<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hello,<br class="">
<div class=""><br class="">
</div>
<div class="">Admin of a service provider reported to us that occasionally he saw authentication failure in his server log. During investigation I found corresponding NoCredentials error in idp_process log which I don’t understand how this happened. Our IDP
use remote user for authentication. User are redirected to our central authentication system to enter user name/password. I don’t understand why user wasn’t redirected to central authentication system in this case.</div>
<div class=""><br class="">
</div>
<div class="">Apache configuration:</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><Location /idp/Authn/RemoteUser></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" class="">
<br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> AuthType all</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> AuthName CORNELL</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> require valid-user</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""></Location></div>
</div>
<div class=""><br class="">
</div>
<div class=""><b class="">Apache log for a failed authentication:</b></div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">10.145.141.230 9396 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZFBSwMxEIX%2Fyt5y2k2y29YauoViL4WK0FUPXiTNjmwwm8RMIv58s5ViC%2BJxMu89vnlZoRyNF5sUB3uAjwQYiw0ihKidvXMW0wihg%2FCpFTwd9i0ZYvQoKJXZUXndSxwq5YIFYyroE03Zi6ctnaKpksYcpXonxTZnayun4N8YHPRR975SOl7F5Dfqg3vTBmi3ud%2FX9AC9DqAi7boHUuy2LXllx9lSLpasVApuS8abplwsb%2BqS1bNaKs4ZY02WIibYWYzSxpbUjC9K1pR8%2FshnopkLzl5I8ZyhT1x1xUjxNRqLYsJvSQpWOIkahZUjoIhKTDwiC4U8F3Vp8f978lHRKWfIejWpxYkurM99%2FNEo%2BhW9lP5M13%2B2%2FgY%3D
HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko)"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">10.145.141.230 1442 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=6E98202755850B6500EBC6EB90F783D5?execution=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh;
Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko)"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">10.145.141.230 2193 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/Authn/RemoteUser;jsessionid=6E98202755850B6500EBC6EB90F783D5?conversation=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh;
Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko)"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">10.145.141.230 17042 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=6E98202755850B6500EBC6EB90F783D5?execution=e1s1&_eventId_proceed=1 HTTP/1.1" 200 4910
"-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.7 (KHTML, like Gecko)"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">10.145.141.230 8259 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZHNTsMwEIRfJTefEtvpD9RqKlX0UqkIqQEOXJDrLIqFYxuvjXh8nKCKVkIc1zsz%2Bna8RjkYL7Yp9vYIHwkwFltECFE7e%2BcspgFCC%2BFTK3g6HhrSx%2BhRUCqzo%2FK6k9hXygULxlTQJZqyF6ctHaOpksacpHonxS5nayvH4N8Y7PVJd75SOl7F5Dfqg3vTBmi7vT%2FU9AidDqAibdsHUux3DXllpxvJV5KVSsGqZHw2K%2Flyfluyel5LxTljTGUpYoK9xShtbEjN%2BLJkWbh45HMxWwjOXkjxnKEnrrpipPgajEUx4jckBSucRI3CygFQRCVGHpGFQp6LurT4%2Fz35qOiUM2SzHtViogubcx9%2FNIp%2BTS%2BlP9P1n22%2BAQ%3D%3D
HTTP/1.1" 302 - "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">10.145.141.230 1321 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=697A4F0DA4F01EF4379CBF4C1F92349A?execution=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (iPhone;
CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">10.145.141.230 2025 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/Authn/RemoteUser;jsessionid=697A4F0DA4F01EF4379CBF4C1F92349A?conversation=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (iPhone; CPU
iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">10.145.141.230 15845 - - [15/Mar/2016:10:35:10 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=697A4F0DA4F01EF4379CBF4C1F92349A?execution=e1s1&_eventId_proceed=1 HTTP/1.1" 200 4910
"-" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" class="">
<br class="">
</div>
</div>
<div class=""><br class="">
</div>
