<div dir="ltr">From the IDP side, there's not even a mention of a connection attempt. Unfortunately, I only have the IDP logs, not the Tomcat logs because we reverted the changes before saving those logs. That said, I did get some decent logs from a service provider:<div>
<br></div><p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.SOAPTransport.CURL [18]: sending SOAP message to <a href="https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery" target="_blank">https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery</a><u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: Connection #0 seems to be dead!<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: Closing connection #0<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: SSLv3, TLS alert, Client hello (1):<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: About to connect() to <a href="http://shib.nacs.uci.edu/" target="_blank">shib.nacs.uci.edu</a> port 8443 (#0)<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: Trying <a href="tel:128.195.182.15" value="+12819518215" target="_blank">128.195.182.15</a>...<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: connected<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: Connected to <a href="http://shib.nacs.uci.edu/" target="_blank">shib.nacs.uci.edu</a> <a href="tel:%28128.195.182.15" value="+12819518215" target="_blank">(128.195.182.15</a>) port 8443 (#0)<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: SSL re-using session ID<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: SSLv3, TLS handshake, Client hello (1):<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><b><span style="font-size:7pt;font-family:Consolas;color:red">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: SSLv3, TLS alert, Server hello (2):<u></u><u></u></span></b></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><b><span style="font-size:7pt;font-family:Consolas;color:red">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error<u></u><u></u></span></b></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.libcurl [18]: Closing connection #0<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 ERROR Shibboleth.AttributeResolver.Query [18]: exception during SAML query to <a href="https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery" target="_blank">https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery</a>: CURLSOAPTransport failed while contacting SOAP endpoint (<a href="https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery" target="_blank">https://shib.nacs.uci.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery</a>): error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1 alert internal error<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 ERROR Shibboleth.AttributeResolver.Query [18]: unable to obtain a SAML response from attribute authority<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG Shibboleth.SessionCache [18]: creating new session<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.StorageService.MEMCACHE [18]: readString ctx: Logout - key: _afdbcad82202b4d57962d226d48469c2<u></u><u></u></span></p>
<p class="" style="margin:0in 0in 0.0001pt;font-size:12pt;font-family:'Times New Roman',serif"><span style="font-size:7pt;font-family:Consolas">2013-07-24 21:22:42 DEBUG XMLTooling.StorageService.MEMCACHE [18]: Key Logout:_afdbcad82202b4d57962d226d48469c2 not found in memcache...<u></u><u></u></span></p>
<div><span style="font-family:Consolas;font-size:7pt">2013-07-24 21:22:42 DEBUG Shibboleth.SessionCache [18]: storing new session...<br></span><br></div><div><div>It's just not telling *me* very much.</div></div><div>
<br></div><div>On our end, all we have is:</div><div><br></div><div><div>Jul 24 21:22:39 <a href="http://shib1.service.uci.edu">shib1.service.uci.edu</a> [Shibboleth-Access:73] 20130725T042239Z|******|shib.nacs.uci.edu:443|/profile/Shibboleth/SSO|</div>
<div>Jul 24 21:22:40 <a href="http://shib1.service.uci.edu">shib1.service.uci.edu</a> [Shibboleth-Access:73] 20130725T042240Z|******|shib.nacs.uci.edu:443|/profile/Shibboleth/SSO|</div><div>Jul 24 21:22:40 <a href="http://shib1.service.uci.edu">shib1.service.uci.edu</a> [Shibboleth-Audit:745] 20130725T042240Z|urn:mace:shibboleth:1.0:profiles:AuthnRequest||*****|urn:mace:shibboleth:2.0:profiles:saml1:sso|urn:mace:incommon:<a href="http://uci.edu">uci.edu</a>|urn:oasis:names:tc:SAML:1.0:profiles:browser-post|_0f814169c5b80a7d21cdf07aa3d2d21e|*****|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_afdbcad82202b4d57962d226d48469c2|_66780903f495663db2fabd5a635ec2c2,|</div>
<div>Jul 24 21:22:45 <a href="http://shib1.service.uci.edu">shib1.service.uci.edu</a> [Shibboleth-Access:73] 20130725T042245Z|98.112.170.83|shib.nacs.uci.edu:443|/profile/Shibboleth/SSO|</div></div><div><br></div><div>Which isn't anything, other than a lack of access attempt.</div>
<div><br></div><div>Chris</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jul 29, 2013 at 1:13 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 7/29/13 4:05 PM, "Christopher Peters" <<a href="mailto:cjpeters@uci.edu">cjpeters@uci.edu</a>> wrote:<br>
><br>
>You're right. There is something I overlooked, and you saying this made<br>
>me really think about what I was missing. It was potentially major too,<br>
>it just was a blip in the upgrade process that caused me to forget it.<br>
><br>
>We changed java versions.<br>
<br>
</div>If that caused this error, I would say you aren't using Apache. That would<br>
leave many other possible culprits, like Tomcat, etc.<br>
<div class="im"><br>
>When I was doing the upgrade, launching the idp software failed because<br>
>we had a path issue pointing to an old version of java (1.5.0_14). So I<br>
>fixed the path to point to 1.6.0_20. (something that had been installed<br>
>the whole time but never used).<br>
<br>
</div>You should use 1.7 unless you're using Terracotta and have to stick with<br>
1.6.<br>
<div class="im"><br>
>Man, I always feel so dumb after posting here. Anyway, that's what it's<br>
>for. What are your thoughts on this being the culprit?<br>
<br>
</div>I don't see it.<br>
<br>
Maybe something is happening that isn't TLS-related and is maybe aborting<br>
the requests mid-way and resulting in that error, but there should be<br>
evidence of something somewhere in the logs. If the requests are<br>
demonstrably never getting into the IdP, then there's no way this is Java<br>
or the IdP.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">
<font face="arial black, sans-serif">Chris Peters</font><br>Middleware Services Developer<br>Office of Information Technology - NSP<br>(949) 824-6845<br><a href="mailto:cjpeters@uci.edu" target="_blank">cjpeters@uci.edu</a><br>
</div>
</div>