<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hello,<br><br>Following is our environment<br>- Shibboleth-SP 2.5<br>- Apache 2.2<br><br>We
have a IdP initiated SSO usecase and are noticing that the user gets
timed out in under 2 mins. We are not sure why the user is getting timed
out so quick. The Shibboleth protects a web application running on a
Tomcat server with an Apache front. The session in the web application
is set to expire in 30 mins. Following are full details <br><br>Thanks<br>Ragadeep<br><br>The client has an IdP that is sending the below <samlp:Response> as part of an IdP initiated SSO usecase<br>************************************************************************************************<br> <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="id-SFO1sv8l-shUAEsDAmI2IKE-Khg-"<br> IssueInstant="2013-12-06T15:39:05Z" Version="2.0"><br> <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://myidp.com/idp<br> </saml:Issuer><br> <dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><br> <dsig:SignedInfo><br> <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><br> <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><br> <dsig:Reference URI="#id-SFO1sv8l-shUAEsDAmI2IKE-Khg-"><br> <dsig:Transforms><br> <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><br> <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><br> </dsig:Transforms><br> <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><br> <dsig:DigestValue>+S2+nJTJEEPdDn0UOpqFv22C+ew=</dsig:DigestValue><br> </dsig:Reference><br> </dsig:SignedInfo><br> <dsig:SignatureValue>mKuzwCDOnbCvKLL7uZ7EBqHy1IqQ==</dsig:SignatureValue><br> </dsig:Signature><br> <saml:Subject><br> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">ABC12345</saml:NameID><br> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><br> <saml:SubjectConfirmationData NotOnOrAfter="2013-12-06T15:54:05Z"<br> Recipient="https://mysp.com/Shibboleth.sso/SAML2/POST"/><br> </saml:SubjectConfirmation><br> </saml:Subject><br> <saml:Conditions NotBefore="2013-12-06T15:29:05Z" NotOnOrAfter="2013-12-06T15:54:05Z"><br> <saml:AudienceRestriction><br> <saml:Audience>mysp.com</saml:Audience><br> </saml:AudienceRestriction><br> </saml:Conditions><br> <saml:AuthnStatement AuthnInstant="2013-12-06T15:39:05Z" SessionIndex="id-Ki0kbaXnRMxusDp0yKc1exLkcQo-"><br> <saml:AuthnContext><br>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</saml:AuthnContextClassRef><br> </saml:AuthnContext><br> </saml:AuthnStatement><br> <saml:AttributeStatement xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"<br> xmlns:xs="http://www.w3.org/2001/XMLSchema"<br> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><br> <saml:Attribute Name="MYATTR" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"><br> <saml:AttributeValue xsi:type="xs:string">ABC12345</saml:AttributeValue><br> </saml:Attribute><br> </saml:AttributeStatement><br> </saml:Assertion><br>************************************************************************************************<br><br>What
we are noticing is that the SP expires the session after a few minutes
after authenticating the user. I<br><br>As
we see in the logs, SP expires the session as below<br><br>************************************************************************************************<br>2013-12-06 15:39:07 DEBUG OpenSAML.MessageDecoder.SAML2 [3]: extracting issuer from SAML 2.0 protocol message<br>2013-12-06 15:39:07 DEBUG OpenSAML.MessageDecoder.SAML2 [3]: message from (http://myidp.com/idp)<br>2013-12-06 15:39:07 DEBUG OpenSAML.MessageDecoder.SAML2 [3]: searching metadata for message issuer...<br>2013-12-06
15:39:07 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [3]: evaluating
message flow policy (replay checking on, expiration 60)<br>2013-12-06
15:39:07 DEBUG XMLTooling.StorageService [3]: inserted record
(id-3xJwHyzy6Q0tWi8p5gM575-jtNw-) in context (MessageFlow) with
expiration (1386344585)<br>2013-12-06 15:39:07 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [3]: validating signature profile<br>2013-12-06 15:39:07 DEBUG XMLTooling.TrustEngine.ExplicitKey [3]: attempting to validate signature with the peer's credentials<br>2013-12-06 15:39:07 DEBUG XMLTooling.TrustEngine.ExplicitKey [3]: signature validated with credential<br>2013-12-06 15:39:07 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [3]: signature verified against message issuer<br>2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: processing message against SAML 2.0 SSO profile<br>2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: extracting issuer from SAML 2.0 assertion<br>2013-12-06
