<div dir="ltr">Hi Cantor,<div>Please let me know what settings you would like to see. By the way, I found a workaround for this by disabling encryptAsserions in relying-party.xml:</div><div><br></div><div><div><bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"></div><div> <property name="profileConfigurations"></div><div> <list></div><div> ..</div><div> <bean parent="SAML2.SSO" p:encryptAssertions="false" /></div><div> ..</div><div> </list></div><div> </property></div><div> </bean></div></div><div><br></div><div>Also have a look at what the logs for this, this might be an Opensaml bug that could be reproduced in isolation from Shibboleth:</div><div><br></div><div><div>2016-01-06 14:54:25,427 - DEBUG [org.opensaml.saml.saml2.profile.impl.EncryptAssertions:132] - Profile Action EncryptAssertions: Assertion before encryption:</div><div><?xml version="1.0" encoding="UTF-8"?></div><div><saml2:Assertion ID="_ef7d814399cb80e4b2e1f57b128d51ca"</div><div> IssueInstant="2016-01-06T14:54:25.272Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></div><div> <saml2:Issuer><a href="http://localhost:8080/saml/2e/shibboleth">http://localhost:8080/saml/2e/shibboleth</a></saml2:Issuer></div><div> <saml2:Subject></div><div> <saml2:NameID</div><div> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"</div><div> NameQualifier="<a href="http://localhost:8080/saml/2e/shibboleth">http://localhost:8080/saml/2e/shibboleth</a>" SPNameQualifier="<a href="https://sp.testshib.org/shibboleth-sp">https://sp.testshib.org/shibboleth-sp</a>">AAdzZWNyZXQxqRBl3Sg7BBVo4Lo8DqCAXCAfxVz/J9h+dBql/Bt4ve1Oh5JH9cvkC6k3T1vruV9ABomcloBerFecMwNShIOj1MsVmUMcE+M2U34Zj/ek7yHsVk+2MgSV2Xj4T6cOjkrhD6vNhm+E</saml2:NameID></div><div> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div> <saml2:SubjectConfirmationData Address="0:0:0:0:0:0:0:1"</div><div> InResponseTo="_ffb3e770316afe20b8c0d7872bf69d10"</div><div> NotOnOrAfter="2016-01-06T14:59:25.344Z" Recipient="<a href="https://sp.testshib.org/Shibboleth.sso/SAML2/POST">https://sp.testshib.org/Shibboleth.sso/SAML2/POST</a>"/></div><div> </saml2:SubjectConfirmation></div><div> </saml2:Subject></div><div> <saml2:Conditions NotBefore="2016-01-06T14:54:25.272Z" NotOnOrAfter="2016-01-06T14:59:25.272Z"></div><div> <saml2:AudienceRestriction></div><div> <saml2:Audience><a href="https://sp.testshib.org/shibboleth-sp">https://sp.testshib.org/shibboleth-sp</a></saml2:Audience></div><div> </saml2:AudienceRestriction></div><div> </saml2:Conditions></div><div> <saml2:AuthnStatement AuthnInstant="2016-01-06T14:54:25.055Z" SessionIndex="_8dac33a1922f57bdac1d8567263bc75e"></div><div> <saml2:SubjectLocality Address="0:0:0:0:0:0:0:1"/></div><div> <saml2:AuthnContext></div><div> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></div><div> </saml2:AuthnContext></div><div> </saml2:AuthnStatement></div><div> <saml2:AttributeStatement></div><div> <saml2:Attribute FriendlyName="lastname" Name="lastname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div> <saml2:AttributeValue</div><div> xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">Albei</saml2:AttributeValue></div><div> </saml2:Attribute></div><div> <saml2:Attribute FriendlyName="firstname" Name="firstname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div> <saml2:AttributeValue</div><div> xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">Bogdan</saml2:AttributeValue></div><div> </saml2:Attribute></div><div> <saml2:Attribute FriendlyName="callsign" Name="callsign" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div> <saml2:AttributeValue</div><div> xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">gigi3</saml2:AttributeValue></div><div> </saml2:Attribute></div><div> </saml2:AttributeStatement></div><div></saml2:Assertion></div><div><br></div><div>2016-01-06 14:54:25,429 - DEBUG [org.opensaml.saml.saml2.encryption.Encrypter:329] - Assertion before encryption:</div><div><?xml version="1.0" encoding="UTF-8"?