<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:214389163;
mso-list-type:hybrid;
mso-list-template-ids:1905039118 1211387964 201916419 201916421 201916417 201916419 201916421 201916417 201916419 201916421;}
@list l0:level1
{mso-level-start-at:10;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:54.0pt;
text-indent:-18.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:90.0pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:126.0pt;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:162.0pt;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:198.0pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:234.0pt;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:270.0pt;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:306.0pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:342.0pt;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Greetings, all.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Summary: <o:p></o:p></p>
<p class="MsoNormal"> Previously working httpd frontend/tomcat backend (Shib IdP 2.4.4) fails to work for SOAP
<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:36.0pt">back-channel binding after putting it behind a load balancer.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Full story:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’re migrating from a single-server IdP instance, <o:p></o:p></p>
<p class="MsoNormal" style="text-indent:36.0pt">apache httpd front-end,<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:36.0pt">tomcat back end,<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:36.0pt">mysql server<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">to:<o:p></o:p></p>
<p class="MsoNormal"> separate mysql server instance,<o:p></o:p></p>
<p class="MsoNormal"> F5 load-balancer as the front-end,<o:p></o:p></p>
<p class="MsoNormal"> Two back-end nodes, still with apache and with tomcat as the back end [1].<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It Just Works, for standard front-channel requests,<o:p></o:p></p>
<p class="MsoNormal">but there’s One service that I can find that does a back-channel request,<o:p></o:p></p>
<p class="MsoNormal">SAML 1.0/SOAP call to port 8443,<o:p></o:p></p>
<p class="MsoNormal">which is failing.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the single server it works, <o:p></o:p></p>
<p class="MsoNormal">On the new setup, it doesn’t.<o:p></o:p></p>
<p class="MsoNormal">The new server is a VM directly cloned from the old server,<o:p></o:p></p>
<p class="MsoNormal">so there’s no significant config differences that I can see.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It also fails when I stick the legacy server behind the F5 load balancer.
<o:p></o:p></p>
<p class="MsoNormal">Definitely not a config difference.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is pretty relevant to the email thread at<o:p></o:p></p>
<p class="MsoNormal"><a href="http://shibboleth.net/pipermail/users/2015-August/023696.html">http://shibboleth.net/pipermail/users/2015-August/023696.html</a><o:p></o:p></p>
<p class="MsoNormal">but the F5 seems like a new component / not mentioned in that email, and it’s working without the F5.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">There’s a full TRACE log of the relevant (failed) transaction below my signature for clarity,<o:p></o:p></p>
<p class="MsoNormal">but in essence:<o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:54.0pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>front-channel binding happens well, with the published metadata<o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:54.0pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>browser pauses for a second at the SP to allow back-channel binding to occur<o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:54.0pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>back-channel request comes in with a slightly different certificate<o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:54.0pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>back-channel request is denied<o:p></o:p></p>
<p class="MsoListParagraph" style="margin-left:54.0pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">-<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>SP returns “Inter-institutional access failure. Please contact your system administrator for assistance.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can see why that might get rejected easily enough - the certificate differs, so it gets rejected -
<o:p></o:p></p>
<p class="MsoNormal">but my question is:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:36.0pt">Why was it ever working in the first place with plain apache httpd --> tomcat?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m aware of how httpd magically Doesn’t Mangle client certificates using AJP (+ExportCertData option),<o:p></o:p></p>
<p class="MsoNormal">I’ve set up the F5 so it should in theory be passing traffic straight through / not acting as an intermediate as such [2]<o:p></o:p></p>
<p class="MsoNormal">but Something is still getting mangled.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Does this ring any bells for anyone who has experienced this particular pain?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
