<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR-CH" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt">Dear comunity,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">I’m struggling with a Problem between IDP (2.3.8) and remote CAS server (3 tier configurated). Sometime (I cannot identify when and how) the SP login stucks on the
following error:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Navigator:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">URL:
<a href="https://testidp.unifr.ch/idp/Authn/RemoteUser?ticket=ST-12-LGnqK9uu4jA7YZDBE6FR-login.unifr.ch">
https://testidp.unifr.ch/idp/Authn/RemoteUser?ticket=ST-12-LGnqK9uu4jA7YZDBE6FR-login.unifr.ch</a><o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Display:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> SHIBBOLETH<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> ERROR<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> An error occurred while processing your request. Please contact your helpdesk or user ID office for assistance.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> This service requires cookies. Please ensure that they are enabled and try your going back to your desired resource and trying to login again.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> Use of your browser's back button may cause specific errors that can be resolved by going back to your desired resource and trying to login again.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> If you think you were sent here in error, please contact technical support<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">idp-process.log:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:01.506 - DEBUG [edu.internet2.middleware.shibboleth.idp.StatusServlet:121] - Attempting to authenticate client '127.0.0.1'<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:01.507 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.StoredIDStore:226] - Selecting persistent ID entry based
on prepared sql statement: SELECT * FROM shibpid WHERE persistentId = ? AND deactivationDate IS NULL<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:01.507 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.StoredIDStore:233] - Setting prepared statement parameter
1: 1<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:01.582 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.StoredIDStore:226] - Selecting persistent ID entry based
on prepared sql statement: SELECT * FROM shibpid WHERE persistentId = ?<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:01.582 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.StoredIDStore:233] - Setting prepared statement parameter
1: test<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.336 - DEBUG [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:160] - No session associated with session ID NmI1OTkxYzUyNjU3MDUzMzUxNDAzMDE5NzhjZWYwZTMzOWIzMTBlMWFlOTAxM2JkZjdmM2U3NWFlYzUyODBjZQ==
- session must have timed out<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.338 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:346] - No login context in storage service<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.349 - INFO [Shibboleth-Access:74] - 20140707T142520Z|134.21.209.207|testidp.unifr.ch:443|/profile/SAML2/Redirect/SSO|<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.351 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request
path: /SAML2/Redirect/SSO<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.351 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97] - shibboleth.HandlerManager: Located profile handler of the following
type for the request path: edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.351 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:346] - No login context in storage service<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.351 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:186] - Incoming request does not contain a login context, processing
as first leg of request<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.352 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:337] - Decoding message with decoder binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.357 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration
for https://moodle-test.unifr.ch/shibboleth<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.357 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration
found for https://moodle-test.unifr.ch/shibboleth, looking up configuration based on metadata groups.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.357 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying
party configuration found for https://moodle-test.unifr.ch/shibboleth. Using default relying party configuration.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.363 - INFO [org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:100] - SAML protocol message was not signed, skipping
XML signature processing<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.365 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:358] - Decoded request from relying party 'https://moodle-test.unifr.ch/shibboleth'<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.365 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration
for https://moodle-test.unifr.ch/shibboleth<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.365 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration
found for https://moodle-test.unifr.ch/shibboleth, looking up configuration based on metadata groups.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.365 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying
party configuration found for https://moodle-test.unifr.ch/shibboleth. Using default relying party configuration.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.365 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:224] - Creating login context and transferring control to authentication
engine<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.368 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:167] - Storing LoginContext to StorageService partition loginContexts, key 5239f4ed-651a-46db-8872-da9f30ef5125<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.368 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:237] - Redirecting user to authentication engine at https://testidp.unifr.ch:443/idp/AuthnEngine<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.372 - DEBUG [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:160] - No session associated with session ID NmI1OTkxYzUyNjU3MDUzMzUxNDAzMDE5NzhjZWYwZTMzOWIzMTBlMWFlOTAxM2JkZjdmM2U3NWFlYzUyODBjZQ==
- session must have timed out<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.372 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.373 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:240] - Beginning user authentication process.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.373 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:283] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.shibboleth.idp.authn.provider.PreviousSessionLoginHandler@6faae28b,
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler@3bff4cf3}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.373 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:332] - Filtering out previous session login handler because there is no existing
IdP session<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.373 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:464] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler@3bff4cf3}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.373 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:497] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.374 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserLoginHandler:66] - Redirecting to https://testidp.unifr.ch:443/idp/Authn/RemoteUser<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">16:25:20.532 - DEBUG [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:160] - No session associated with session ID NmI1OTkxYzUyNjU3MDUzMzUxNDAzMDE5NzhjZWYwZTMzOWIzMTBlMWFlOTAxM2JkZjdmM2U3NWFlYzUyODBjZQ==
- session must have timed out<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Sometime all the login chain ended correctly. Could someone help me?<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">By the way, does somebody know how I could handle logging CAS client on the IDP? I found that but it seems not to work:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <logger name="fr.renater.ssocashandler"><o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> <level value="DEBUG" /><o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"> </logger><o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Regards,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt">Jacques<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span lang="EN-US" style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="black" face="Calibri"><span style="font-size:11.0pt;color:black">J.T.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="black" face="Calibri"><span style="font-size:11.0pt;color:black">University of Fribourg<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="black" face="Calibri"><span style="font-size:11.0pt;color:black">Switzerland</span></font><span style="mso-fareast-language:FR-CH"><o:p></o:p></span></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"><o:p> </o:p></span></font></p>
</div>
</body>
</html>