<div dir="ltr">Thank you Nate,Scott<div><br></div><div>I was bit confused ... in a hurry I mentioned it as OpenID sorry for that . It is OpenSSO .</div><div><br></div><div><div style="font-family:arial,sans-serif;font-size:13px">
Does this resource protected by this SP work with other IdP's? If so, I think your problem is that the IdP is encoding colon in the RelayState parameter in a strange way.</div></div><div style="font-family:arial,sans-serif;font-size:13px">
<br></div><div>>> yes, our shib SP [ installed on win2008 IIS7.5] protected resource work with other IDP, configured elsewhere.Nate How to find idp encoding RelayState parameter? is there any specific log file that I have to examine?Please suggest.</div>
<div><br></div><div><u>also below is my shib SP configuration file </u></div><div><br></div><div><p class="MsoNormal"><SPConfig
xmlns="urn:mace:shibboleth:2.0:native:sp:config"</p>
<p class="MsoNormal">
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"</p>
<p class="MsoNormal">
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"</p>
<p class="MsoNormal">
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" </p>
<p class="MsoNormal">
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"</p>
<p class="MsoNormal">
clockSkew="180"></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> The InProcess
section contains settings affecting web server modules.</p>
<p class="MsoNormal"> Required for IIS,
but can be removed when using other web servers.</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> <InProcess
logger="native.logger"></p>
<p class="MsoNormal"> <ISAPI
normalizeRequest="true" safeHeaderNames="true"></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> Maps IIS
Instance ID values to the host scheme/name/port. The name is</p>
<p class="MsoNormal"> required
so that the proper <Host> in the request map above is found without</p>
<p class="MsoNormal"> having to
cover every possible DNS/IP combination the user might enter.</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> <Site
id="1" name="<a href="http://gul1.xlindia.com">gul1.xlindia.com</a>" scheme="https"
port="443"/></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> When the
port and scheme are omitted, the HTTP request's port and scheme are used.</p>
<p class="MsoNormal"> If these
are wrong because of virtualization, they can be explicitly set here to</p>
<p class="MsoNormal"> ensure
proper redirect generation.</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> <Site
id="42" name="<a href="http://virtual.example.org">virtual.example.org</a>" scheme="https"
port="443"/></p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> </ISAPI></p>
<p class="MsoNormal"> </InProcess></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> By default,
in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache</p>
<p class="MsoNormal"> are used. See
example-shibboleth2.xml for samples of explicitly configuring them.</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"><StorageService type="Memory"
id="mem" cleanupInterval="900"/></p>
<p class="MsoNormal"> <SessionCache
type="StorageService" StorageService="mem"
cacheTimeout="3600" inprocTimeout="900"
cleanupInterval="900"/></p>
<p class="MsoNormal"> <ReplayCache
StorageService="mem"/></p>
<p class="MsoNormal"> <ArtifactMap
artifactTTL="180"/></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> To customize
behavior for specific resources on IIS, and to link vhosts or</p>
<p class="MsoNormal"> resources to
ApplicationOverride settings below, use the XML syntax below.</p>
<p class="MsoNormal"> See
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo</a>
for help.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> Apache users
should rely on web server options/commands in most cases, and can remove the</p>
<p class="MsoNormal"> RequestMapper
element. See <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig</a></p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> <RequestMapper
type="Native"></p>
<p class="MsoNormal">
<RequestMap></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> The
example requires a session for documents in /secure on the containing host with
http and</p>
<p class="MsoNormal"> https on
the default ports. Note that the name and port in the <Host> elements
MUST match</p>
<p class="MsoNormal"> Apache's
