<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin-top:15.0pt;
margin-right:0in;
margin-bottom:15.0pt;
margin-left:0in;
font-size:10.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
p.emailquote, li.emailquote, div.emailquote
{mso-style-name:emailquote;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:1.0pt;
border:none;
padding:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
p.error, li.error, div.error
{mso-style-name:error;
margin-top:15.0pt;
margin-right:0in;
margin-bottom:15.0pt;
margin-left:0in;
font-size:10.0pt;
font-family:"Times New Roman","serif";
font-weight:bold;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>OK Scott and Peter, I guess I am still not getting it.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I created a keypair with the proxy name (duketest1us.lims.com) as hostname and entity, and a shibboleth2.xml that I created using testshib page.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I then copied all three to both SP nodes. The metadata shows proxy throughout, for entity, initiator, keys, and consumers. I registered the updated metadata with testshib.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I get the testshib login, enter myself/myself and then the response comes back to the proxy and then I get a fatal error<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>opensaml::FatalProfileException at (http://duketest1us.lims.com/Shibboleth.sso/SAML2/POST)<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>A valid authentication statement was not found in the incoming message.<o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></b></p><p class=MsoNormal><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Checking the logs shows me <o:p></o:p></span></p><p class=MsoNormal><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Failed to decrypt assertion: Unable to resolve any key decryption keys</span></b><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></b></p><p><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> I have confirmed that they key in the metadata sent to testshib is the same as on both systems.<o:p></o:p></span></p><p><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I do see one other error on one of the apache where shibd is running, not the proxy<o:p></o:p></span></p><p><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>[Sun May 24 03:36:27 2015] [error] [client 192.168.1.141] A valid authentication statement was not found in the incoming message.<o:p></o:p></span></p><p><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p><b><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></b></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div class=MsoNormal align=center style='text-align:center'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>William T. Musil</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Manager, Technical Services<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><br></span><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#006AA7'>LABVANTAGE</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#999999'>Solutions, Inc.</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>265 Davidson Avenue, Suite 220<br>Somerset, NJ 08873-4120 USA<br><br>Phone: 908-333-0111<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt;text-autospace:none'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Mobile: 908-531-0835<br>Fax: </span><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>732-560-0121</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><br>Email: <a href="mailto:wmusil@labvantage.com?subject=Link%20from%20Signature"><span style='color:#1F497D'>wmusil@labvantage.com</span></a><br>Website: <a href="http://www.labvantage.com"><span style='color:#1F497D'>www.labvantage.com</span></a><br>Skype: <a href="skype:bmusil.lvs?chat"><span style='color:#1F497D'>bmusil.lvs</span></a><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Musil, William <br><b>Sent:</b> Saturday, May 23, 2015 6:54 PM<br><b>To:</b> Shib Users<br><b>Subject:</b> RE: multiple sp hosts behind a firewall/proxy etc<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Thanks Scott.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I think from reading and Peter's explanation, I will likely not even try to use database persistence. Our application does not require SSO and doesn't use shib for any session data, save for the credential transaction, so having multiple SP with an identical entity should do fine by me. Our effort is focused on integrating our application into an existing federated shibboleth environment that is already in use, as well as ensuring that we have a documented implementation process for other future mplementations that also require shibboleth. I only need the shib session for the app to SP to idp to SP to app transaction flow. Once the credential phase is complete our session management takes over.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I didn't understand the concept of logical SP and that the entity was completely abstract. I assumed incorrectly that they keying was at least partially host specific. Knowing that it is not makes it clearer to me what I need to do.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Thanks again.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div id="composer_signature"><div><p class=MsoNormal><span style='font-size:10.0pt;color:#575757'>Sent from my Verizon Wireless 4G LTE smartphone<o:p></o:p></span></p></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><br><br>-------- Original message --------<br>From: "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> <br>Date: 05/23/2015 18:18 (GMT-05:00) <br>To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> <br>Subject: Re: multiple sp hosts behind a firewall/proxy etc <o:p></o:p></p><div><p class=MsoNormal><span style='font-size:10.0pt'>On 5/23/15, 11:47 AM, "Musil, William" <<a href="mailto:wmusil@labvantage.com">wmusil@labvantage.com</a>> wrote:<br><br>>The issue I think would be that session state at shibd is not shared<br><br>If you've solved the brutally difficult problem of how to cluster an application, then you should try and avoid any use of the SP session other than to initially create an application session and by all means do *not* waste your time trying to cluster the SP.<br><br>The clustering material in the wiki takes great pains to say this.<br><br>>It is almost like what I really need is to put SP deeper into the application layer itself like if SP was a clusterable container, and shibd actually ran as a servlet, using the session replication that comes with java application servers and cluster aware java web applications to store the shibd sessions state data.<br><br>Then don't use Shibboleth and find a Java SP you can live with. The Shibboleth SP is not designed to run inside applications and it never will be. It's about an entirely different problem space.<br><br>>I don't know how to do it yet, but if I persist in a database, I might be able to pull this off.<br><br>On Windows, ODBC is reasonably reliable and not a terrible option with the SP. On Linux it's often unreliable because of bad drivers and ODBC libraries, and it's very system dependent how well it works.<br><br>-- Scott<br><br>-- <br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><o:p></o:p></span></p></div></div></body></html>