15:39:07 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [3]: evaluating
message flow policy (replay checking on, expiration 60)<br>2013-12-06
15:39:07 DEBUG XMLTooling.StorageService [3]: inserted record
(id-SFO1sv8l-shUAEsDAmI2IKE-Khg-) in context (MessageFlow) with
expiration (1386344585)<br>2013-12-06 15:39:07 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [3]: validating signature profile<br>2013-12-06 15:39:07 DEBUG XMLTooling.TrustEngine.ExplicitKey [3]: attempting to validate signature with the peer's credentials<br>2013-12-06 15:39:07 DEBUG XMLTooling.TrustEngine.ExplicitKey [3]: signature validated with credential<br>2013-12-06 15:39:07 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [3]: signature verified against message issuer<br>2013-12-06
15:39:07 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [3]:
assertion satisfied bearer confirmation requirements<br>2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: SSO profile processing completed successfully<br>2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: extracting pushed attributes...<br>2013-12-06
15:39:07 DEBUG Shibboleth.AttributeExtractor.XML [3]: unable to extract
attributes, unknown XML object type: samlp:Response<br>2013-12-06
15:39:07 DEBUG Shibboleth.AttributeExtractor.XML [3]: skipping unmapped
NameID with format
(urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName)<br>2013-12-06
15:39:07 DEBUG Shibboleth.AttributeExtractor.XML [3]: unable to extract
attributes, unknown XML object type: saml:AuthnStatement<br>2013-12-06
15:39:07 DEBUG Shibboleth.AttributeDecoder.String [3]: decoding
SimpleAttribute (MYATTR) from SAML 2 Attribute (MYATTR) with 1 value(s)<br>2013-12-06 15:39:07 DEBUG Shibboleth.AttributeFilter [3]: filtering 1 attribute(s) from (http://myidp.com/idp)<br>2013-12-06
15:39:07 DEBUG Shibboleth.AttributeFilter [3]: applying filtering
rule(s) for attribute (MYATTR) from (http://myidp.com/idp)<br>2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: resolving attributes...<br>2013-12-06
15:39:07 DEBUG Shibboleth.AttributeResolver.Query [3]: found
AttributeStatement in input to new session, skipping query<br>2013-12-06 15:39:07 DEBUG Shibboleth.SessionCache [3]: creating new session<br>2013-12-06 15:39:07 DEBUG Shibboleth.SessionCache [3]: storing new session...<br>2013-12-06
15:39:07 DEBUG XMLTooling.StorageService [3]: inserted record (session)
in context (_263852c73a50b2e98fcbefcd2716fa62) with expiration
(1386347947)<br>2013-12-06 15:39:07 DEBUG XMLTooling.StorageService [3]:
inserted record (E01953571) in context (NameID) with expiration
(1386373147)<br>2013-12-06 15:39:07 DEBUG XMLTooling.StorageService [3]:
inserted record (id-SFO1sv8l-shUAEsDAmI2IKE-Khg-) in context
(_263852c73a50b2e98fcbefcd2716fa62) with expiration (1386347947)<br>2013-12-06
15:39:07 INFO Shibboleth.SessionCache [3]: new session created: ID
(_263852c73a50b2e98fcbefcd2716fa62) IdP (http://myidp.com/idp)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (123.45.678.90)<br>2013-12-06 15:39:07 DEBUG Shibboleth.SSO.SAML2 [3]: ACS returning via redirect to: https://mysp.com/myapp/somepage.html<br>2013-12-06 15:39:07 DEBUG Shibboleth.Listener [4]: dispatching message (find::StorageService::SessionCache)<br>2013-12-06
15:39:07 DEBUG XMLTooling.StorageService [4]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386347947)<br>2013-12-06 15:39:11 DEBUG Shibboleth.Listener [5]: dispatching message (find::StorageService::SessionCache)<br>2013-12-06
15:39:11 DEBUG XMLTooling.StorageService [5]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386347951)<br>2013-12-06 15:39:11 DEBUG Shibboleth.Listener [6]: dispatching message (find::StorageService::SessionCache)<br>2013-12-06
