SP v4 alpha2 testing

[Jarno Huuskonen]

Hello,

I'm testing testing SP v4 alpha2. (Use case would be shared hub for
multiple existing SPs (all with different certs), some will use one
IdP(p:authenticatingAuthority) and some will use
discovery(p:discoveryService)).

Couple of things are not super clear: does the hub need metadata for
existing SPs or just metadata for all IdPs (that SPs use for
authentication) ? From what I understand from the docs, only IdPs
metadata is needed ?

Second thing that's not clear from hub docs is how to configure
existing certs for agents, I can certainly copy cert/keys to
/credentials/sp/, but so far I haven't figured out how to configure
different cert/key for each agent. Do I need to add all cert/keys as
shibboleth.sp.EncryptionCredentials in sp/saml-credentials.xml then
somehow configure each for each agent ?

Problem for now is that if agent issues request to IdP
/idp/profile/sp/session-initiator it fails with uncaught exception:

agent.ini has (urls a little sanitized)
[remoting]
agentID = agentid-here
baseURL = https://hostname-redacted/idp/profile/sp/
enableIP4=true
enableIP6=false
authMethod = basic
#authCachingCookie = __Host-JSESSIONID
tlsCAFile = /etc/shibboleth-sp/ca-hub.pem
secretSourceType = File
secretFile = /etc/shibboleth-sp/agent.pwd

remotehub sp/agent.xml has:
    <bean p:id="agentid-here" parent="shibboleth.sp.Agent"
      p:issuer="entityIDofthisSP"
p:authenticatingAuthority="https://idp.uef.fi/idp/shibboleth"
      p:tokenConsumers="#{{ 'saml2/post' }}"
      p:authenticationMethod="basic" p:credentials="#{ {null :
'password_removed'} }"
      p:allowedAddressRanges="#{ { 'a.b.c.d/23', 'x:y:z::/64' } }" />

When I call agent/SP /secure url, agent makes call to hub (logging is
in json, so I just copied message part (on logs that look ok/normal)
(in logback.xml I've:
    <logger name="net.shibboleth.sp" level="DEBUG"/>
    <logger name="net.shibboleth.sp.profile.session.initiator"
level="TRACE"/>
but doesn't seem to log more details):

"message": "Profile Action InitializeAgentRequestContext: Resolved
requesting agent 'agentid-here'"
"message": "Profile Action ValidateAgentAddress: Request permitted from
agent 'agentid-here' from a.b.c.x"
"message": "Profile Action ValidateCachedAuthentication: No session
record for request from agent 'agentid-here', full authentication will
proceed"
"message": "Credential Validator spagent-internal: Attempting to
authenticate agent 'agentid-here' with username 'agentid-here'"
"message": "Credential Validator spagent-internal: Authentication of
agent 'agentid-here' with username 'null' succeeded",
"message": "Profile Action DecodeAgentRequest: Wrapping tunnelled HTTP
request"
"message": "Profile Action DecodeAgentRequest: Decoded message with
transaction ID 'redacted'"
"message": "Profile Action ResolveApplication: Request from agent
'agentid-here' mapped to application 'default'"
"message": "Profile Action RecoverStateData: No state token returned
from lookup strategy, nothing to do"
"message": "Profile Action ValidateSessionInitiatorRequest: Evaluating
applicability of request to saml2 session initiator flow"
"message": "Profile Action ValidateSessionInitiatorRequest: Initialized
RelyingPartyContext for https://idp.uef.fi/idp/shibboleth"
"message": "Profile Action SelectRelyingPartyConfiguration: Found
relying party configuration agentid-here for request"

So far this looks ok ? But next one is error/uncaught exception:

"message": "Uncaught runtime exception",
"log.logger": "net.shibboleth.sp.profile.session.initiator",
"sp.application_id": "default",
"error.type": "java.lang.NullPointerException",
"error.message": "Cannot invoke \"Object.hashCode()\" because \"pk\" is
null",
Stack trace is:

  "error.stack_trace": "java.lang.NullPointerException: Cannot invoke
\"Object.hashCode()\" because \"pk\" is null
        at
java.base/java.util.ImmutableCollections$MapN.probe(ImmutableCollection

s.java:1328)
        at
java.base/java.util.ImmutableCollections$MapN.get(ImmutableCollections.

java:1242)
        at
net.shibboleth.sp.saml.saml2.profile.impl.AddAuthnRequest.lambda$setRes

ponseEndpoint$0(AddAuthnRequest.java:419)
        at
java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeli

ne.java:178)
        at
java.base/java.util.AbstractList$RandomAccessSpliterator.tryAdvance(Abs

tractList.java:708)
        at
java.base/java.util.stream.ReferencePipeline.forEachWithCancel(Referenc

ePipeline.java:129)
        at
java.base/java.util.stream.AbstractPipeline.copyIntoWithCancel(Abstract

Pipeline.java:527)
        at
java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.j

ava:513)
        at
java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPip

eline.java:499)
        at
java.base/java.util.stream.FindOps$FindOp.evaluateSequential(FindOps.ja

va:150)
        at
java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.j

ava:234)
        at
java.base/java.util.stream.ReferencePipeline.findFirst(ReferencePipelin

e.java:647)
        at
net.shibboleth.sp.saml.saml2.profile.impl.AddAuthnRequest.setResponseEn

dpoint(AddAuthnRequest.java:420)
        at
net.shibboleth.sp.saml.saml2.profile.impl.AddAuthnRequest.doExecute(Add

AuthnRequest.java:317)
        at
org.opensaml.profile.action.AbstractProfileAction.execute(AbstractProfi

leAction.java:170)
        at
net.shibboleth.idp.profile.AbstractProfileAction.doExecute(AbstractProf

ileAction.java:156)
        at
net.shibboleth.idp.profile.AbstractProfileAction.execute(AbstractProfil

eAction.java:127)
        at
jakarta.servlet.http.HttpServlet.service(HttpServlet.java:649)
        at
jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
        at
net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(Abstra

ctConditionalFilter.java:83)
        at
net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(Abstra

ctConditionalFilter.java:83)
        at
net.shibboleth.idp.conf.impl.SLF4JMDCServletFilter.runFilter(SLF4JMDCSe

rvletFilter.java:115)
        at
net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(Abstra

ctConditionalFilter.java:83)
        at java.base/java.lang.Thread.run(Thread.java:1583)

(with lots of at org.springframework.webflow.engine. / removed).

There's probably something really basic missing ? Is it trying to
figure out SP's entityID or AssertionConsumerService Binding ?

Any hints / which logger should help figure out what's the problem ?

-Jarno

-- 
Jarno Huuskonen