<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><span>Hi,</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span><br></span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span>I finally found where the shibd.logger file is located and opened this file.</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span>i can see everything is in debug mode. (see below).</span></div><div style="font-family: 'times new roman', 'new york', times,
serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span>Im using IIS 7.0 as my server to host my application.</span></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; color: rgb(0, 0, 0); background-color: transparent; font-style: normal;"><span><br></span></div><div style="background-color: transparent;"># set overall behavior</div><div style="background-color: transparent;">log4j.rootCategory=INFO, shibd_log, warn_log</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;"># fairly verbose for DEBUG, so generally leave at INFO</div><div style="background-color: transparent;">log4j.category.XMLTooling.XMLObject=INFO</div><div style="background-color: transparent;">log4j.category.XMLTooling.KeyInfoResolver=INFO</div><div style="background-color: transparent;">log4j.category.Shibboleth.IPRange=INFO</div><div
style="background-color: transparent;">log4j.category.Shibboleth.PropertySet=INFO</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;"># raise for low-level tracing of SOAP client HTTP/SSL behavior</div><div style="background-color: transparent;">log4j.category.XMLTooling.libcurl=INFO</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;"># useful categories to tune independently:</div><div style="background-color: transparent;">#</div><div style="background-color: transparent;"># tracing of SAML messages and security policies</div><div style="background-color: transparent;">#log4j.category.OpenSAML.MessageDecoder=DEBUG</div><div style="background-color: transparent;">#log4j.category.OpenSAML.MessageEncoder=DEBUG</div><div style="background-color: transparent;">#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG</div><div style="background-color:
transparent;">#log4j.category.XMLTooling.SOAPClient=DEBUG</div><div style="background-color: transparent;"># interprocess message remoting</div><div style="background-color: transparent;">#log4j.category.Shibboleth.Listener=DEBUG</div><div style="background-color: transparent;"># mapping of requests to applicationId</div><div style="background-color: transparent;">#log4j.category.Shibboleth.RequestMapper=DEBUG</div><div style="background-color: transparent;"># high level session cache operations</div><div style="background-color: transparent;">#log4j.category.Shibboleth.SessionCache=DEBUG</div><div style="background-color: transparent;"># persistent storage and caching</div><div style="background-color: transparent;">#log4j.category.XMLTooling.StorageService=DEBUG</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;"># logs XML being signed or verified if set to DEBUG</div><div style="background-color:
transparent;">log4j.category.XMLTooling.Signature.Debugger=INFO, sig_log</div><div style="background-color: transparent;">log4j.additivity.XMLTooling.Signature.Debugger=false</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;"># the tran log blocks the "default" appender(s) at runtime</div><div style="background-color: transparent;"># Level should be left at INFO for this category</div><div style="background-color: transparent;">log4j.category.Shibboleth-TRANSACTION=INFO, tran_log</div><div style="background-color: transparent;">log4j.additivity.Shibboleth-TRANSACTION=false</div><div style="background-color: transparent;"># uncomment to suppress particular event types</div><div style="background-color: transparent;">#log4j.category.Shibboleth-TRANSACTION.AuthnRequest=WARN</div><div style="background-color: transparent;">#log4j.category.Shibboleth-TRANSACTION.Login=WARN</div><div style="background-color:
transparent;">#log4j.category.Shibboleth-TRANSACTION.Logout=WARN</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;"># define the appenders</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;">log4j.appender.shibd_log=org.apache.log4j.RollingFileAppender</div><div style="background-color: transparent;">log4j.appender.shibd_log.fileName=C:/opt/shibboleth-sp/var/log/shibboleth/shibd.log</div><div style="background-color: transparent;">log4j.appender.shibd_log.maxFileSize=1000000</div><div style="background-color: transparent;">log4j.appender.shibd_log.maxBackupIndex=10</div><div style="background-color: transparent;">log4j.appender.shibd_log.layout=org.apache.log4j.PatternLayout</div><div style="background-color: transparent;">log4j.appender.shibd_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n</div><div style="background-color:
