39:56,511 - DEBUG [net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:137] - Profile Action ExtractSubjectFromRequest: No Subject NameID/NameIdentifier in message needs inbound processing
2025-02-05 08:39:56,512 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.impl.ExtractProxiedRequestersHandler' on INBOUND message context
2025-02-05 08:39:56,513 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2025-02-05 08:39:56,513 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:244] - Profile Action InitializeAuthenticationContext: AuthnRequest did not contain Scoping, nothing to do
2025-02-05 08:39:56,514 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:226] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2025-02-05T06:39:56.513894615Z, isPassive=false, forceAuthn=false, requiredName=null, hintedName=null, maxAge=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, authenticationResult=null, completionInstant=null}
2025-02-05 08:39:56,518 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:162] - Profile Action ProcessRequestedAuthnContext: AuthnRequest did not contain a RequestedAuthnContext, nothing to do
2025-02-05 08:39:56,520 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:203] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext
2025-02-05 08:39:56,520 - DEBUG [net.shibboleth.idp.session.impl.PopulateSessionContext:140] - Profile Action PopulateSessionContext: No session found for client
2025-02-05 08:39:56,522 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:146] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods
2025-02-05 08:39:56,522 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:54] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
2025-02-05 08:39:56,523 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:54] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2025-02-05 08:39:56,523 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:270] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2025-02-05 08:39:56,523 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:309] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
2025-02-05 08:39:56,524 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:368] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/Password
2025-02-05 08:39:56,524 - DEBUG [net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth:141] - Profile Action ExtractUsernamePasswordFromBasicAuth: No appropriate Authorization header found
2025-02-05 08:39:56,551 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:574] - Found Name 'DELOS 365' for Locale 'en'
2025-02-05 08:39:56,552 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:800] - No UIInfo or logos returning null
2025-02-05 08:39:56,552 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:615] - Found Name 'DELOS 365 brings together GRNET's DELOS Identity Federation and Office 365' for Locale 'en'

G

On 04/02/2025 14:47, Cantor, Scott via users wrote:
>> Can please someone have a look on this?
> "Somebody" is welcome to, but I am not in a position to debug your IdP for you. See list footer for why.
>
> You need to start with your logs. If it's reporting a failure to reuse a session or a login result, it's going to say something about that. If it's not seeing a session, then that's a different sort of issue.
>
> -- Scott
>
>