<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div apple-content-edited="true">
<div><font face="Arial">Hello - I'm asking for some assistance in troubleshooting a connection between our </font>Shibboleth SP Version 2.4.2 and an IdP running version 1.3.1.</div><div><font face="Arial"><div><font face="Arial"><br></font></div><div><font face="Arial">Most of the time, login is working as expected, but occassionally, we're missing attributes on return. For example, from our logs:</font></div><div><font face="Arial"><br></font></div><div><font face="Arial">Bad sign-in (no attributes returned)</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:09 INFO Shibboleth-TRANSACTION [1]: New session (ID: _25xxx) with (applicationId: default) for principal from (IdP: urn:mace:incommon:northwestern.edu) at (ClientAddress: 98.213.53.61) with (NameIdentifier: C3xxx) using (Protocol: urn:oasis:names:tc:SAML:1.1:protocol) from (AssertionID: _a17b2103c1ecbb9ad51b6d8275f10df1)</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:09 INFO Shibboleth-TRANSACTION [1]: Cached the following attributes with session (ID: _25xxx) for (applicationId: default) {</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:09 INFO Shibboleth-TRANSACTION [1]: }</font></div><div><font class="Apple-style-span" face="'Courier New'"><br></font></div><div><font class="Apple-style-span" face="'Courier New'"><span class="Apple-style-span" style="font-family: Arial; ">Good sign-in (all attributes returned)</span></font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: New session (ID: _9fxxx) with (applicationId: default) for principal from (IdP: urn:mace:incommon:northwestern.edu) at (ClientAddress: 98.213.53.61) with (NameIdentifier: EBxxx) using (Protocol: urn:oasis:names:tc:SAML:1.1:protocol) from (AssertionID: _2652ab6540ed07ba5f4fb4327d8ddb97)</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: Cached the following attributes with session (ID: _9fxxx) for (applicationId: default) {</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: <span class="Apple-tab-span" style="white-space: pre; "> </span>uid (1 values)</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: <span class="Apple-tab-span" style="white-space: pre; "> </span>mail (1 values)</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: <span class="Apple-tab-span" style="white-space: pre; "> </span>eduPersonPrimaryAffiliation (1 values)</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: <span class="Apple-tab-span" style="white-space: pre; "> </span>nuSnapGroups (18 values)</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: <span class="Apple-tab-span" style="white-space: pre; "> </span>nuallschoolaffiliations (48 values)</font></div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:18:35 INFO Shibboleth-TRANSACTION [1]: } </font></div><div><font class="Apple-style-span" face="'Courier New'"><br></font></div><div>Nothing changes on the SP or IdP configuration in between good and bad logins. Often we can go weeks without a problem, and then have several days where the login is up and down throughout the day. </div><div><br></div><div>On the SP, I do see these error messages:</div><div><font class="Apple-style-span" face="'Courier New'">2012-03-29 14:06:52 ERROR Shibboleth.Listener [4880] isapi_shib: socket call resulted in error (10054): Unknown error</font></div><div><font class="Apple-style-span" face="'Courier New'"><br></font></div><div><font class="Apple-style-span" face="'Courier New'"><div>2012-03-29 14:18:09 ERROR Shibboleth.AttributeResolver.Query [1]: exception during SAML query to <a href="https://fed.it.northwestern.edu:8443/shibboleth-idp/AA:">https://fed.it.northwestern.edu:8443/shibboleth-idp/AA:</a> CURLSOAPTransport failed while contacting SOAP endpoint (<a href="https://fed.it.northwestern.edu:8443/shibboleth-idp/AA">https://fed.it.northwestern.edu:8443/shibboleth-idp/AA</a>): Connection time-out</div><div><br></div><div>2012-03-29 14:18:09 ERROR Shibboleth.AttributeResolver.Query [1]: unable to obtain a SAML response from attribute authority</div><div style="font-size: 11px; "><br></div></font>Kind Regards,</div><div>Gordon</div>
<div><font face="Arial"><br></font></div><br>
<font color="#447799" style="font-size: 10pt; ">
Gordon Capreol | UNIVERSITYTICKETS | 2640 RT 9W | Cornwall | NY | 12518 | p: 646-355-UTIX (8849) | f: 212-937-2299 | <a href="mailto:gcapreol@universitytickets.com">gcapreol@universitytickets.com</a>
</font><font color="#6699aa" style="font-size: 10pt; ">
</font></font><p><font face="Arial" style="font-size:10pt"><font color="#6699aa"><i>
For emergency support, please contact 888-771-1420 or <a href="mailto:support@universitytickets.com">support@universitytickets.com</a>
</i></font>
</font>
</p></div>
</div>
<br></body></html>