<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><span>Hi,</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span>My native.log log has the below error - can you help me with this ?</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span><br></span></div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO XMLTooling.Config : xmltooling 1.5.2 library initialization complete</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.Config : shibboleth 2.5.1 library initialization complete</div><div
style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.Config : reload thread started...running when signaled</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.Config : loaded XML resource (C:/opt/shibboleth-sp/etc/shibboleth/shibboleth2.xml)</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.Config : Shibboleth SP Version 2.5.1</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.Config : Library versions: log4shib 1.0.5, Xerces-C 3.1.1, XMLTooling-C 1.5.2, Shibboleth 1.5.1</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.Config : building ListenerService of type TCPListener...</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.Config : building SessionCache of type StorageService...</div><div style="background-color: transparent;">2013-06-27 16:54:49 WARN
Shibboleth.SessionCache : cacheTimeout property is deprecated in favor of cacheAllowance (see documentation)</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.Config : building RequestMapper of type Native...</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.SessionCache : cleanup thread started...run every 900 secs; timeout after 900 secs</div><div style="background-color: transparent;">2013-06-27 16:54:49 INFO Shibboleth.AssertionLookup : installing default ACL (127.0.0.1 ::1)</div><div style="background-color: transparent;">2013-06-27 16:54:58 ERROR Shibboleth.Listener [4848] isapi_shib_extension: remoted message returned an error: Unable to establish security of incoming assertion.</div><div style="background-color: transparent;"><span></span></div><div style="background-color: transparent;">2013-06-27 16:54:58 ERROR Shibboleth.ISAPI [4848] isapi_shib_extension: Unable to
establish security of incoming assertion.</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">thanks</div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: 'times new roman', 'new york', times, serif; font-style: normal;">Justin</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><br></div> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span
style="font-weight:bold;">From:</span></b> Nate Klingenstein <ndk@internet2.edu><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, June 27, 2013 4:17 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Unable to establish security of incoming assertion<br> </font> </div> <div class="y_msg_container"><br>Session initiation should be fine and I see nothing wrong with your SP configuration. The problem is likely something in the incoming message. If you turn up shibd.logger to DEBUG, you should be able to see that incoming message.<br><br>On Jun 27, 2013, at 20:11 , Justin Russo wrote:<br><br>> Hi Scott,<br>> thanks for the quick reply.<br>> here is some more info.<br>> Initially when i set up shibboleth for the first time i test using University of south California idp.<br>> Now when im trying to
connect to my IDP provider "ABC Company" i used the existing shibboleth2.xml file and modified it accordingly. <br>> Currently when i check i have the below questionable stuff in my shibboleth2.xml<br>> <br>> <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"<br>> relayState="cookie" entityID="<a href="https://abccompany.org/SAML2/IDP" target="_blank">https://abccompany.org/SAML2/IDP</a>"<br>> acsByIndex="false"><br>> <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/><br>> <SessionInitiator type="Shib1" acsIndex="5"/><br>> </SessionInitiator><br>>
<br>> <br>> <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. --><br>> <SessionInitiator type="Chaining" Location="/WAYF/shibboleth.usc.edu" id="usc" relayState="cookie"><br>> <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/><br>> <SessionInitiator type="Shib1" acsIndex="5"/><br>> <SessionInitiator type="WAYF" acsIndex="5" URL="<a href="https://shibboleth-test.usc.edu/idp/profile/Shibboleth/SSO" target="_blank">https://shibboleth-test.usc.edu/idp/profile/Shibboleth/SSO</a>"/><br>>
</SessionInitiator><br>> <br>> I know im nbot using University of south California idp any more, can i remove the WAYF Session initiator attribute ?<br>> <br>> do you think this is the cause<br>> <br>> thanks<br>> Justin<br>> <br>> From: "Cantor, Scott" <<a ymailto="mailto:cantor.2@osu.edu" href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>><br>> To: Shib Users <<a ymailto="mailto:users@shibboleth.net" href="mailto:users@shibboleth.net">users@shibboleth.net</a>> <br>> Sent: Thursday, June 27, 2013 4:04 PM<br>> Subject: Re: Unable to establish security of incoming assertion<br>> <br>> On 6/27/13 3:49 PM, "justin9" <<a ymailto="mailto:justin9@ymail.com" href="mailto:justin9@ymail.com">justin9@ymail.com</a>> wrote:<br>> <br>> >Hi Nate,<br>> >The file attached here.<br>> >shibd.log <br>> ><<a href="http://shibboleth.1660669.n2.nabble.com/file/n7587944/shibd.log"
target="_blank">http://shibboleth.1660669.n2.nabble.com/file/n7587944/shibd.log</a>><br>> <br>> I would turn up logging to DEBUG to see if anything more comes out, but<br>> the sparseness of information leads me to believe the error is something<br>> extremely unusual, like a non-Shibboleth IdP that isn't signing anything<br>> in the response. It's not normal to get that error without more in the log<br>> than that one warning.<br>> <br>> -- Scott<br>> <br>> <br>> --<br>> To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>> <br>> <br>> --<br>> To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br>--<br>To unsubscribe from this list
send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br></div> </div> </div> </div></body></html>