<div class=""><b class="">IDP process log:</b></div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">2016-03-15 10:35:10,198|10.145.141.230 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:257] - User identity not found in request</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">2016-03-15 10:35:10,212|10.145.141.230 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:121] - Profile Action ValidateExternalAuthentication: External authentication
failed, no user identity or error information returned</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">2016-03-15 10:35:10,213|10.145.141.230 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: NoCredentials</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">2016-03-15 10:35:10,227|10.145.141.230 - INFO [Shibboleth-Audit.SSO:241] - 20160315T143510Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_0b48a680-cce9-0133-6872-0242ac110003|<a href="https://pidash.cornell.edu/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibidp.cit.cornell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_ebc878e876ee2f2bc492e4daa11b425f|||||" class="">https://pidash.cornell.edu/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibidp.cit.cornell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_ebc878e876ee2f2bc492e4daa11b425f|||||</a></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">2016-03-15 10:35:10,484|10.145.141.230 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:257] - User identity not found in request</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">2016-03-15 10:35:10,501|10.145.141.230 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:121] - Profile Action ValidateExternalAuthentication: External authentication
failed, no user identity or error information returned</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">2016-03-15 10:35:10,503|10.145.141.230 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: NoCredentials</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">2016-03-15 10:35:10,516|10.145.141.230 - INFO [Shibboleth-Audit.SSO:241] - 20160315T143510Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_0b7a19a0-cce9-0133-1648-0242ac11000c|<a href="https://pidash.cornell.edu/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibidp.cit.cornell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f1a9d6cbb5c9d9bc90113ab0eb421a83|||||" class="">https://pidash.cornell.edu/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shibidp.cit.cornell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_f1a9d6cbb5c9d9bc90113ab0eb421a83|||||</a></div>
</div>
<div class=""><br class="">
</div>
<div class=""><b class="">For comparison, here is the apache log for a success authentication:</b></div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 8433 - - [21/Mar/2016:09:52:44 -0400] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZHNTsMwEIRfJTefEttJyo%2FVVKropVIRUgMcuCDXWRQLxzZeG%2FH4OEUVrYQ4rndm9O14iXIyXqxTHO0ePhJgLNaIEKJ29s5ZTBOEHsKnVvC033VkjNGjoFRmR%2BX1IHGslAsWjKlgSDRlLx63dI6mShpzkOqdFJucra2cg39jcNQHPfhK6XgRk9%2BoD%2B5NG6D9%2Bn5X0z0MOoCKtO8fSLHddOSVq4W6lgMrB34rS8abprwFuClZ3dZScc4Ya7MUMcHWYpQ2dqRm%2FKpkTVnzR96IRS3a9oUUzxn6yFVXjBRfk7EoZvyOpGCFk6hRWDkBiqjEzCOyUMhTUecW%2F78nHxWdcoaslrNaHOnC6tTHH42iX9Jz6c90%2BWerbw%3D%3D
HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 771 - - [21/Mar/2016:09:52:44 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=5A521B6F91A110B5DF2FDFB9CC10C8BC?execution=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 641 - - [21/Mar/2016:09:52:44 -0400] "GET /idp/Authn/RemoteUser;jsessionid=5A521B6F91A110B5DF2FDFB9CC10C8BC?conversation=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 15555 - - [21/Mar/2016:09:52:44 -0400] "GET /idp/profile/SAML2/Redirect/SSO;jsessionid=5A521B6F91A110B5DF2FDFB9CC10C8BC?execution=e1s1&_eventId_proceed=1 HTTP/1.1" 200 4910