transparent;"><br></div><div style="background-color: transparent;">log4j.appender.warn_log=org.apache.log4j.RollingFileAppender</div><div style="background-color: transparent;">log4j.appender.warn_log.fileName=C:/opt/shibboleth-sp/var/log/shibboleth/shibd_warn.log</div><div style="background-color: transparent;">log4j.appender.warn_log.maxFileSize=1000000</div><div style="background-color: transparent;">log4j.appender.warn_log.maxBackupIndex=10</div><div style="background-color: transparent;">log4j.appender.warn_log.layout=org.apache.log4j.PatternLayout</div><div style="background-color: transparent;">log4j.appender.warn_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n</div><div style="background-color: transparent;">log4j.appender.warn_log.threshold=WARN</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;">log4j.appender.tran_log=org.apache.log4j.RollingFileAppender</div><div
style="background-color: transparent;">log4j.appender.tran_log.fileName=C:/opt/shibboleth-sp/var/log/shibboleth/transaction.log</div><div style="background-color: transparent;">log4j.appender.tran_log.maxFileSize=1000000</div><div style="background-color: transparent;">log4j.appender.tran_log.maxBackupIndex=20</div><div style="background-color: transparent;">log4j.appender.tran_log.layout=org.apache.log4j.PatternLayout</div><div style="background-color: transparent;">log4j.appender.tran_log.layout.ConversionPattern=%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent;">log4j.appender.sig_log=org.apache.log4j.FileAppender</div><div style="background-color: transparent;">log4j.appender.sig_log.fileName=C:/opt/shibboleth-sp/var/log/shibboleth/signature.log</div><div style="background-color:
transparent;">log4j.appender.sig_log.layout=org.apache.log4j.PatternLayout</div><div style="background-color: transparent;"><span></span></div><div style="background-color: transparent;">log4j.appender.sig_log.layout.ConversionPattern=%m</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><br></div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;">thanks,</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;">justin</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"><br></div> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2"
face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Nate Klingenstein <ndk@internet2.edu><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, June 27, 2013 5:05 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Unable to establish security of incoming assertion<br> </font> </div> <div class="y_msg_container"><br>Justin,<br><br>This is just the in-process counterpart of the other error. You're unlikely to discover anything new about the error without putting shibd.logger on DEBUG and retrying with this IdP, and as Scott mentioned, it's not likely to be a common problem.<br><br>Thanks,<br>Nate.<br><br>On Jun 27, 2013, at 20:56 , Justin Russo wrote:<br><br>> Hi,<br>> My native.log log has the below error - can you help me with this ?<br>> <br>> 2013-06-27 16:54:49 INFO XMLTooling.Config :
xmltooling 1.5.2 library initialization complete<br>> 2013-06-27 16:54:49 INFO Shibboleth.Config : shibboleth 2.5.1 library initialization complete<br>> 2013-06-27 16:54:49 INFO Shibboleth.Config : reload thread started...running when signaled<br>> 2013-06-27 16:54:49 INFO Shibboleth.Config : loaded XML resource (C:/opt/shibboleth-sp/etc/shibboleth/shibboleth2.xml)<br>> 2013-06-27 16:54:49 INFO Shibboleth.Config : Shibboleth SP Version 2.5.1<br>> 2013-06-27 16:54:49 INFO Shibboleth.Config : Library versions: log4shib 1.0.5, Xerces-C 3.1.1, XMLTooling-C 1.5.2, Shibboleth 1.5.1<br>> 2013-06-27 16:54:49 INFO Shibboleth.Config : building ListenerService of type TCPListener...<br>> 2013-06-27 16:54:49 INFO Shibboleth.Config : building SessionCache of type StorageService...<br>> 2013-06-27 16:54:49 WARN Shibboleth.SessionCache : cacheTimeout property is deprecated in favor of cacheAllowance (see documentation)<br>> 2013-06-27
