<div dir="ltr"><div><div>Hello Peter,<br></div>Thanks for the guidance. All we have done is take the apps from data center and move them to cloud. I am totally new to shib and shib SP setup.<br></div>PFB details and let me know if you need more info.<br><br>
<table class="" style="border-collapse:collapse;border:medium none" border="1" cellpadding="0" cellspacing="0">
<tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes">
<td style="width:6.65in;border:1pt solid windowtext;padding:0in 5.4pt" valign="top" width="638">
<p class="MsoNormal">12:58:58.445(06/16) INFO<span style="mso-spacerun:yes">
</span>Shibboleth.Application : adding SessionInitiator of type (SAML2) to
chain (/Login)</p>
<p class="MsoNormal">12:58:58.445(06/16) INFO<span style="mso-spacerun:yes">
</span>Shibboleth.Application : adding SessionInitiator of type (Shib1) to
chain (/Login)</p>
<p class="MsoNormal">12:58:58.446(06/16) DEBUG
Shibboleth.SessionInitiator.SAML2 : supporting outgoing binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect)</p>
<p class="MsoNormal">12:58:58.446(06/16) DEBUG
Shibboleth.SessionInitiator.SAML2 : supporting outgoing binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST)</p>
<p class="MsoNormal">12:58:58.446(06/16) DEBUG
Shibboleth.SessionInitiator.SAML2 : supporting outgoing binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign)</p>
<p class="MsoNormal">12:58:58.446(06/16) DEBUG
Shibboleth.SessionInitiator.SAML2 : supporting outgoing binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact)</p>
<p class="MsoNormal">12:58:58.446(06/16) DEBUG
Shibboleth.SessionInitiator.SAML2 : supporting outgoing binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect)</p>
<p class="MsoNormal">12:58:58.446(06/16) DEBUG
Shibboleth.SessionInitiator.SAML2 : supporting outgoing binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST)</p>
<p class="MsoNormal">12:58:58.446(06/16) DEBUG Shibboleth.SessionInitiator.SAML2
: supporting outgoing binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign)</p>
<p class="MsoNormal">12:58:58.446(06/16) DEBUG
Shibboleth.SessionInitiator.SAML2 : supporting outgoing binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact)</p>
<p class="MsoNormal">12:58:58.447(06/16) DEBUG Shibboleth.PropertySet : added
property Location (/Session)</p>
<p class="MsoNormal">12:58:58.447(06/16) DEBUG Shibboleth.PropertySet : added
property type (Session)</p>
<p class="MsoNormal">12:58:58.448(06/16) DEBUG Shibboleth.PropertySet : added
nested property set: {urn:mace:shibboleth:2.0:native:sp:config}Sessions</p>
<p class="MsoNormal">12:58:58.448(06/16) INFO<span style="mso-spacerun:yes">
</span>Shibboleth.Application : adding SessionInitiator of type (Shib1) to
chain (/Login)</p>
<p class="MsoNormal">nk/lNgFT/d8y7topbOcZxhaK/lzwOJcrCxw=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="<a href="https://federation/idp3/shibboleth">https://federation/idp3/shibboleth</a>"
SPNameQualifier="<a href="https://auth.domain.com/">https://auth.domain.com/</a>">_cc1a057008ce7af25acc9a05897819d2</saml2:NameID><saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData
Address="192.168.222.171"
InResponseTo="_968fd4d5f9a4334d2aa72ab9bce0ad08"
NotOnOrAfter="2016-06-16T13:32:00.795Z" Recipient="<a href="https://HOST/SHIRE/SAML2/POST">https://HOST/SHIRE/SAML2/POST</a>"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions
NotBefore="2016-06-16T13:27:00.795Z"
NotOnOrAfter="2016-06-16T13:32:00.795Z"><saml2:AudienceRestriction><saml2:Audience><a href="https://sdauth.sciencedirect.com/">https://sdauth.sciencedirect.com/</a></saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement
AuthnInstant="2016-06-16T13:27:00.402Z"
SessionIndex="17aec448b03b8a41802d3405af3438c900067f333e3cbed9a9e626ea488d811b"><saml2:SubjectLocality