<p class="MsoNormal">--Benji<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">[1]: I know it’s more sensible to just have F5 talking straight to tomcat,<o:p></o:p></p>
<p class="MsoNormal">but it’s an interim measure prior to v3 migration and extreme workload pressure. Usual story.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[2]: F5 LTM, virtual server – Type, Performance (Layer 4), protocol TCP, Protocol Profile (Client) fastL4, no HTTP Profile, Source Address translation: Auto Map<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">Benji Wakely <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">Unix Systems Administrator,
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">La Trobe University, Melbourne AU<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">============= Full TRACE email for reference: ======================<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">Failed back-channel authentication:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.711 - DEBUG [org.opensaml.ws.security.provider.ClientCertAuthRule:118] - MIIEzDCCA7SgAwIBAgIBCDANBgkqhkiG9w0BAQUFADCBpDEaMBgGA1UEAxMRcHJveHkudmR4aG9z<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">dC5jb20xCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMQ8wDQYDVQQHEwZEdWJsaW4xMTAvBgNV<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">BAoTKE9DTEMgT25saW5lIENvbXB1dGVyIExpYnJhcnkgQ2VudGVyIEluYy4xJjAkBgkqhkiG9w0B<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">CQEWF2hhcnVuLmFiZHVsbGFoQG9jbGMub3JnMB4XDTE1MDcwMTA3MjkyNFoXDTI1MDYzMDA3Mjky<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">NFowgaQxGjAYBgNVBAMTEXByb3h5LnZkeGhvc3QuY29tMQswCQYDVQQGEwJVUzENMAsGA1UECBME<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">T2hpbzEPMA0GA1UEBxMGRHVibGluMTEwLwYDVQQKEyhPQ0xDIE9ubGluZSBDb21wdXRlciBMaWJy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">YXJ5IENlbnRlciBJbmMuMSYwJAYJKoZIhvcNAQkBFhdoYXJ1bi5hYmR1bGxhaEBvY2xjLm9yZzCC<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOTqNhNJbkIriaLVu1a4Dj/GBul2sBHQT9DJ<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">vAjGqdWP1NSCuri2Dq1y0k0ng3OkNXDdse+zkyQ9goN9rypHpuRbfcuODLbqt8DLun6p04C4b0ad<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">/hFnRiIyTbJZ1WORjQ8x5krQrIpfti7GACKYwK/viV68HUGrAffXlEmNNUc8F3pt3yayPx+V0o27<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">6mwYNVRJKhJblwTRDw6I+SCa4HBPZlxzhXTrEHBkT1HQ1tV15en15EFMb+6nBJFDSxWzg5abzW8h<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">V+9PkeO8WCSqDi6Q5n2IPY2L6E94UlxKF62AFnQwWTY4pD6ssZydtLUKDe89lNhokjt/GOWholEy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">9vkCAwEAAaOCAQUwggEBMB0GA1UdDgQWBBTwXv99NVdEop0UslZ+0ysmMHulsjCB0QYDVR0jBIHJ<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">MIHGgBTwXv99NVdEop0UslZ+0ysmMHulsqGBqqSBpzCBpDEaMBgGA1UEAxMRcHJveHkudmR4aG9z<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">dC5jb20xCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRPaGlvMQ8wDQYDVQQHEwZEdWJsaW4xMTAvBgNV<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">BAoTKE9DTEMgT25saW5lIENvbXB1dGVyIExpYnJhcnkgQ2VudGVyIEluYy4xJjAkBgkqhkiG9w0B<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">CQEWF2hhcnVuLmFiZHVsbGFoQG9jbGMub3JnggEIMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEF<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">BQADggEBANwzPoZqFiZjPiuvxhYM9FHnpTV52JZP+VTh6kzjD1opWBbjhTNFGHtbedg2goLRBdKP<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">bZhT6z5qbqd01GHeX3Ag4Uq9oJFq5s5q2XFjIfKKrjRLmw0Pga6ACPDHSilqGKqqhHYhodtGo9d+<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">uS0gUBMLp8uRFj+I/ItjTlKY8Or426O9QDmEriqKtnkqXUBo09ikMu86hYBYe8jD0hhZZ89cVIhM<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">EWp6Da/Qie76v6y7mRDyRPxjpx7+d1RvtsGk/7wEnhwJnx6/w9ChqUqRCGPI9yAAL8OhjnnC0WLK<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">D5umMB37dMgvO74eFTMWTUVMpfA7EEBbpsAn0n69iqGqpYw=<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.711 - DEBUG [org.opensaml.ws.security.provider.ClientCertAuthRule:150] - Attempting client certificate authentication using context presenter entity ID: https://proxy.vdxhost.com/shibboleth<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.716 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:225] - Checking trusted names against credential: [subjectName='1.2.840.113549.1.9.1=#1617686172756e2e616264756c6c6168406f636c632e6f7267,O=OCLC
Online Computer Library Center Inc.,L=Dublin,ST=Ohio,C=US,CN=proxy.vdxhost.com']<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.716 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:227] - Trusted names being evaluated are: [https://proxy.vdxhost.com/shibboleth, *.vdxhost.com]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.716 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:356] - Processing subject alt names<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.716 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:361] - Extracted subject alt names from certificate: []<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.716 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:288] - Processing subject DN common name<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.717 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:297] - Extracted common name from certificate: proxy.vdxhost.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.717 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:319] - Processing subject DN<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.717 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:323] - Extracted X500Principal from certificate: 1.2.840.113549.1.9.1=#1617686172756e2e616264756c6c6168406f636c632e6f7267,O=OCLC