ServerName and Port directives or the IIS Site name in the <ISAPI>
element above.</p>
<p class="MsoNormal">
--> </p>
<p class="MsoNormal"> <Host name="<a href="http://gul1.xlindia.com">gul1.xlindia.com</a>"> </p>
<p class="MsoNormal"> <Path
name="AssessmentCenterStaging" authType="shibboleth"
requireSession="true"/></p>
<p class="MsoNormal">
</Host></p>
<p class="MsoNormal"> <!--
Example of a second vhost mapped to a different applicationId. --></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> <Host
name="<a href="http://admin.example.org">admin.example.org</a>" applicationId="admin"
authType="shibboleth" requireSession="true"/></p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal">
</RequestMap></p>
<p class="MsoNormal">
</RequestMapper></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> The
ApplicationDefaults element is where most of Shibboleth's SAML bits are
defined.</p>
<p class="MsoNormal"> Resource requests
are mapped by the RequestMapper to an applicationId that</p>
<p class="MsoNormal"> points into to
this section (or to the defaults here).</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal">
<ApplicationDefaults entityID="<a href="https://gul1.xlindia.com/shibboleth">https://gul1.xlindia.com/shibboleth</a>"
homeURL="<a href="https://gul1.xlindia.com">https://gul1.xlindia.com</a>" REMOTE_USER="eppn
persistent-id targeted-id" signing="false"
encryption="false"></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> Controls
session lifetimes, address checks, cookie handling, and the protocol handlers.</p>
<p class="MsoNormal"> You MUST
supply an effectively unique handlerURL value for each of your applications.</p>
<p class="MsoNormal"> The value
defaults to /Shibboleth.sso, and should be a relative path, with the SP
computing</p>
<p class="MsoNormal"> a relative
value based on the virtual host. Using handlerSSL="true", the
default, will force</p>
<p class="MsoNormal"> the protocol to
be https. You should also set cookieProps to "https" for SSL-only
sites.</p>
<p class="MsoNormal"> Note that
while we default checkAddress to "false", this has a negative impact
on the</p>
<p class="MsoNormal"> security of
your site. Stealing sessions via cookie theft is much easier with this
disabled.</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <Sessions lifetime="28800"
timeout="3600" relayState="ss:mem"</p>
<p class="MsoNormal">
handlerURL="/Shibboleth.sso" exportLocation="<a href="http://gul1.xlindia.com/Shibboleth.sso/GetAssertion">http://gul1.xlindia.com/Shibboleth.sso/GetAssertion</a>"
exportACL="127.0.0.1"</p>
<p class="MsoNormal"> idpHistory="false"
idpHistoryDays="7" checkAddress="false"
handlerSSL="false" cookieProps="http"></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> Configures
SSO for a default IdP. To allow for >1 IdP, remove</p>
<p class="MsoNormal"> entityID
property and adjust discoveryURL to point to discovery service.</p>
<p class="MsoNormal"> (Set
discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)</p>
<p class="MsoNormal"> You can
also override entityID on /Login query string, or in RequestMap/htaccess.</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> <SSO
entityID="<a href="https://l1osso.wgu.edu:443/opensso/xlso">https://l1osso.wgu.edu:443/opensso/xlso</a>"</p>
<p class="MsoNormal">
discoveryProtocol="SAMLDS"
discoveryURL="<a href="https://ds.example.org/DS/WAYF">https://ds.example.org/DS/WAYF</a>"></p>
<p class="MsoNormal"> SAML2
SAML1</p>
<p class="MsoNormal">
</SSO></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--
SAML and local-only logout. --></p>
<p class="MsoNormal">
<Logout>SAML2 Local</Logout></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--
Extension service that generates "approximate" metadata based on SP
configuration. --></p>
<p class="MsoNormal">
<Handler type="MetadataGenerator"
Location="/Metadata" signing="false"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--
Status reporting service. --></p>
<p class="MsoNormal">
<Handler type="Status" Location="/Status"
acl="<a href="http://gul1.xlindia.com">gul1.xlindia.com</a>"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--
Session diagnostic service. --></p>
<p class="MsoNormal">
<Handler type="Session" Location="/Session"
showAttributeValues="false"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!-- JSON feed of discovery information.