Address="192.168.222.171"/><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><saml2:Attribute
FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"
xsi:type="xs:string"><a href="mailto:v.a@email.com">v.a@email.com</a></saml2:AttributeValue></saml2:Attribute><saml2:Attribute
FriendlyName="eduPersonPrincipalName"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Test001@idp3</saml2:AttributeValue></saml2:Attribute><saml2:Attribute
FriendlyName="sn" Name="urn:oid:2.5.4.4"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"
xsi:type="xs:string">SD</saml2:AttributeValue></saml2:Attribute><saml2:Attribute
FriendlyName="givenName" Name="urn:oid:2.5.4.42"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"
xsi:type="xs:string">Test001</saml2:AttributeValue></saml2:Attribute><saml2:Attribute
FriendlyName="eduPersonEntitlement"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"
xsi:type="xs:string">TestEntitlement</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion></p>
<p class="MsoNormal">13:26:31.626(06/16) DEBUG
Shibboleth.AttributeResolver.Query : found AttributeStatement in input to new
session, skipping query</p>
<p class="MsoNormal">13:26:31.626(06/16) DEBUG Shibboleth.SessionCache :
creating new session</p>
<p class="MsoNormal">13:26:31.626(06/16) DEBUG Shibboleth.SessionCache :
storing new session...</p>
<p class="MsoNormal">13:26:31.626(06/16) DEBUG XMLTooling.StorageService :
inserted record (session) in context (_9b685984837b48ae789856c161d29d10) with
expiration (1466087191)</p>
<p class="MsoNormal">13:26:31.626(06/16) INFO<span style="mso-spacerun:yes">
</span>Shibboleth.SessionCache : new session created: ID
(_9b685984837b48ae789856c161d29d10) IdP
(<a href="https://elsevier.test.federation/idp3/shibboleth">https://elsevier.test.federation/idp3/shibboleth</a>)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (10.168.126.251)</p>
<p class="MsoNormal">13:26:31.626(06/16) INFO<span style="mso-spacerun:yes">
</span>Shibboleth-TRANSACTION : New session (ID:
_9b685984837b48ae789856c161d29d10) with (applicationId: new_shib) for
principal from (IdP: <a href="https://elsevier.test.federation/idp3/shibboleth">https://elsevier.test.federation/idp3/shibboleth</a>) at
(ClientAddress: 10.168.126.251) with (NameIdentifier:
_cc1a057008ce7af25acc9a05897819d2) using (Protocol:
urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID:
_076c038355db166cda8db30fbf0cb108)</p>
<p class="MsoNormal">13:26:31.626(06/16) INFO<span style="mso-spacerun:yes">
</span>Shibboleth-TRANSACTION : Cached the following attributes with session
(ID: _9b685984837b48ae789856c161d29d10) for (applicationId: new_shib) {</p>
</td>
</tr>
</tbody></table>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Shibboleth.xml:</p>
<table class="" style="border-collapse:collapse;border:medium none" border="1" cellpadding="0" cellspacing="0">
<tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes">
<td style="width:824.15pt;border:1pt solid windowtext;padding:0in 5.4pt" valign="top" width="1099">
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><RequestMapper
type="Native"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><RequestMap
applicationId="default" requireSession="true"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><Host
applicationId="new_shib" name="<a href="http://hostUrl.domain.com">hostUrl.domain.com</a>"
requireSession="true" scheme="http"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><Path
authType="shibboleth" exportAssertion="true"
name="hbeat" requireSession="false"/></p>
<p class="MsoNormal"><span style="mso-spacerun:yes">
</span></Host></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><Host
applicationId="new_shib" name="<a href="http://hostUrl.domain.com">hostUrl.domain.com</a>"