></div><div><saml2:Assertion ID="_ef7d814399cb80e4b2e1f57b128d51ca"</div><div> IssueInstant="2016-01-06T14:54:25.272Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"></div><div> <saml2:Issuer><a href="http://localhost:8080/saml/2e/shibboleth">http://localhost:8080/saml/2e/shibboleth</a></saml2:Issuer></div><div> <saml2:Subject></div><div> <saml2:NameID</div><div> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"</div><div> NameQualifier="<a href="http://localhost:8080/saml/2e/shibboleth">http://localhost:8080/saml/2e/shibboleth</a>" SPNameQualifier="<a href="https://sp.testshib.org/shibboleth-sp">https://sp.testshib.org/shibboleth-sp</a>">AAdzZWNyZXQxqRBl3Sg7BBVo4Lo8DqCAXCAfxVz/J9h+dBql/Bt4ve1Oh5JH9cvkC6k3T1vruV9ABomcloBerFecMwNShIOj1MsVmUMcE+M2U34Zj/ek7yHsVk+2MgSV2Xj4T6cOjkrhD6vNhm+E</saml2:NameID></div><div> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div><div> <saml2:SubjectConfirmationData Address="0:0:0:0:0:0:0:1"</div><div> InResponseTo="_ffb3e770316afe20b8c0d7872bf69d10"</div><div> NotOnOrAfter="2016-01-06T14:59:25.344Z" Recipient="<a href="https://sp.testshib.org/Shibboleth.sso/SAML2/POST">https://sp.testshib.org/Shibboleth.sso/SAML2/POST</a>"/></div><div> </saml2:SubjectConfirmation></div><div> </saml2:Subject></div><div> <saml2:Conditions NotBefore="2016-01-06T14:54:25.272Z" NotOnOrAfter="2016-01-06T14:59:25.272Z"></div><div> <saml2:AudienceRestriction></div><div> <saml2:Audience><a href="https://sp.testshib.org/shibboleth-sp">https://sp.testshib.org/shibboleth-sp</a></saml2:Audience></div><div> </saml2:AudienceRestriction></div><div> </saml2:Conditions></div><div> <saml2:AuthnStatement AuthnInstant="2016-01-06T14:54:25.055Z" SessionIndex="_8dac33a1922f57bdac1d8567263bc75e"></div><div> <saml2:SubjectLocality Address="0:0:0:0:0:0:0:1"/></div><div> <saml2:AuthnContext></div><div> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></div><div> </saml2:AuthnContext></div><div> </saml2:AuthnStatement></div><div> <saml2:AttributeStatement></div><div> <saml2:Attribute FriendlyName="lastname" Name="lastname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div> <saml2:AttributeValue</div><div> xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">Albei</saml2:AttributeValue></div><div> </saml2:Attribute></div><div> <saml2:Attribute FriendlyName="firstname" Name="firstname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div> <saml2:AttributeValue</div><div> xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">Bogdan</saml2:AttributeValue></div><div> </saml2:Attribute></div><div> <saml2:Attribute FriendlyName="callsign" Name="callsign" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div> <saml2:AttributeValue</div><div> xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</div><div> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xsd:string">gigi3</saml2:AttributeValue></div><div> </saml2:Attribute></div><div> </saml2:AttributeStatement></div><div></saml2:Assertion></div><div><br></div><div>2016-01-06 14:54:25,478 - DEBUG [org.opensaml.saml.saml2.encryption.Encrypter:441] - Placing EncryptedKey elements inline inside EncryptedData</div><div>2016-01-06 14:54:25,486 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'bb'</div><div>2016-01-06 14:54:25,487 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile Action PopulateAuditContext: Skipping field 'DD' not included in audit format</div><div>2016-01-06 14:54:25,487 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile Action PopulateAuditContext: Skipping field 'II' not included in audit format</div><div>2016-01-06 14:54:25,487 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile Action PopulateAuditContext: Skipping field 'SS' not included in audit format</div><div>2016-01-06 14:54:25,488 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile Action PopulateAuditContext: Skipping field 's' not included in audit format</div><div>2016-01-06 14:54:25,488 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile Action PopulateAuditContext: Skipping field 'S' not included in audit format</div><div>2016-01-06 14:54:25,488 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'u'</div><div>2016-01-06 14:54:25,489 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile Action PopulateAuditContext: Skipping field 'HASHEDu' not included in audit format</div><div>2016-01-06 14:54:25,489 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'III'</div><div>2016-01-06 14:54:25,489 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:198] - Profile Action PopulateAuditContext: Skipping field 'SM' not included in audit format</div><div>2016-01-06 14:54:25,490 - TRACE [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:206] - Profile Action PopulateAuditContext: Adding 3 value(s) for field 'attr'</div><div>2016-01-06 14:54:25,541 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:159] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message context</div><div>2016-01-06 14:54:25,541 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'</div><div>2016-01-06 14:54:25,542 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] - Adding destination to outbound SAML 2 protocol