"-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 13217 - - [21/Mar/2016:09:52:56 -0400] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZHNasMwEIRfxTedbP04SbGwA6G5BFIKcdtDL0WRN1hUllytXPr4lVNCEyg9rnZm%2BHZUoxrsKDdT7N0BPibAmG0QIUTj3b13OA0QWgifRsPzYd%2BQPsYRJaUqOYrRdAr7QvvgwNoCuolOyYvnLZ2jqVbWHpV%2BJ9k2ZRun5uDfGOzN0XRjoU28iUlvdAz%2BZCzQdvOwF%2FQAnQmgI23bR5Lttg15E2V3Kqs7lne8UjnjZZlXAFXOxEIozTljbJGkiBPsHEblYkME46uclbngT7yUSyGXq1eSvSToM5coGMm%2BButQzvgNmYKTXqFB6dQAKKOWM49MQqkuRV1bxv896ajotbdkXc9qeaYL60sffzSKY02vpT%2FT7Z%2BtvwE%3D
HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 1016 - - [21/Mar/2016:09:52:56 -0400] "GET /idp/profile/SAML2/Redirect/SSO?execution=e1s1 HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101
Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 101069 - - [21/Mar/2016:09:52:56 -0400] "GET /idp/Authn/RemoteUser?conversation=e1s1 HTTP/1.1" 302 845 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101
Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 5359 - - [21/Mar/2016:09:52:57 -0400] "GET /idp/Authn/RemoteUser?conversation=e1s1 HTTP/1.1" 302 254 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101
Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 1037 - hy93 [21/Mar/2016:09:52:57 -0400] "GET /idp/Authn/RemoteUser?conversation=e1s1 HTTP/1.1" 302 - "<a href="https://web1.login.cornell.edu/?SID=CBD40C21E2E68EC7&WAK0Service=https/shibidp.cit.cornell.edu@CIT.CORNELL.EDU&WAK2Name=&WAK0Realms=&ReturnURL=https://shibidp.cit.cornell.edu/CBD40C21E2E68EC7/cuwal2.c0ntinue&VerP=3&VerC=2.3.0.229/idmbuild@fox02.serverfarm.cornell.edu/RedHat6-64bit-229/2.2.27&VerS=Apache%2020160313-1003&VerO=Linux%20cork57.serverfarm.cornell.edu%202.6.32-573.7.1.el6.x86_64%20%231%20SMP%20Thu%20Sep%2010%2013:42:16%20EDT%202015%20x86_64%20x86_64%20x86_64%20GNU/Linux%20Red%20Hat%20Enterprise%20Linux%20Server%20release%206.7%20%20Santiago%20&Accept=K2&WANow=1458568376&WAK2Flags=0&WAreason=1" class="">https://web1.login.cornell.edu/?SID=CBD40C21E2E68EC7&WAK0Service=https/shibidp.cit.cornell.edu@CIT.CORNELL.EDU&WAK2Name=&WAK0Realms=&ReturnURL=https://shibidp.cit.cornell.edu/CBD40C21E2E68EC7/cuwal2.c0ntinue&VerP=3&VerC=2.3.0.229/idmbuild@fox02.serverfarm.cornell.edu/RedHat6-64bit-229/2.2.27&VerS=Apache%2020160313-1003&VerO=Linux%20cork57.serverfarm.cornell.edu%202.6.32-573.7.1.el6.x86_64%20%231%20SMP%20Thu%20Sep%2010%2013:42:16%20EDT%202015%20x86_64%20x86_64%20x86_64%20GNU/Linux%20Red%20Hat%20Enterprise%20Linux%20Server%20release%206.7%20%20Santiago%20&Accept=K2&WANow=1458568376&WAK2Flags=0&WAreason=1</a>"
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">1</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">128.253.101.159 504767 - - [21/Mar/2016:09:52:57 -0400] "GET /idp/profile/SAML2/Redirect/SSO?execution=e1s1&_eventId_proceed=1 HTTP/1.1" 200 16542 "<a href="https://web1.login.cornell.edu/?SID=CBD40C21E2E68EC7&WAK0Service=https/shibidp.cit.cornell.edu@CIT.CORNELL.EDU&WAK2Name=&WAK0Realms=&ReturnURL=https://shibidp.cit.cornell.edu/CBD40C21E2E68EC7/cuwal2.c0ntinue&VerP=3&VerC=2.3.0.229/idmbuild@fox02.serverfarm.cornell.edu/RedHat6-64bit-229/2.2.27&VerS=Apache%2020160313-1003&VerO=Linux%20cork57.serverfarm.cornell.edu%202.6.32-573.7.1.el6.x86_64%20%231%20SMP%20Thu%20Sep%2010%2013:42:16%20EDT%202015%20x86_64%20x86_64%20x86_64%20GNU/Linux%20Red%20Hat%20Enterprise%20Linux%20Server%20release%206.7%20%20Santiago%20&Accept=K2&WANow=1458568376&WAK2Flags=0&WAreason=1" class="">https://web1.login.cornell.edu/?SID=CBD40C21E2E68EC7&WAK0Service=https/shibidp.cit.cornell.edu@CIT.CORNELL.EDU&WAK2Name=&WAK0Realms=&ReturnURL=https://shibidp.cit.cornell.edu/CBD40C21E2E68EC7/cuwal2.c0ntinue&VerP=3&VerC=2.3.0.229/idmbuild@fox02.serverfarm.cornell.edu/RedHat6-64bit-229/2.2.27&VerS=Apache%2020160313-1003&VerO=Linux%20cork57.serverfarm.cornell.edu%202.6.32-573.7.1.el6.x86_64%20%231%20SMP%20Thu%20Sep%2010%2013:42:16%20EDT%202015%20x86_64%20x86_64%20x86_64%20GNU/Linux%20Red%20Hat%20Enterprise%20Linux%20Server%20release%206.7%20%20Santiago%20&Accept=K2&WANow=1458568376&WAK2Flags=0&WAreason=1</a>"
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0”</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">Thanks,</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div apple-content-edited="true" class="">
<div class="">
<div style="orphans: 2; widows: 2;" class="">Hong </div>
</div>
</div>
</div>
</body>
</html>