<div dir="ltr"><div><div><div><div><div><div><div>Hi,<br><br></div>I am trying to set up an idp proxy following this link:<br> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering</a>.<br>
<br></div>The only difference is that I am not using Apache Proxy module, I am using our own proxy to forward request. We have set the proxy to do session stickiness.<br><br></div>1) I edited web.xml with:<br><div class="" title="Hint: double-click to select code">
<div class=""><code class=""><filter></code></div><div class=""><code class=""> </code><code class=""><filter-name>IdPSessionFilter</filter-name></code></div><div class=""><code class=""> </code><code class=""><filter-</code><code class="">class</code><code class="">>edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter</filter-</code><code class="">class</code><code class="">></code></div>
<div class=""><code class=""> </code><code class=""><init-param></code></div><div class=""><code class=""> </code><code class=""><param-name>ensureConsistentClientAddress</param-name></code></div><div class="">
<code class=""> </code><code class=""><param-value></code><code class="">false</code><code class=""></param-value></code></div><div class=""><code class=""> </code><code class=""></init-param></code></div>
<div class=""><code class=""></filter><br><br></code></div><div class=""><code class="">But it gives me following error:<br></code></div></div> 17:52:58.116 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:409] - Message did not meet security requirements<br>
org.opensaml.xml.security.SecurityException: SAML message intended destination endpoint did not match recipient endpoint<br> at org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217) ~[opensaml-2.6.0.jar:na]<br>
at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72) ~[opensaml-2.6.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:389) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]<br>
at javax.servlet.http.HttpServlet.service(HttpServlet.java:728) [servletContainer.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305) [servletContainer.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) [servletContainer.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br>
at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) [servletContainer.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222) [servletContainer.jar:na]<br>
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123) [servletContainer.jar:na]<br> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472) [servletContainer.jar:na]<br>
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) [servletContainer.jar:na]<br> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99) [servletContainer.jar:na]<br>
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953) [servletContainer.jar:na]<br> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118) [servletContainer.jar:na]<br>
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) [servletContainer.jar:na]<br> at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008) [servletContainer.jar:na]<br>
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589) [servletContainer.jar:na]<br> at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310) [servletContainer.jar:na]<br>
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895) [na:1.6.0_45]<br> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918) [na:1.6.0_45]<br> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]<br>
<br></div>2) I saw the exception came from SLF4JMDCCleanupFilter, so I just did the same thing like:<br><div class=""><code class=""><filter></code></div><div class=""><code class=""> </code><code class=""><filter-name>SL4JCleanupFilter</filter-name></code></div>
<div class=""><code class=""> </code><code class=""><filter-</code><code class="">class</code><code class="">>edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter</filter-</code><code class="">class</code><code class="">></code></div>
<div class=""><code class=""> </code><code class=""><init-param></code></div><div class=""><code class=""> </code><code class=""><param-name>ensureConsistentClientAddress</param-name></code></div><div class="">
<code class=""> </code><code class=""><param-value></code><code class="">false</code><code class=""></param-value></code></div><div class=""><code class=""> </code><code class=""></init-param></code></div>
<code class=""></filter><br></code></div><code class="">Note this is not in the wiki.<br><br></code></div><code class="">Then I saw this error which is different:<br>18:09:00.973 - ERROR [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML message intended destination endpoint '<a href="http://sma-pc1:8080/idp/profile/SAML2/POST/SSO">http://sma-pc1:8080/idp/profile/SAML2/POST/SSO</a>' did not match the recipient endpoint '<a href="http://sma-pc1:8900/idp/profile/SAML2/POST/SSO">http://sma-pc1:8900/idp/profile/SAML2/POST/SSO</a>'<br>
18:09:00.981 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:409] - Message did not meet security requirements<br>org.opensaml.xml.security.SecurityException: SAML message intended destination endpoint did not match recipient endpoint<br>
at org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217) ~[opensaml-2.6.0.jar:na]<br> at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72) ~[opensaml-2.6.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:389) [shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]<br> at javax.servlet.http.HttpServlet.service(HttpServlet.java:728) [servletContainer.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305) [servletContainer.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) [servletContainer.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222) [servletContainer.jar:na]<br>
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123) [servletContainer.jar:na]<br> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472) [servletContainer.jar:na]<br>
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) [servletContainer.jar:na]<br> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99) [servletContainer.jar:na]<br>
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953) [servletContainer.jar:na]<br> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118) [servletContainer.jar:na]<br>
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) [servletContainer.jar:na]<br> at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008) [servletContainer.jar:na]<br>
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589) [servletContainer.jar:na]<br> at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310) [servletContainer.jar:na]<br>
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895) [na:1.6.0_45]<br> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918) [na:1.6.0_45]<br> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]<br>
<br></code></div><code class="">Looks like IdP is trying to match the URL in many places, is there a way to disable the checking all together? It seems that following the wiki is not enough. Is there anything I am missing?<br>
<br>Thanks,<br></code><div><div><div><div><div><div><div><div><div><div><div>Yaowen</div>
</div></div></div></div></div></div></div></div></div></div></div>