message: <a href="https://sp.testshib.org/Shibboleth.sso/SAML2/POST">https://sp.testshib.org/Shibboleth.sso/SAML2/POST</a></div><div>2016-01-06 14:54:25,542 - DEBUG [org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52] - Message Handler: Checking outbound endpoint for allowed URL scheme: <a href="https://sp.testshib.org/Shibboleth.sso/SAML2/POST">https://sp.testshib.org/Shibboleth.sso/SAML2/POST</a></div><div>2016-01-06 14:54:25,546 - DEBUG [org.opensaml.saml.common.SAMLObjectSupport:56] - Examing signed object for content references with exclusive canonicalization transform</div><div>2016-01-06 14:54:25,547 - DEBUG [org.opensaml.saml.common.SAMLObjectSupport:70] - Saw exclusive transform, declaring non-visible namespaces on signed object</div><div>2016-01-06 14:54:25,555 - DEBUG [org.opensaml.saml.common.SAMLObjectContentReference:165] - Adding list of inclusive namespaces for signature exclusive canonicalization transform</div><div>2016-01-06 14:54:25,568 - ERROR [org.opensaml.core.xml.io.AbstractXMLObjectMarshaller:426] - Unable to root namespaces of cached DOM element, {<a href="http://www.w3.org/2001/04/xmlenc#}EncryptionMethod">http://www.w3.org/2001/04/xmlenc#}EncryptionMethod</a></div><div>org.w3c.dom.DOMException: Unable to resolve namespace prefix ds found on element {<a href="http://www.w3.org/2000/09/xmldsig#}DigestMethod">http://www.w3.org/2000/09/xmldsig#}DigestMethod</a></div><div><span class="" style="white-space:pre"> </span>at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)</div><div><span class="" style="white-space:pre"> </span>at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)</div><div>2016-01-06 14:54:25,582 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:182] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message</div><div>org.opensaml.messaging.handler.MessageHandlerException: Error signing outbound protocol message</div><div><span class="" style="white-space:pre"> </span>at org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler.doInvoke(SAMLOutboundProtocolMessageSigningHandler.java:81)</div><div><span class="" style="white-space:pre"> </span>at org.opensaml.messaging.handler.AbstractMessageHandler.invoke(AbstractMessageHandler.java:95)</div><div>Caused by: org.opensaml.core.xml.io.MarshallingException: Unable to root namespaces of cached DOM element, {<a href="http://www.w3.org/2001/04/xmlenc#}EncryptionMethod">http://www.w3.org/2001/04/xmlenc#}EncryptionMethod</a></div><div><span class="" style="white-space:pre"> </span>at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.prepareForAdoption(AbstractXMLObjectMarshaller.java:427)</div><div><span class="" style="white-space:pre"> </span>at org.opensaml.core.xml.io.AbstractXMLObjectMarshaller.marshall(AbstractXMLObjectMarshaller.java:144)</div><div>Caused by: org.w3c.dom.DOMException: Unable to resolve namespace prefix ds found on element {<a href="http://www.w3.org/2000/09/xmldsig#}DigestMethod">http://www.w3.org/2000/09/xmldsig#}DigestMethod</a></div><div><span class="" style="white-space:pre"> </span>at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:247)</div><div><span class="" style="white-space:pre"> </span>at net.shibboleth.utilities.java.support.xml.NamespaceSupport.rootNamespaces(NamespaceSupport.java:295)</div></div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On 6 January 2016 at 14:41, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">On 1/6/16, 3:58 AM, "users on behalf of Bogdan Albei" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:bogdan.albei@callsign.com">bogdan.albei@callsign.com</a>> wrote:<br>
<br>
<br>
<br>
>I am upgrading to Shibboleth 3 and I'm getting the following error just before the attribute release, meaning that the redirect to the relying party is not taking place. I'm using shibboleth 3.2.1 and opensaml 3.2.0.<br>
<br>
</span>You're going to have to provide an explanation of what unusual settings were used. Nobody else has reported a bug of that nature, so it can't be a routine scenario.<br>
<br>
If you can't provide that, then you'll have to basically provide all of your configuration in a bug report.<br>
<span class=""><font color="#888888"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><span style="color:rgb(136,136,136)">Bogdan Albei</span><div style="color:rgb(136,136,136)">Senior Platform Engineer</div><div style="color:rgb(136,136,136)">Callsign Inc.</div><div style="color:rgb(136,136,136)">[C] bogdan</div><div><br></div></div></div></div></div></div></div></div></div></div></div>
</div></div>