--></p>
<p class="MsoNormal">
<Handler type="DiscoveryFeed"
Location="/DiscoFeed"/></p>
<p class="MsoNormal"> <SessionInitiator
type="Chaining" Location="/Login" id="Intranet"
isDefault="true" relayState="cookie"
entityID="<a href="https://l1osso.wgu.edu:443/opensso/xlso">https://l1osso.wgu.edu:443/opensso/xlso</a>"></p>
<p class="MsoNormal"> <SessionInitiator
type="SAML2" acsIndex="1"
template="bindingTemplate.html"/> <SessionInitiator
type="Shib1" acsIndex="5"/></p>
<p class="MsoNormal"> </SessionInitiator></p>
<p class="MsoNormal">
</Sessions></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> Allows
overriding of error template information/filenames. You can</p>
<p class="MsoNormal"> also add
attributes with values that can be plugged into the templates.</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> <Errors
supportContact="<a href="mailto:root@gul1.xlindia.com">root@gul1.xlindia.com</a>"</p>
<p class="MsoNormal">
helpLocation="/about.html"</p>
<p class="MsoNormal">
styleSheet="/shibboleth-sp/main.css"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--
Example of remotely supplied batch of signed metadata. --></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal">
<MetadataProvider type="XML"
uri="<a href="http://federation.org/federation-metadata.xml">http://federation.org/federation-metadata.xml</a>"</p>
<p class="MsoNormal"> backingFilePath="federation-metadata.xml"
reloadInterval="7200"></p>
<p class="MsoNormal">
<MetadataFilter type="RequireValidUntil"
maxValidityInterval="2419200"/></p>
<p class="MsoNormal">
<MetadataFilter type="Signature"
certificate="fedsigner.pem"/></p>
<p class="MsoNormal">
</MetadataProvider></p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> <MetadataProvider
type="Chaining"> </p>
<p class="MsoNormal"> <MetadataProvider
type="XML"
file="C:\opt\shibboleth-sp\etc\shibboleth\l1wgumeta.xml"/></p>
<p class="MsoNormal"> <!--
Example of locally maintained metadata. --></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal">
<MetadataProvider type="XML" file="partner-metadata.xml"/></p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> </MetadataProvider></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--
Example of locally maintained metadata. --></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal">
<MetadataProvider type="XML"
file="partner-metadata.xml"/></p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!-- Map to
extract attributes from SAML assertions. --></p>
<p class="MsoNormal">
<AttributeExtractor type="XML" validate="true"
reloadChanges="false" path="attribute-map.xml"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!-- Use a
SAML query if no attributes are supplied during SSO. --></p>
<p class="MsoNormal">
<AttributeResolver type="Query"
subjectMatch="true"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--
Default filtering policy for recognized attributes, lets other data pass.
--></p>
<p class="MsoNormal">
<AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!-- Simple
file-based resolver for using a single keypair. --></p>
<p class="MsoNormal"> <CredentialResolver
type="File"
key="C:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem"
certificate="C:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal"> The default
settings can be overridden by creating ApplicationOverride elements (see</p>
<p class="MsoNormal"> the
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride</a>
topic).</p>
<p class="MsoNormal"> Resource
requests are mapped by web server commands, or the RequestMapper, to an</p>
<p class="MsoNormal"> applicationId
setting.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> Example of a
second application (for a second vhost) that has a different entityID.</p>
<p class="MsoNormal"> Resources on
the vhost would map to an applicationId of "admin":</p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal"> <!--</p>
<p class="MsoNormal">
<ApplicationOverride id="admin"
entityID="<a href="https://admin.example.org/shibboleth">https://admin.example.org/shibboleth</a>"/></p>
<p class="MsoNormal"> --></p>
<p class="MsoNormal">
</ApplicationDefaults></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!-- Policies
that determine how to process and authenticate runtime messages. --></p>
<p class="MsoNormal">
<SecurityPolicyProvider type="XML"
validate="true" path="security-policy.xml"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> <!-- Low-level
configuration about protocols and bindings available for use. --></p>
<p class="MsoNormal">
<ProtocolProvider type="XML" validate="true"
reloadChanges="false" path="protocols.xml"/></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"></SPConfig></p><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p><p class="MsoNormal"><span style="font-family:arial,sans-serif;font-size:13px">All the suggestions Scott gave will help you to resolve the problem</span><br>
</p><p class="MsoNormal"><span style="font-family:arial,sans-serif;font-size:13px">>> Yes, followed some of the documents which says common problem for this are,</span></p><p class="MsoNormal"><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51);background-image:initial;background-repeat:initial"> </span></p>
<p class="" style><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)">a.<span style="font-size:7pt;font-family:'Times New Roman'"> a)</span></span><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51);background-image:initial;background-repeat:initial">Load balancing on the IdP or SP could be implemented wrong.
