One of the interesting things is this only seems to happen when I don't have a pre-existing session on our partner's system. Right now, to test the connection I go to their website and login. Then, using a link to their IDP (with our protected resource as a query parameter), the IDP then initiates the SAML connection and I am redirected to my site's page and have a valid session. Which indicates to me that the signing works quite well in the happy path. My guess is they are passing me something in the not-as-happy path that our SP doesn't like. You mentioned a stack trace as another place to look, I haven't seen any stack traces in any of the logs. A stack trace is exactly what I would like to see, as well as the response our SP is tripping over. I am fairly certain that the issue is one of configuration.<div>
<br></div><div>Thanks,</div><div><br></div><div>Rob<br><br><div class="gmail_quote">On Thu, Jul 12, 2012 at 5:24 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 7/12/12 3:51 PM, "Rob Whitener" <<a href="mailto:rob.whitener@audaxhealth.com">rob.whitener@audaxhealth.com</a>> wrote:<br>
><br>
>Things were going pretty smoothly with our Shibboleth SP installation and<br>
>configuration and suddenly today, the shibd process appears to be<br>
>crashing during the computation of the signature after receiving a<br>
>response from the IDP (I think). Here is what<br>
> I am seeing in the /var/log/shibboleth/shibd.log when it goes down:<br>
<br>
</div>Yes, those are some indirect logging messages inside libxml-security. I'd<br>
have to check that code, I don't know if there are any messages that<br>
would show up after that.<br>
<br>
If it was working, then something had to have changed of course.<br>
<br>
Is there a reason you're signing the requests? Not that it's a good<br>
answer, but that's not generally of any value, so undoing that might at<br>
least be a workaround.<br>
<div class="im"><br>
>Our partner is using a Tivoly SAML solution. Beyond syslog and<br>
>shibd.log, is there another place I can look to help debug this?<br>
<br>
</div>A stack trace.<br>
<div class="im"><br>
>Has anyone seen this problem before?<br>
<br>
</div>Unpatched libxml-security has issues signing or verifying with large RSA<br>
keys (which we put out a security advisory for).<br>
<div class="im"><br>
> Also, I am using an unsupported version on an unsupported OS:<br>
>Shibboleth 2.3.1 on Ubuntu<br>
> 10.04.<br>
<br>
</div>If it's crashing there, it has nothing to do with the Shibboleth version.<br>
If it's not the latest xmlsec code, that probably is the only fix.<br>
<br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>