<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>To all,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I currently have a 2.3.6 IdP running on Linux under JBOSS 5.1. It currently is configured to perform user/password using LDAP (configured as described in shibboleth documentation using JAAS). This works well. I have a request to include an External Auth login provider. A developer has created a servlet to perform this authentication and has deployed the code in the same instance as our IdP. We have also configured the handler.xml with the following entry<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><!-- Username/password login handler --><o:p></o:p></p><p class=MsoNormal> <ph:LoginHandler xsi:type="ph:ExternalAuthn" externalAuthnPath="https://vushib-idpguest-test.vanderbilt.edu/vushib/oauth/servlet/shibLogin"><o:p></o:p></p><p class=MsoNormal> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod><o:p></o:p></p><p class=MsoNormal> </ph:LoginHandler><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For testing sake we have removed the LDAP login hander. Now, using Test Shibboleth SP (which I tested to work fine with the LDAP login handler), I point the SP to the enity id of our IdP. Our IdP is behind an F5 LTM (load balancer) which is configured to only point at one IdP at a time (fail-over). I also only have one instance of the IdP up and running. The VIP on the LTM is <a href="https://vushib-idpguest-test.vanderbilt.edu:443">https://vushib-idpguest-test.vanderbilt.edu:443</a> . What I get back from test shib is a 404 error. Here is what I see in the logs.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>09:22:00.730 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:191] [thread: http-10110-2%PARSER_ERROR[l]] - Checking SAML message intended destination endpoint against receiver endpoint<o:p></o:p></p><p class=MsoNormal>09:22:00.731 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:210] [thread: http-10110-2%PARSER_ERROR[l]] - Intended message destination endpoint: https://vushib-idpguest-test.vanderbilt.edu/idp/profile/SAML2/Redirect/SSO<o:p></o:p></p><p class=MsoNormal>09:22:00.731 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:211] [thread: http-10110-2%PARSER_ERROR[l]] - Actual message receiver endpoint: https://vushib-idpguest-test.vanderbilt.edu/idp/profile/SAML2/Redirect/SSO<o:p></o:p></p><p class=MsoNormal>09:22:00.732 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:219] [thread: http-10110-2%PARSER_ERROR[l]] - SAML message intended destination endpoint matched recipient endpoint<o:p></o:p></p><p class=MsoNormal>09:22:00.732 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:333] [thread: http-10110-2%PARSER_ERROR[l]] - Decoded request from relying party 'https://sp.testshib.org/shibboleth-sp'<o:p></o:p></p><p class=MsoNormal>09:22:00.733 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] [thread: http-10110-2%PARSER_ERROR[l]] - Checking child metadata provider for entity descriptor with entity ID: https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.733 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:509] [thread: http-10110-2%PARSER_ERROR[l]] - Searching for entity descriptor with an entity ID of https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.734 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] [thread: http-10110-2%PARSER_ERROR[l]] - Metadata document does not contain an EntityDescriptor with the ID https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.734 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] [thread: http-10110-2%PARSER_ERROR[l]] - Checking child metadata provider for entity descriptor with entity ID: https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.735 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:509] [thread: http-10110-2%PARSER_ERROR[l]] - Searching for entity descriptor with an entity ID of https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.737 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] [thread: http-10110-2%PARSER_ERROR[l]] - Metadata document does not contain an EntityDescriptor with the ID https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.738 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] [thread: http-10110-2%PARSER_ERROR[l]] - Checking child metadata provider for entity descriptor with entity ID: https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.738 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:509] [thread: http-10110-2%PARSER_ERROR[l]] - Searching for entity descriptor with an entity ID of https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.739 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:127] [thread: http-10110-2%PARSER_ERROR[l]] - Looking up relying party configuration for https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.739 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:129] [thread: http-10110-2%PARSER_ERROR[l]] - Custom relying party configuration found for https://sp.testshib.org/shibboleth-sp<o:p></o:p></p><p class=MsoNormal>09:22:00.740 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:203] [thread: http-10110-2%PARSER_ERROR[l]] - Creating login context and transferring control to authentication engine<o:p></o:p></p><p class=MsoNormal>09:22:00.745 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] [thread: http-10110-2%PARSER_ERROR[l]] - Storing LoginContext to StorageService partition loginContexts, key 3e9be40a-4839-455c-b7e1-56931e1feb77<o:p></o:p></p><p class=MsoNormal>09:22:00.746 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:216] [thread: http-10110-2%PARSER_ERROR[l]] - Redirecting user to authentication engine at https://vushib-idpguest-test.vanderbilt.edu:443/idp/AuthnEngine<o:p></o:p></p><p class=MsoNormal>09:22:00.761 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:202] [thread: http-10110-2%PARSER_ERROR[l]] - Processing incoming request<o:p></o:p></p><p class=MsoNormal>09:22:00.761 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:233] [thread: http-10110-2%PARSER_ERROR[l]] - Beginning user authentication process.<o:p></o:p></p><p class=MsoNormal>09:22:00.762 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:279] [thread: http-10110-2%PARSER_ERROR[l]] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.shibboleth.idp.authn.provider.PreviousSessionLoginHandler@112740e8, urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.ExternalAuthnSystemLoginHandler@28164824}<o:p></o:p></p><p class=MsoNormal>09:22:00.762 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:328] [thread: http-10110-2%PARSER_ERROR[l]] - Filtering out previous session login handler because there is no existing IdP session<o:p></o:p></p><p class=MsoNormal>09:22:00.763 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:460] [thread: http-10110-2%PARSER_ERROR[l]] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.ExternalAuthnSystemLoginHandler@28164824}<o:p></o:p></p><p class=MsoNormal>09:22:00.763 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:493] [thread: http-10110-2%PARSER_ERROR[l]] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.ExternalAuthnSystemLoginHandler<o:p></o:p></p><p class=MsoNormal>09:22:00.764 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:169] [thread: http-10110-2%PARSER_ERROR[l]] - Storing LoginContext to StorageService partition loginContexts, key 5a98aff0-a463-4c32-8139-2e643909f467<o:p></o:p></p><p class=MsoNormal>09:22:00.764 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler:100] [thread: http-10110-2%PARSER_ERROR[l]] - Forwarding authentication request to <a href="https://vushib-idpguest-test.vanderbilt.edu/vushib/oauth/servlet/shibLogin">https://vushib-idpguest-test.vanderbilt.edu/vushib/oauth/servlet/shibLogin</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So it appears that the IdP is attempting to forward to the correct URL… but that is the last thing that we see… and the browser reports a 404. If I use the URL <a href="https://vushib-idpguest-test.vanderbilt.edu/vushib/oauth/servlet/shibLogin">https://vushib-idpguest-test.vanderbilt.edu/vushib/oauth/servlet/shibLogin</a> directly from the browser I get the login page for the external auth.<o:p></o:p></p><p class=MsoNormal>As well the developer attempted to examine the RemoteUSerLoginHandler source code (as found online) and it only contains 78 lines , so no line 100 as listed above<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Does anyone have any ideas?<o:p></o:p></p><p class=MsoNormal>Lee Brewer<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>