causing some state information to be lost.- for this I enabled sticky sessions </span><u><span style="font-size:13.5pt;font-family:Arial,sans-serif;background-image:initial;background-repeat:initial"></span></u></p><p class="MsoNormal">
<span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)">b) The path in the </span><span style="font-size:10pt;font-family:'Courier New';color:rgb(51,51,51)">cookieProps</span><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)"> setting of this </span><span style="font-size:10pt;font-family:'Courier New';color:rgb(51,51,51)">Application</span><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)"> for the SP has been
misconfigured. This path <b>must</b> be </span><span style="font-size:10pt;font-family:'Courier New';color:rgb(51,51,51)">/</span><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)"> , or the browser will
refuse to return it to the protocol handler, causing either looping or a
redirect to </span><span style="font-size:10pt;font-family:'Courier New';color:rgb(51,51,51)">homeURL</span><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)"> - made relevant changes but no luck.</span><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></p><p class="MsoNormal"><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)"><br></span></p><p class="MsoNormal"><span style="font-size:10.5pt;font-family:Arial,sans-serif;color:rgb(51,51,51)">Thanks -Savitha</span></p>
</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Aug 19, 2014 at 7:35 PM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu" target="_blank">ndk@internet2.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
Savitha,
<div><br>
</div>
<div>
<div><div class="">
<blockquote type="cite">
<div dir="ltr">
<div><span style="font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13px">We have configured Shibboleth service provider on win 2008 -IIS7 in our organization and it will be interacting with an </span><br style="font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13px">
<span style="font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13px">external IDP belongs other organization (not shibboleth it is openId )that supports SAML 2.0(Microsoft product) . </span><br style="font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13px">
</div>
</div>
</blockquote>
<div><br>
</div>
</div><div>This doesn't make much sense to me. OpenID is kinda sorta a protocol suite and Shibboleth is a software product. SAML 2.0 is not a Microsoft product, but a widely used standard. Could you try rephrasing what you're trying to do?</div>
<div class="">
<br>
<blockquote type="cite">
<div dir="ltr">
<div><span style="font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13px">When we browse the shib secured application URL( application which is configured in shib-SP configuration file), </span><br style="font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13px">
<span style="font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13px">it is redirecting to other organization IDP login page for authorization.Once authentication details provided, the SSO control is returning back to locally configured
SP but instead redirecting to our shib secured application page (requested page) the request is looping and refreshing SAML request with different "relay state " value highlighted as below. </span><br style="font-family:Verdana,Geneva,Helvetica,Arial,sans-serif;font-size:13px">
</div>
</div>
</blockquote>
<br>
</div></div>
<div>Does this resource protected by this SP work with other IdP's? If so, I think your problem is that the IdP is encoding colon in the RelayState parameter in a strange way.</div>
</div>
<div><br>
</div>
<div>All the suggestions Scott gave will help you to resolve the problem. These are just a couple breadcrumbs from experience.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Nate.</div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>