<div dir="ltr"><div><div>Looking at the last exception again, it seems coming from IdPNoCacheFilter. It seems that I need to do the same thing for IdPNoCacheFilter like I did for IdPSessionFilter and SL4JCleanupFilter to disable the check. I don't have the environment. I will try it tomorrow and see it the request goes through. <br>
<br>I would be appreciated if anyone has had the same issue before could let me know the solution.<br><br></div>Anyways, wiki needs to be updated since changing setting for IdPSessionFilter only doesn't seems to be enough. Please let me know if I am wrong.<br>
<br></div>Thanks,<br>Yaowen<br></div><div class="gmail_extra"><br clear="all"><div>Yaowen</div>
<br><br><div class="gmail_quote">On Tue, Sep 17, 2013 at 6:19 PM, Yaowen Tu <span dir="ltr"><<a href="mailto:yaowen.tu@gmail.com" target="_blank">yaowen.tu@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div><div><div><div><div><div>Hi,<br><br></div>I am trying to set up an idp proxy following this link:<br> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering</a>.<br>
<br></div>The only difference is that I am not using Apache Proxy module, I am using our own proxy to forward request. We have set the proxy to do session stickiness.<br><br></div>1) I edited web.xml with:<br><div title="Hint: double-click to select code">
<div><code><filter></code></div><div><code> </code><code><filter-name>IdPSessionFilter</filter-name></code></div><div><code> </code><code><filter-</code><code>class</code><code>>edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter</filter-</code><code>class</code><code>></code></div>
<div><code> </code><code><init-param></code></div><div><code> </code><code><param-name>ensureConsistentClientAddress</param-name></code></div><div>
<code> </code><code><param-value></code><code>false</code><code></param-value></code></div><div><code> </code><code></init-param></code></div>
<div><code></filter><br><br></code></div><div><code>But it gives me following error:<br></code></div></div> 17:52:58.116 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:409] - Message did not meet security requirements<br>
org.opensaml.xml.security.SecurityException: SAML message intended destination endpoint did not match recipient endpoint<br> at org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217) ~[opensaml-2.6.0.jar:na]<br>
at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72) ~[opensaml-2.6.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:389) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]<br>
at javax.servlet.http.HttpServlet.service(HttpServlet.java:728) [servletContainer.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305) [servletContainer.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) [servletContainer.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br>
at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) [servletContainer.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222) [servletContainer.jar:na]<br>
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123) [servletContainer.jar:na]<br> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472) [servletContainer.jar:na]<br>
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) [servletContainer.jar:na]<br> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99) [servletContainer.jar:na]<br>
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953) [servletContainer.jar:na]<br> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118) [servletContainer.jar:na]<br>
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) [servletContainer.jar:na]<br> at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008) [servletContainer.jar:na]<br>
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589) [servletContainer.jar:na]<br> at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310) [servletContainer.jar:na]<br>
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895) [na:1.6.0_45]<br> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918) [na:1.6.0_45]<br> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]<br>
<br></div>2) I saw the exception came from SLF4JMDCCleanupFilter, so I just did the same thing like:<br><div><code><filter></code></div><div><code> </code><code><filter-name>SL4JCleanupFilter</filter-name></code></div>
<div><code> </code><code><filter-</code><code>class</code><code>>edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter</filter-</code><code>class</code><code>></code></div>
<div><code> </code><code><init-param></code></div><div><code> </code><code><param-name>ensureConsistentClientAddress</param-name></code></div><div>
<code> </code><code><param-value></code><code>false</code><code></param-value></code></div><div><code> </code><code></init-param></code></div>
<code></filter><br></code></div><code>Note this is not in the wiki.<br><br></code></div><code>Then I saw this error which is different:<br>18:09:00.973 - ERROR [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML message intended destination endpoint '<a href="http://sma-pc1:8080/idp/profile/SAML2/POST/SSO" target="_blank">http://sma-pc1:8080/idp/profile/SAML2/POST/SSO</a>' did not match the recipient endpoint '<a href="http://sma-pc1:8900/idp/profile/SAML2/POST/SSO" target="_blank">http://sma-pc1:8900/idp/profile/SAML2/POST/SSO</a>'<br>
18:09:00.981 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:409] - Message did not meet security requirements<br>org.opensaml.xml.security.SecurityException: SAML message intended destination endpoint did not match recipient endpoint<br>
at org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217) ~[opensaml-2.6.0.jar:na]<br> at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72) ~[opensaml-2.6.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:389) [shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]<br>
at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.0.jar:na]<br> at javax.servlet.http.HttpServlet.service(HttpServlet.java:728) [servletContainer.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305) [servletContainer.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) [servletContainer.jar:na]<br>
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) [servletContainer.jar:na]<br> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222) [servletContainer.jar:na]<br>
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123) [servletContainer.jar:na]<br> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472) [servletContainer.jar:na]<br>
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) [servletContainer.jar:na]<br> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99) [servletContainer.jar:na]<br>
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953) [servletContainer.jar:na]<br> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118) [servletContainer.jar:na]<br>
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) [servletContainer.jar:na]<br> at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008) [servletContainer.jar:na]<br>
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589) [servletContainer.jar:na]<br> at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310) [servletContainer.jar:na]<br>
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895) [na:1.6.0_45]<br> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918) [na:1.6.0_45]<br> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_45]<br>
<br></code></div><code>Looks like IdP is trying to match the URL in many places, is there a way to disable the checking all together? It seems that following the wiki is not enough. Is there anything I am missing?<br>
<br>Thanks,<br></code><div><div><div><div><div><div><div><div><div><div><div>Yaowen</div>
</div></div></div></div></div></div></div></div></div></div></div>
</blockquote></div><br></div>