15:39:11 DEBUG XMLTooling.StorageService [6]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386347951)<br>2013-12-06 15:39:11 DEBUG Shibboleth.Listener [1]: dispatching message (find::StorageService::SessionCache)<br>...........<br>...........<br>...........//OMITTED LOG ENTRIES TO REDUCE EMAIL SIZE<br>...........<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [1]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:07 DEBUG Shibboleth.Listener [5]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [5]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:07 DEBUG Shibboleth.Listener [7]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [7]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:07 DEBUG Shibboleth.Listener [9]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [9]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:07 DEBUG Shibboleth.Listener [10]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [10]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:07 DEBUG Shibboleth.Listener [2]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [2]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:07 DEBUG Shibboleth.Listener [3]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [3]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:07 DEBUG Shibboleth.Listener [6]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [6]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:07 DEBUG Shibboleth.Listener [8]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:07 DEBUG XMLTooling.StorageService [8]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348007)<br>2013-12-06 15:40:08 DEBUG Shibboleth.Listener [4]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:08 DEBUG XMLTooling.StorageService [4]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348008)<br>2013-12-06 15:40:08 DEBUG Shibboleth.Listener [1]: dispatching message (touch::StorageService::SessionCache)<br>2013-12-06
15:40:08 DEBUG XMLTooling.StorageService [1]: updated expiration of
valid records in context (_263852c73a50b2e98fcbefcd2716fa62) to
(1386348008)<br>2013-12-06 15:40:14 DEBUG Shibboleth.Listener [5]: dispatching message (remove::StorageService::SessionCache)<br>2013-12-06 15:40:14 INFO Shibboleth.SessionCache [5]: removed session (_263852c73a50b2e98fcbefcd2716fa62)<br>2013-12-06 15:40:14 DEBUG Shibboleth.Listener [5]: dispatching message (default/Login::run::SAML2SI)<br>2013-12-06
15:40:14 DEBUG XMLTooling.StorageService [5]: inserted record
(feff1c4749418cb0f91a09569b44587e074fb146233459a9014e3227fc533f1f) in
context (RelayState) with expiration (1386345014)<br>2013-12-06 15:40:14 WARN Shibboleth.SessionInitiator.SAML2 [5]: no credential resolver installed, leaving message unsigned<br>************************************************************************************************<br><br>This is followed by the SP trying to <br><br>Following are the Application defaults for the SP in shibboleth2.xml<br><br>************************************************************************************************<br> <ApplicationDefaults entityID="MySPEntityID" REMOTE_USER="eppn persistent-id targeted-id"><br><br> <Sessions lifetime="28800" timeout="3600" checkAddress="false" <br> handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="https" relayState="ss:mem"<br> exportLocation="http://localhost/Shibboleth.sso/GetAssertion" exportACL="127.0.0.1" ><br>************************************************************************************************<br><br><br>Currently
the key and cert are out of sync due to some changes and we currently
have following in shibd_warn.log and we are going to be generating a new
key/cert pair.<br>************************************************************************************************<br>2013-12-06
15:37:13 CRIT Shibboleth.Application : error building
CredentialResolver: FilesystemCredentialResolver given mismatched
key/certificate, check for consistency.<br>2013-12-06 15:38:30 WARN Shibboleth.SessionInitiator.SAML2 [1]: no credential resolver installed, leaving message unsigned<br>2013-12-06 15:40:14 WARN Shibboleth.SessionInitiator.SAML2 [5]: no credential resolver installed, leaving message unsigned<br>2013-12-06 16:09:17 WARN Shibboleth.SessionInitiator.SAML2 [9]: no credential resolver installed, leaving message unsigned<br>2013-12-06 16:09:17 WARN Shibboleth.SessionInitiator.SAML2 [2]: no credential resolver installed, leaving message unsigned<br>************************************************************************************************<br><br><br><br><br><br>
<br> </div></body>
</html>