<div dir="ltr"><div>Hello everyone,</div><div><br></div><div>I am working on a set of step-by-step instructions for converting some of the web applications previously protected by mod_webauth for my institution and I have hit a snag. I am new to Shibboleth and SAML2 in general, but attended one of the installfests a few weeks ago and got an introduction to how everything works. I was able to set up a single IdP / SP setup and get basic login working for a protected Apache path. However, when I went to implement Logout behavior, I noticed the back-channel was not working correctly. I turned up the logging on both sides and noticed the following log messages, indicating to me there is a problem with the SSL handshake. Both machines are Ubuntu 12.04 servers. I installed the IdP from the web, and the SP from the package in the Ubuntu repo.</div>
<div><br></div><div>(from the SP process log)</div><div>------</div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: About to connect() to <a href="http://vm-test-idp01.haverford.edu">vm-test-idp01.haverford.edu</a> port 8443 (#0)</div>
<div><br></div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: Trying 165.82.1.191...</div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: connected</div><div><br></div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: successfully set certificate verify locations:</div>
<div><br></div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: CAfile: none</div><div> CApath: /etc/ssl/certs</div><div><br></div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: SSLv3, TLS handshake, Client hello (1):</div>
<div><br></div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: SSLv3, TLS alert, Server hello (2):</div><div><br></div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error</div>
<div><br></div><div>2013-10-08 09:35:05 DEBUG XMLTooling.libcurl [1]: Closing connection #0</div><div><br></div><div>2013-10-08 09:35:05 ERROR Shibboleth.AttributeResolver.Query [1]: exception during SAML query to <a href="https://vm-test-idp01.haverford.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery">https://vm-test-idp01.haverford.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery</a>: CURLSOAPTransport failed while contacting SOAP endpoint (<a href="https://vm-test-idp01.haverford.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery">https://vm-test-idp01.haverford.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery</a>): error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error</div>
<div>2013-10-08 09:35:05 ERROR Shibboleth.AttributeResolver.Query [1]: unable to obtain a SAML response from attribute authority</div><div>-----</div><div><br></div><div>I don't see any errors in the IdP log, and I am able to log into the service. I can get info about my session from the SP, but when I go to do the SAML logout I get an error because the back-channel isn't working. I can see the flat files are getting created for the metadata and are getting periodically refreshed. I will include below how I am exchanging my metadata. I did spend some time looking in the mailing list archives and on Google, but didn't find anything to help me. Any help someone can offer into what I am doing wrong would be very much appreciated.</div>
<div><br></div><div>(On the SP)</div><div>-----</div><div><MetadataProvider type="XML"</div><div> uri="<a href="https://vm-test-idp01.haverford.edu/idp/profile/Metadata/SAML">https://vm-test-idp01.haverford.edu/idp/profile/Metadata/SAML</a>"</div>
<div> backingFilePath="vm-test-idp01_metadata.xml" reloadInterval="7200"></div><div> </MetadataProvider></div><div>-----</div><div><br></div><div>(On the IdP)</div><div>-----</div>
<div><metadata:MetadataProvider id="SP01MD"</div><div> xsi:type="metadata:FileBackedHTTPMetadataProvider"</div><div> metadataURL="<a href="https://vm-test-sp01.haverford.edu/Shibboleth.sso/Metadata">https://vm-test-sp01.haverford.edu/Shibboleth.sso/Metadata</a>"</div>
<div> backingFile="/opt/shibboleth-idp/metadata/vm-test-sp01.xml"/></div><div>-----</div><div><br></div>-- <br><div dir="ltr">Adam Portier</div>
</div>