requireSession="true" scheme="https"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><Path
authType="shibboleth" exportAssertion="true"
name="hbeat" requireSession="false"/></p>
<p class="MsoNormal"><span style="mso-spacerun:yes">
</span></Host></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><span style="mso-spacerun:yes"> </span><Host
applicationId="old_shib" name="<a href="http://hostUrl.domain.com">hostUrl.domain.com</a>"
requireSession="true" scheme="http"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><Path
authType="shibboleth" exportAssertion="true"
name="hbeat" requireSession="false"/></p>
<p class="MsoNormal"><span style="mso-spacerun:yes">
</span></Host></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><Host
applicationId="old_shib" name="<a href="http://hostUrl.domain.com">hostUrl.domain.com</a>"
requireSession="true" scheme="https"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><Path
authType="shibboleth" exportAssertion="true"
name="hbeat" requireSession="false"/></p>
<p class="MsoNormal"><span style="mso-spacerun:yes">
</span></Host></p>
<p class="MsoNormal"><span style="mso-spacerun:yes">
</span></RequestMap></p>
<p class="MsoNormal"><span style="mso-spacerun:yes">
</span></RequestMapper></p>
<p class="MsoNormal"><span style="mso-spacerun:yes">
</span><ApplicationDefaults attributePrefix="ELS_"
connectTimeout="10" encryption="false"
entityID="<a href="https://auth.domain/">https://auth.domain/</a>"
homeURL="<a href="https://hostUrl2.domain.com/ShibAuth/deliverInstCredentials">https://hostUrl2.domain.com/ShibAuth/deliverInstCredentials</a>"
id="default" policyId="default" signing="false"
timeout="20"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><Sessions
checkAddress="false" cookieName="elsevier"
cookieProps="; path=/; domain=.<a href="http://domain.com">domain.com</a>"
handlerSSL="false"
handlerURL="<a href="https://hostUrl.domain.com/SHIRE">https://hostUrl.domain.com/SHIRE</a>"
lifetime="28800" relayState="cookie" timeout="3600"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span><SSO
discoveryProtocol="SAMLDS"></p>
<p class="MsoNormal"><span style="mso-spacerun:yes"> </span>SAML2
SAML1</p>
<p class="MsoNormal"><span style="mso-spacerun:yes">
</span></SSO></p>
</td>
</tr>
</tbody></table>
<p class="MsoNormal"> </p>
<p class="MsoNormal">When I dump all the headers in java (iterate over all
headers and print) <span style="mso-spacerun:yes"> </span>I do see attributes. I
receive them in a servlet on /ShibAuth/deliverInstCredentials</p>
<table class="" style="border-collapse:collapse;border:medium none" border="1" cellpadding="0" cellspacing="0">
<tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes">
<td style="width:6.65in;border:1pt solid windowtext;padding:0in 5.4pt" valign="top" width="638">
<p class="MsoNormal">Headers received: {RED-REMOTE-HOST=10.172.35.189,
accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
ELS_Shib-AuthnContext-Class=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,
X-Forwarded-Host=cdc316-auth.domain, ELS_Shib-Session-Index=c747076dc1232ee7770efc70f85fbf82389bfdb5b7e32ef11818a05dd14de2cb,
ELS_Shib-Identity-Provider=https:// federation/idp3/shibboleth,
Accept-Language=en-US,en;q=0.5, ELS_givenName=Test001,
ELS_eduPersonPrincipalName=SD_Test001@idp3, ELS_Shib-Assertion-Count=,
ELS_eduPersonOrgDN=, ELS_eduServPersonUName=, ELS_eduPersonPrimaryOrgUnitDN=,
X-RE-ClientHTTPReqVersion=1.1, ELS_eduServPersonGroups=,
OrigHTTPReqVersion=1.1, ELS_organisationId=, ELS_sn=SD,
connection=Keep-Alive, host=be-cdc316a, ELS_memberOf=,
ELS_Shib-Authentication-Instant=2016-06-07T20:27:31.120Z, ELS_mail=v.a@email,
cookie=JSESSIONID=40EE940075DD152BB4315188AC582006.abMwSNTPpUYpoqhsQuMBw;
appRetURL=http%3A%2F%<a href="http://2Fwww.ABC.com">2Fwww.ABC.com</a>%2Fsc%2F; BIGipServerels-es-cdc-tc-http-80=1411058826.20480.0000;
