Hi Paul, sorry for my last message, google is my friend too, but sometimes I wrong to cut and paste.<br><br><span id="result_box" class="" lang="en"><span class="hps">There</span> <span class="hps">are 2</span> <span class="hps">nodes</span> <span class="hps">in the infrastructure for</span> <span class="hps">the problem</span> <span class="hps">with the load.</span> <span class="hps">There</span> <span class="hps">are two</span> <span class="hps">applications</span><span class="">, a</span> <span class="hps">php</span> <span class="hps">and</span> <span class="hps">java</span><span class="">.</span> <span class="hps">The choice</span> <span class="hps">to authenticate</span> <span class="hps">on a single</span> <span class="hps">node is</span> <span class="hps">to avoid problems with</span> <span class="hps">cookies</span> <span class="hps">idp</span><span class="">.</span> <span class="hps">To</span> <span class="hps">overcome this</span> <span class="hps">problem and use</span> <span class="hps">both nodes</span> <span class="hps">for</span> <span class="hps">authentication</span> <span class="hps">on the</span> <span class="hps">balancer</span> <span class="hps">I</span> <span class="hps">had to use</span> <span class="hps">the session</span> <span class="hps">continued</span><span class="">,</span> <span class="hps">but it is</span> <span class="hps">a correct choice</span><span class="">.<br>
<br>thanks <br><br></span></span><div class="gmail_quote">2011/11/29 Paul Hethmon <span dir="ltr"><<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>
<div>
<div>Ok, as pointed out to me, Google is my friend:</div>
<div><br>
</div>
<div><span style="color:rgb(51,51,51);font-size:16px;font-family:arial,sans-serif"><span>The environment is</span> <span>composed of</span> <span>2</span> <span>nodes</span> <span>of
which only</span> <span>one is</span> <span>responsible for authenticating</span><span>.</span> <span>In front</span> <span>there is a</span> <span>balancer</span> <span>F5</span> <span>bigip</span><span>.</span> <span>There
is no</span> <span>cluster.</span><br>
<span>I think the problem</span> <span>is related</span> <span>to the load</span><span>,</span> <span>because in</span> <span>this period</span> <span>where the load</span> <span>is
very low,</span> <span>the problem</span> <span>occurs</span> <span>rarely and in</span> <span>any case</span> <span>have never</span> <span>been able to</span> <span>replicate</span><span>despite
the</span> <span>development</span> <span>and production</span> <span>environments</span> <span>are equal.</span><br>
<span>I can only</span> <span>send part</span> <span>of the</span> <span>log where</span> <span>I'm sure</span> <span>that has occurred</span><span>.</span></span></div>
<div>
<div>
<div><br>
</div>
<div>What is the purpose of 2 nodes if only one is doing authentication? How is only one doing authentication? Do you have enough load to require 2 nodes or is that strictly for redundancy? If not for load, can you turn off one node and does the problem persist?
What type of load do you see and what type of machines?</div>
<div><br>
</div>
<div>-- </div>
<div><br>
</div>
</div><div class="im">
<div>
<div>Paul Hethmon</div>
<div>Chief Software Architect</div>
<div>Clareity Security, LLC</div>
<div>o) <a href="tel:865.824.1350" value="+18658241350" target="_blank">865.824.1350</a></div>
<div>c) <a href="tel:865.250.3517" value="+18652503517" target="_blank">865.250.3517</a></div>
<div>e) <a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a></div>
</div>
<div><br>
</div>
</div></div>
</div>
</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<div class="im">
<span style="font-weight:bold">From: </span>Daniele Russo <<a href="mailto:ruda76@gmail.com" target="_blank">ruda76@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
</div><span style="font-weight:bold">Date: </span>Tue, 29 Nov 2011 15:04:52 +0100<div class="im"><br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: null principal in attribute resolver<br>
</div></div><div class="im">
<div><br>
</div>
L'ambiente è composto da 2 nodi di cui solo uno è preposto all'autenticazione. Davanti c'è un bilanciatore F5 bigip. Non c'è cluster.<br>
Penso che il problema è legato al carico, perchè in questo periodo dove il carico è molto basso il problema si verifica raramente e in ogni caso non sono mai riuscito a replicarlo nonostante gli ambienti di sviluppo e produzione siano uguali.<br>
Posso solo inviare parte del log dove sono sicuro che si è verificato.<br>
<br>
Thanks<br>
<br>
</div><div class="gmail_quote">2011/11/29 Paul Hethmon <span dir="ltr"><<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif"><div class="im">
<div>
<div>
<div>Yes, we need to see the error. You'll need to approximate the same steps in production. We have to see the complete log info for that request that does not work. It has to show the initial authentication request, the login itself, the attribute resolution,
and the final saml response to the client. You might also provide some set up information about your production site. Whether you have multiple servers, load balancer, clustering in place, etc. All of those things matter.</div>
<div>
<div><br>
</div>
<div>
<div>
<div>-- </div>
<div><br>
</div>
</div>
<div>
<div>Paul Hethmon</div>
<div>Chief Software Architect</div>
<div>Clareity Security, LLC</div>
<div>o) <a href="tel:865.824.1350" value="+18658241350" target="_blank">865.824.1350</a></div>
<div>c) <a href="tel:865.250.3517" value="+18652503517" target="_blank">865.250.3517</a></div>
<div>e) <a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a></div>
</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
<div><br>
</div>
</div><span><div class="im">
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<div><span style="font-weight:bold">From: </span>Daniele Russo <<a href="mailto:ruda76@gmail.com" target="_blank">ruda76@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
</div>
<span style="font-weight:bold">Date: </span>Tue, 29 Nov 2011 14:53:03 +0100
<div><br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: null principal in attribute resolver<br>
</div>
</div>
</div><div>
<div>
<div><br>
</div>
<span lang="en"><span>Hello</span> <span>Paul, this</span> <span>error does not occur</span>
<span>to any request to</span> <span>login</span> <span>and above</span><span>only in</span>
<span>production environment</span><span>.</span><div class="im"><br>
<span>I think you</span> <span>want to see the</span> <span>logs when</span> <span>
this error occurs</span><span>, or</span> <span>am I wrong?<br>
Vuoi che seguo comunque le tue istruzioni?<br>
<br>
Thanks<br>
</span></div></span><div class="im"><br>
<div class="gmail_quote">2011/11/29 Paul Hethmon <span dir="ltr"><<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>
<div>
<div>You need to follow these steps if you want any meaningful help:</div>
<div><br>
</div>
<div>1. Shut down the idp</div>
<div>2. Clear all logs</div>
<div>3. Turn on the idp</div>
<div>4. Wait until the idp fully starts, check the process.log</div>
<div>5. Do one login</div>
<div>6. Shut down the idp</div>
<div>7. Post the process.log file starting with the very first authentication request</div>
<div><br>
</div>
<div>You can look at the process.log file at step 4 and note the last line in it. Post everything past that point.</div>
<span><font color="#888888">
<div><br>
</div>
<div>Paul</div>
<div><br>
<br>
</div>
</font></span></div>
</div>
<span></span></div>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
<br>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></div></div>
</div>
</span></div><div class="im">
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</div></blockquote>
</div><div class="im">
<br>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></div></span>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>