<div dir="ltr"><div>Does the problem happen only when you enable shibboleth.authn.External.addDefaultPrincipals and request a specific auth type or all of the time? Did you create your own principal class - which might have serialization issues? <br><br></div><div>Did this problem happen before you upgraded to 3.2.1?<br></div><div><br></div>-Christopher<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 21, 2015 at 11:46 AM, Stefan Santesson <span dir="ltr"><<a href="mailto:stefan@aaa-sec.com" target="_blank">stefan@aaa-sec.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Tried to post this as a new thread but it doesn’t show up. Trying again in the original thread. Sorry for any double posting.<br>
<br>
<br>
I have upgraded the IdP from 3.1.1 to 3.2.1<br>
<br>
The principal is accepted:<br>
<br>
2015-12-21 17:07:48,249 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:262] - Profile Action FinalizeAuthentication: Principal '<a href="http://id.elegnamnden.se/loa/1.0/loa2" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa2</a>' in authentication result satisfies request for principal '<a href="http://id.elegnamnden.se/loa/1.0/loa2" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa2</a>'<br>
<br>
<br>
The the following error appears on the next log entry:<br>
<br>
2015-12-21 17:07:48,250 - DEBUG [net.shibboleth.idp.session.impl.UpdateSessionWithAuthenticationResult:221] - Profile Action UpdateSessionWithAuthenticationResult: Creating new session for principal 170001010017<br>
2015-12-21 17:07:48,252 - ERROR [net.shibboleth.idp.authn:-2] - Uncaught runtime exception<br>
net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Storage object was not present in session<br>
at net.shibboleth.utilities.java.support.logic.Constraint.isNotNull(Constraint.java:227)<br>
2015-12-21 17:07:48,253 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: RuntimeException<br>
<br>
<br>
I’ve spent hours trying to figure this one out, but nothing works.<br>
Any hint what this is caused by.<br>
<br>
/Sfefan<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
<br>
<br>
On 19/12/15 14:41, "users on behalf of Stefan Santesson" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:stefan@aaa-sec.com">stefan@aaa-sec.com</a>> wrote:<br>
<br>
>I do have a clue what the problem might be.<br>
><br>
>I noticed that the AuthnContextClassRefPrincipal class, as well as the default setting for shibboleth.authn.External.addDefaultPrincipals is not available in version 3.1.1 but only in 3.2.0 and onward.<br>
>I suspect the my IdP version is too old and that I need to upgrade.<br>
><br>
>I’ll update and see if that solves it.<br>
><br>
>/Stefan<br>
><br>
><br>
><br>
><br>
>On 19/12/15 04:26, "users on behalf of Stefan Santesson" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:stefan@aaa-sec.com">stefan@aaa-sec.com</a>> wrote:<br>
><br>
>>Scott,<br>
>><br>
>><br>
>><br>
>><br>
>>>><br>
>>>>Add an object of type AuthnContextClassRefPrincipal with the value you want to the Subject's principal collection.<br>
>>>><br>
>>>>-- Scott<br>
>><br>
>>Actually, this didn’t work.<br>
>><br>
>><br>
>>My auth/External bean is defined as:<br>
>><br>
>><bean id="authn/External" parent="shibboleth.AuthenticationFlow"<br>
>> p:nonBrowserSupported="false"<br>
>> p:passiveAuthenticationSupported="false"<br>
>> p:forcedAuthenticationSupported="true"><br>
>> <property name="supportedPrincipals"><br>
>> <util:list><br>
>> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="<a href="http://id.elegnamnden.se/loa/1.0/loa2" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa2</a>"/><br>
>> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="<a href="http://id.elegnamnden.se/loa/1.0/loa3" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa3</a>"/><br>
>> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="<a href="http://id.elegnamnden.se/loa/1.0/loa4" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa4</a>"/><br>
>> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="<a href="http://id.elegnamnden.se/loa/1.0/loa2-sigmessage" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa2-sigmessage</a>"/><br>
>> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="<a href="http://id.elegnamnden.se/loa/1.0/loa3-sigmessage" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa3-sigmessage</a>"/><br>
>> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="<a href="http://id.elegnamnden.se/loa/1.0/loa4-sigmessage" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa4-sigmessage</a>"/><br>
>> </util:list><br>
>> </property><br>
>> </bean><br>
>><br>
>>External-auth-config.xml contains: <util:constant id="shibboleth.authn.External.addDefaultPrincipals" static-field="java.lang.Boolean.FALSE" /><br>
>><br>
>><br>
>>The AuthnRequest sends request for 2 supported class refs:<br>
>><br>
>><saml2p:RequestedAuthnContext Comparison="exact"><br>
>> <saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a href="http://id.elegnamnden.se/loa/1.0/loa3" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa3</a></saml2:AuthnContextClassRef><br>
>> <saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a href="http://id.elegnamnden.se/loa/1.0/loa3-sigmessage" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa3-sigmessage</a></saml2:AuthnContextClassRef><br>
>> </saml2p:RequestedAuthnContext><br>
>><br>
>><br>
>><br>
>>The External Auth module sets the <a href="http://id.elegnamnden.se/loa/1.0/loa3-sigmessage" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa3-sigmessage</a> as the context class ref for the response by:<br>
>><br>
>>Principal principal = new UsernamePrincipal(principalName);<br>
>> Principal accPrincipal = new AuthnContextClassRefPrincipal("<a href="http://id.elegnamnden.se/loa/1.0/loa3-sigmessage" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa3-sigmessage</a>");<br>
>> Subject subj = new Subject();<br>
>> subj.getPrincipals().add(principal);<br>
>> subj.getPrincipals().add(accPrincipal);<br>
>>request.setAttribute(“subject", subj);<br>
>><br>
>><br>
>>But the assertion is returned with AuthnContextClassRef = <a href="http://id.elegnamnden.se/loa/1.0/loa3" rel="noreferrer" target="_blank">http://id.elegnamnden.se/loa/1.0/loa3</a><br>
>><br>
>>What am I doing wrong here?<br>
>><br>
>><br>
>>/Stefan<br>
>><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>>--<br>
>>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
>--<br>
>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div></blockquote></div><br></div>