Hi Scott,<div><br></div><div>I believe the version of libxml-security we are using is 15.0.1 :</div><div><br></div><div><div>root@VM:/# find / -name libxml-security*</div><div>/var/lib/dpkg/info/libxml-security-c15.postinst</div>
<div>/var/lib/dpkg/info/libxml-security-c15.md5sums</div><div>/var/lib/dpkg/info/libxml-security-c15.postrm</div><div>/var/lib/dpkg/info/libxml-security-c15.shlibs</div><div>/var/lib/dpkg/info/libxml-security-c15.list</div>
<div>/usr/share/doc/libxml-security-c15</div><div>/usr/lib/libxml-security-c.so.15</div><div><span style="background-color:rgb(255,255,51)">/usr/lib/libxml-security-c.so.15.0.1</span></div><div><span style="background-color:rgb(255,255,51)"><br>
</span></div><div><span style="background-color:rgb(255,255,255)">The key we are using is 1675 bytes including the begin and end delimitters, and its RSA.</span></div><div><span style="background-color:rgb(255,255,255)"><br>
</span></div><div><span style="background-color:rgb(255,255,255)">Also, I am going to try attaching the debugger to try and get a stack trace, but first I thought I would try out the simple route of turning off the signing to see if that solves it. If I remove this element:</span></div>
<div><span style="background-color:rgb(255,255,255)"><br></span></div><div><span style="background-color:rgb(255,255,255)"><PolicyRule type="XMLSigning" errorFatal="true"/></span></div><div><span style="background-color:rgb(255,255,255)"><br>
</span></div><div><span style="background-color:rgb(255,255,255)">from my <Policy> element, is that what turns off the signing?</span></div><div><span style="background-color:rgb(255,255,255)"><br></span></div><div>
<span style="background-color:rgb(255,255,255)">Thanks,</span></div><div><span style="background-color:rgb(255,255,255)"><br></span></div><div><span style="background-color:rgb(255,255,255)">Rob</span></div><br><div class="gmail_quote">
On Thu, Jul 12, 2012 at 7:41 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 7/12/12 5:38 PM, "Rob Whitener" <<a href="mailto:rob.whitener@audaxhealth.com">rob.whitener@audaxhealth.com</a>> wrote:<br>
><br>
>One of the interesting things is this only seems to happen when I don't<br>
>have a pre-existing session on our partner's system.<br>
<br>
</div>The SP doesn't know anything about that session, so I don't see how that<br>
could matter.<br>
<div class="im"><br>
>Right now, to test the connection I go to their website and login. Then,<br>
>using a link to their IDP (with our protected resource as a query<br>
>parameter), the IDP then initiates the SAML connection and I am<br>
>redirected to my site's page and have a valid session.<br>
<br>
</div>Well, there's no request there. That's IdP-initiated SSO.<br>
<div class="im"><br>
> Which indicates to me that the signing works quite well in the happy<br>
>path.<br>
<br>
</div>It's not signing. It's not issuing a request at all.<br>
<div class="im"><br>
> My guess is they are passing me something in the not-as-happy<br>
> path that our SP doesn't like.<br>
<br>
</div>The crash happens when the SP issues a request, there's nothing from the<br>
IdP involved in that path.<br>
<div class="im"><br>
> You mentioned a stack trace as another place to look, I haven't seen<br>
>any stack traces in any of the logs.<br>
<br>
</div>A stack trace is from a core dump or a debugger attached to the shibd<br>
process, not in the log.<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPDebuggingNonWi" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPDebuggingNonWi</a><br>
ndows<br>
<div class="im"><br>
> A stack trace is exactly what I would like to see, as well as the<br>
>response our SP is tripping over.<br>
<br>
</div>There is no response, it's tripping over the formulation of a request, and<br>
all indications are it's in the signature. As I said, one workaround is<br>
simply to stop signing.<br>
<br>
I'd also like to know how big the key is, and the xml-sec version.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>