BIGipServerels-es-cdc316-sdauth-http-25007=3173231626.44897.0000;
_shibsession_elsevier=_1140878066a62c061a8de7738f4acb71,
ELS_campusPermanentId=,
ELS_Shib-Authentication-Method=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,
X-Forwarded-For-Received=198.185.23.225, 192.168.222.171,
X-Forwarded-For-Chain=8.8.8.8, 198.185.23.225, 198.185.23.225,
192.168.222.171, 10.172.35.189, ELS_eduPersonNickname=, content-length=0,
RED-PATH=/ShibAuth/deliverInstCredentials, ELS_eduPersonPrimaryAffiliation=,
Accept-Encoding=gzip, deflate, br, ELS_eduPersonAffiliation=,
referer=<a href="https://REF.domain/idp3/profile/SAML2/Redirect/SSO">https://REF.domain/idp3/profile/SAML2/Redirect/SSO</a>,
ELS_eduPersonTargetedID=, ELS_subjectAssertionTargetedID=, ELS_eduServOrgID=,
ELS_eduServPersonACType=, ELS_eduServOrgName=, ELS_eduServPersonRole=,
ELS_eduServOrgSubType=, ELS_eduServOrgCountry=,
RED-REMOTE-ADDR=10.172.35.189,
X-RE-FEproxy=<a href="http://russpf-bec-lvela.telecom.regn.net">russpf-bec-lvela.telecom.regn.net</a>, X-RE-Ref=1
1465331251721429<span style="mso-spacerun:yes"> </span>1 1465331252138596,
ELS_eduServOrgType=, user-agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0)
Gecko/20100101 Firefox/46.0, ELS_eduPersonEntitlement=TestEntitlement,
ELS_eduPersonScopedAffiliation=, ELS_eduPersonOrgUnitDN=, ELS_Shib-Application-ID=new_shib,
ELS_Shib-AuthnContext-Decl=, REMOTE_USER=, X-Forwarded-For=10.172.35.189,
ELS_Shib-Session-ID=_1140878066a62c061a8de7738f4acb71,
ELS_eduServPersonPUID=}</p>
</td>
</tr>
</tbody></table>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Honestly, I am not sure if we are using AJP or proxy. Please
let me know which configuration can tell this for sure.</p>
<p class="MsoNormal"> </p>
<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 14, 2016 at 6:16 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Sachin Kadam <<a href="mailto:sachin.nihcas@gmail.com">sachin.nihcas@gmail.com</a>> [2016-06-14 23:53]:<br>
<span class="">> Following are my log messages. I am not getting attributes from SP -> my<br>
> Java application<br>
<br>
</span>I don't see what those logs have to do with anything. Also haven't you<br>
asked that same question at least twice before in recent weeks?<br>
<br>
Anyway, first make sure the attributes are there in the SP, by<br>
checking the Session handler and the transaction log. Also look for<br>
"skip" messages in shibd.log. Only continue to look at Java once all<br>
the expected attributes are visible in the Session handler.<br>
Then make sure the location tunnelled/proxied to Java is enabled at<br>
least for passive protection from the SP.<br>
<br>
None of those things require DEBUG logging from the SP, btw, and you<br>
don't need to debug the inner workings of the SP when passing<br>
attributes on to Java from httpd is the issue.<br>
<br>
How exactly are you integrating with Java? Tunnelling AJP and request<br>
attributes (and with the AJP- prefix set in the Shib SP, as per the<br>
documentation)? Or reverse proxying HTTP Request Headers?<br>
<br>
Also, how are you determining that the attributes are missing?<br>
Referencing them by name (using what name) or looping over any<br>
available ones (the latter doesn't work with Tomcat)?<br>
What methods are you using on the Java side to access the attributes?<br>
getHeader? getAttribute?<br>
<br>
*All* of the above needs to be correct in order to get the attributes<br>
into Java. Unless you start providing concrete technical details all<br>
that's left is referring you to the documentation:<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPJavaInstall" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPJavaInstall</a><br>
<span class="HOEnZb"><font color="#888888"><br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>