<div dir="ltr">Thank you for the suggestion. I switched Tomcat over to use Sun 1.7 JDK, and I can now see the initial back-channel communication completing correctly when the SP is looking for attributes. I still get an error when trying to log out (ERROR [org.opensaml.ws.security.provider.MandatoryAuthenticatedMessageRule:37] - Inbound message issuer was not authenticated), but I don't think that has anything to do with the back-channel not being properly configured. If anyone has any suggestions about this new problem, please chime in. Otherwise I am going to work on this some more myself and maybe ask for more help later if I get stuck.<div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Oct 8, 2013 at 10:45 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 10/8/13 10:34 AM, "Adam Portier" <<a href="mailto:aportier@haverford.edu">aportier@haverford.edu</a>> wrote:<br>
<br>
>Thank you for your response. The logout I am trying to do is via the<br>
>"Shibboleth.sso/Logout" in the default SP config. It is configure to do<br>
>both a Local and SAML2 logout action. When it tries to do the SAML2<br>
>logout action, that's when I see<br>
> the error page and the connection attempt to the IdP back-channel. My<br>
>point is that it looks like my back-channel communication isn't working<br>
>at all (initial connection or anything afterward).<br>
<br>
</div>Well, that isn't what you posted a log trace of, that was an attribute<br>
query. The mechanics would be the same in terms of the eventual problem<br>
though.<br>
<div class="im"><br>
>I am using Apache to proxy the HTTPS via an AJP connector on port 8009,<br>
>using a guide I found online. However, I am letting Tomcat host 8443<br>
>directly. Does that change anything about your suggestion?<br>
<br>
</div>If Tomcat is hosting 8443, and that's where the metadata is advertsing the<br>
endpoint to be, then the issue is with the Java runtime's TLS<br>
configuration and capability and its interoperability with the OpenSSL<br>
version the SP is using.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Adam Portier<br><div>Linux Administrator</div><div>IITS Core Technologies</div><div>Haverford College</div></div>
</div></div>