Online Computer Library Center Inc.,L=Dublin,ST=Ohio,C=US,CN=proxy.vdxhost.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.717 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:340] - Trusted name was not a DN or could not be parsed: https://proxy.vdxhost.com/shibboleth<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.718 - DEBUG [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:340] - Trusted name was not a DN or could not be parsed: *.vdxhost.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.718 - ERROR [org.opensaml.xml.security.x509.BasicX509CredentialNameEvaluator:273] - Credential failed name check: [subjectName='1.2.840.113549.1.9.1=#1617686172756e2e616264756c6c6168406f636c632e6f7267,O=OCLC
Online Computer Library Center Inc.,L=Dublin,ST=Ohio,C=US,CN=proxy.vdxhost.com']<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.718 - ERROR [org.opensaml.ws.security.provider.ClientCertAuthRule:157] - Authentication via client certificate failed for context presenter entity ID https://proxy.vdxhost.com/shibboleth<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.719 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml1.AttributeQueryProfileHandler:180] - Message did not meet security requirements<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">org.opensaml.ws.security.SecurityPolicyException: Client certificate authentication failed for context presenter entity ID<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.opensaml.ws.security.provider.ClientCertAuthRule.doEvaluate(ClientCertAuthRule.java:159) ~[openws-1.5.5.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.opensaml.ws.security.provider.ClientCertAuthRule.evaluate(ClientCertAuthRule.java:123) ~[openws-1.5.5.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.opensaml.ws.security.provider.BasicSecurityPolicy.evaluate(BasicSecurityPolicy.java:51) ~[openws-1.5.5.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.opensaml.ws.message.decoder.BaseMessageDecoder.processSecurityPolicy(BaseMessageDecoder.java:132) ~[openws-1.5.5.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:83) ~[openws-1.5.5.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.opensaml.saml1.binding.decoding.BaseSAML1MessageDecoder.decode(BaseSAML1MessageDecoder.java:109) ~[opensaml-2.6.5.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at edu.internet2.middleware.shibboleth.idp.profile.saml1.AttributeQueryProfileHandler.decodeRequest(AttributeQueryProfileHandler.java:165) [shibboleth-identityprovider-2.4.4.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at edu.internet2.middleware.shibboleth.idp.profile.saml1.AttributeQueryProfileHandler.processRequest(AttributeQueryProfileHandler.java:88) [shibboleth-identityprovider-2.4.4.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at edu.internet2.middleware.shibboleth.idp.profile.saml1.AttributeQueryProfileHandler.processRequest(AttributeQueryProfileHandler.java:57) [shibboleth-identityprovider-2.4.4.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) [shibboleth-common-1.4.4.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [tomcat6-servlet-2.5-api-6.0.36.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at ch.SWITCH.aai.uApprove.Intercepter.intercept(Intercepter.java:147) [uApprove-2.5.0.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at ch.SWITCH.aai.uApprove.Intercepter.doFilter(Intercepter.java:118) [uApprove-2.5.0.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.4.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.4.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.4.jar:na]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) [tomcat-coyote-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:311) [tomcat-coyote-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:776) [tomcat-coyote-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:705) [tomcat-coyote-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:898) [tomcat-coyote-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) [tomcat-coyote-6.0.36.jar:6.0.36]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU"> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_26]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-AU">15:59:05.722 - INFO [Shibboleth-Audit:745] - 20151110T045905Z|urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding|_14471315447819|https://proxy.vdxhost.com/shibboleth|urn:mace:shibboleth:2.0:profiles:saml1:query:attribute|https://aaf-test.latrobe.edu.au/idp/shibboleth|urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding|_49f0143eb2e37fb1b11ff328f5e5d2ab||||_7a8013c4fe2d95660b5f35c837e7959a||<o:p></o:p></span></p>
</div>
</body>
</html>