16:54:49 INFO Shibboleth.Config : building RequestMapper of type Native...<br>> 2013-06-27 16:54:49 INFO Shibboleth.SessionCache : cleanup thread started...run every 900 secs; timeout after 900 secs<br>> 2013-06-27 16:54:49 INFO Shibboleth.AssertionLookup : installing default ACL (127.0.0.1 ::1)<br>> 2013-06-27 16:54:58 ERROR Shibboleth.Listener [4848] isapi_shib_extension: remoted message returned an error: Unable to establish security of incoming assertion.<br>> 2013-06-27 16:54:58 ERROR Shibboleth.ISAPI [4848] isapi_shib_extension: Unable to establish security of incoming assertion.<br>> <br>> thanks<br>> <br>> Justin<br>> <br>> From: Nate Klingenstein <<a ymailto="mailto:ndk@internet2.edu" href="mailto:ndk@internet2.edu">ndk@internet2.edu</a>><br>> To: Shib Users <<a ymailto="mailto:users@shibboleth.net" href="mailto:users@shibboleth.net">users@shibboleth.net</a>> <br>> Sent: Thursday, June 27, 2013
4:17 PM<br>> Subject: Re: Unable to establish security of incoming assertion<br>> <br>> Session initiation should be fine and I see nothing wrong with your SP configuration. The problem is likely something in the incoming message. If you turn up shibd.logger to DEBUG, you should be able to see that incoming message.<br>> <br>> On Jun 27, 2013, at 20:11 , Justin Russo wrote:<br>> <br>> > Hi Scott,<br>> > thanks for the quick reply.<br>> > here is some more info.<br>> > Initially when i set up shibboleth for the first time i test using University of south California idp.<br>> > Now when im trying to connect to my IDP provider "ABC Company" i used the existing shibboleth2.xml file and modified it accordingly. <br>> > Currently when i check i have the below questionable stuff in my shibboleth2.xml<br>> > <br>> > <SessionInitiator type="Chaining" Location="/Login"
isDefault="true" id="Intranet"<br>> > relayState="cookie" entityID="<a href="https://abccompany.org/SAML2/IDP" target="_blank">https://abccompany.org/SAML2/IDP</a>"<br>> > acsByIndex="false"><br>> > <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/><br>> > <SessionInitiator type="Shib1" acsIndex="5"/><br>> > </SessionInitiator><br>> > <br>> > <br>> > <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. --><br>> >
<SessionInitiator type="Chaining" Location="/WAYF/shibboleth.usc.edu" id="usc" relayState="cookie"><br>> > <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/><br>> > <SessionInitiator type="Shib1" acsIndex="5"/><br>> > <SessionInitiator type="WAYF" acsIndex="5" URL="<a href="https://shibboleth-test.usc.edu/idp/profile/Shibboleth/SSO" target="_blank">https://shibboleth-test.usc.edu/idp/profile/Shibboleth/SSO</a>"/><br>> > </SessionInitiator><br>> > <br>> > I know im nbot using University of south California idp any more, can i remove the WAYF Session initiator attribute ?<br>> > <br>> > do you think this is the cause<br>> >
<br>> > thanks<br>> > Justin<br>> > <br>> > From: "Cantor, Scott" <<a ymailto="mailto:cantor.2@osu.edu" href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>><br>> > To: Shib Users <<a ymailto="mailto:users@shibboleth.net" href="mailto:users@shibboleth.net">users@shibboleth.net</a>> <br>> > Sent: Thursday, June 27, 2013 4:04 PM<br>> > Subject: Re: Unable to establish security of incoming assertion<br>> > <br>> > On 6/27/13 3:49 PM, "justin9" <<a ymailto="mailto:justin9@ymail.com" href="mailto:justin9@ymail.com">justin9@ymail.com</a>> wrote:<br>> > <br>> > >Hi Nate,<br>> > >The file attached here.<br>> > >shibd.log <br>> > ><<a href="http://shibboleth.1660669.n2.nabble.com/file/n7587944/shibd.log" target="_blank">http://shibboleth.1660669.n2.nabble.com/file/n7587944/shibd.log</a>><br>> > <br>> > I would turn up logging to
DEBUG to see if anything more comes out, but<br>> > the sparseness of information leads me to believe the error is something<br>> > extremely unusual, like a non-Shibboleth IdP that isn't signing anything<br>> > in the response. It's not normal to get that error without more in the log<br>> > than that one warning.<br>> > <br>> > -- Scott<br>> > <br>> > <br>> > --<br>> > To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>> > <br>> > <br>> > --<br>> > To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>> <br>> <br>> --<br>> To unsubscribe from this list send an email to <a
ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>> <br>> <br>> --<br>> To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br></div> </div> </div> </div></body></html>