<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>
<div>
<div>Ok, as pointed out to me, Google is my friend:</div>
<div><br>
</div>
<div><span class="Apple-style-span" style="color: rgb(51, 51, 51); font-size: 16px; font-family: arial, sans-serif; "><span class="hps">The environment is</span> <span class="hps">composed of</span> <span class="hps">2</span> <span class="hps">nodes</span> <span class="hps">of
which only</span> <span class="hps">one is</span> <span class="hps">responsible for authenticating</span><span class="">.</span> <span class="hps">In front</span> <span class="hps">there is a</span> <span class="hps">balancer</span> <span class="hps">F5</span> <span class="hps">bigip</span><span class="">.</span> <span class="hps">There
is no</span> <span class="hps">cluster.</span><br>
<span class="hps">I think the problem</span> <span class="hps">is related</span> <span class="hps">to the load</span><span class="">,</span> <span class="hps">because in</span> <span class="hps">this period</span> <span class="hps">where the load</span> <span class="hps">is
very low,</span> <span class="hps">the problem</span> <span class="hps">occurs</span> <span class="hps">rarely and in</span> <span class="hps">any case</span> <span class="hps">have never</span> <span class="hps">been able to</span> <span class="hps">replicate</span><span class="hps">despite
the</span> <span class="hps">development</span> <span class="hps">and production</span> <span class="hps">environments</span> <span class="hps">are equal.</span><br>
<span class="hps">I can only</span> <span class="hps">send part</span> <span class="hps">of the</span> <span class="hps">log where</span> <span class="hps">I'm sure</span> <span class="hps">that has occurred</span><span class="">.</span></span></div>
<div>
<div>
<div><br>
</div>
<div>What is the purpose of 2 nodes if only one is doing authentication? How is only one doing authentication? Do you have enough load to require 2 nodes or is that strictly for redundancy? If not for load, can you turn off one node and does the problem persist?
What type of load do you see and what type of machines?</div>
<div><br>
</div>
<div>-- </div>
<div><br>
</div>
</div>
<div>
<div>Paul Hethmon</div>
<div>Chief Software Architect</div>
<div>Clareity Security, LLC</div>
<div>o) 865.824.1350</div>
<div>c) 865.250.3517</div>
<div>e) paul.hethmon@clareitysecurity.com</div>
</div>
<div><br>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Daniele Russo <<a href="mailto:ruda76@gmail.com">ruda76@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Tue, 29 Nov 2011 15:04:52 +0100<br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: null principal in attribute resolver<br>
</div>
<div><br>
</div>
L'ambiente è composto da 2 nodi di cui solo uno è preposto all'autenticazione. Davanti c'è un bilanciatore F5 bigip. Non c'è cluster.<br>
Penso che il problema è legato al carico, perchè in questo periodo dove il carico è molto basso il problema si verifica raramente e in ogni caso non sono mai riuscito a replicarlo nonostante gli ambienti di sviluppo e produzione siano uguali.<br>
Posso solo inviare parte del log dove sono sicuro che si è verificato.<br>
<br>
Thanks<br>
<br>
<div class="gmail_quote">2011/11/29 Paul Hethmon <span dir="ltr"><<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>
<div>
<div>Yes, we need to see the error. You'll need to approximate the same steps in production. We have to see the complete log info for that request that does not work. It has to show the initial authentication request, the login itself, the attribute resolution,
and the final saml response to the client. You might also provide some set up information about your production site. Whether you have multiple servers, load balancer, clustering in place, etc. All of those things matter.</div>
<div class="im">
<div><br>
</div>
<div>
<div>
<div>-- </div>
<div><br>
</div>
</div>
<div>
<div>Paul Hethmon</div>
<div>Chief Software Architect</div>
<div>Clareity Security, LLC</div>
<div>o) <a href="tel:865.824.1350" value="+18658241350" target="_blank">865.824.1350</a></div>
<div>c) <a href="tel:865.250.3517" value="+18652503517" target="_blank">865.250.3517</a></div>
<div>e) <a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a></div>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<div class="im"><span style="font-weight:bold">From: </span>Daniele Russo <<a href="mailto:ruda76@gmail.com" target="_blank">ruda76@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
</div>
<span style="font-weight:bold">Date: </span>Tue, 29 Nov 2011 14:53:03 +0100
<div class="im"><br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: null principal in attribute resolver<br>
</div>
</div>
<div>
<div class="h5">
<div><br>
</div>
<span lang="en"><span>Hello</span> <span>Paul, this</span> <span>error does not occur</span>
<span>to any request to</span> <span>login</span> <span>and above</span><span>only in</span>
<span>production environment</span><span>.</span><br>
<span>I think you</span> <span>want to see the</span> <span>logs when</span> <span>
this error occurs</span><span>, or</span> <span>am I wrong?<br>
Vuoi che seguo comunque le tue istruzioni?<br>
<br>
Thanks<br>
</span></span><br>
<div class="gmail_quote">2011/11/29 Paul Hethmon <span dir="ltr"><<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>
<div>
<div>You need to follow these steps if you want any meaningful help:</div>
<div><br>
</div>
<div>1. Shut down the idp</div>
<div>2. Clear all logs</div>
<div>3. Turn on the idp</div>
<div>4. Wait until the idp fully starts, check the process.log</div>
<div>5. Do one login</div>
<div>6. Shut down the idp</div>
<div>7. Post the process.log file starting with the very first authentication request</div>
<div><br>
</div>
<div>You can look at the process.log file at step 4 and note the last line in it. Post everything past that point.</div>
<span><font color="#888888">
<div><br>
</div>
<div>Paul</div>
<div><br>
<br>
</div>
</font></span></div>
</div>
<span></span></div>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
<br>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></div>
</div>
</span></div>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
<br>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></span>
</body>
</html>