<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello,<br>
<br>
I have tried the patched version of
system/flows/logout/logout-propagation-flow.xml
and got the same warnings. <br>
<br>
Here is what I see in the idp-warn.log file (this is before the
patch but after applying it is the same):
<p style="color: #2b2e2f; font-family: 'Lucida Sans Unicode',
'Lucida Grande', 'Tahoma', Verdana, sans-serif; font-size: 14px;
line-height: 22px; margin: 15px 0" dir="auto">2017-05-25
15:23:32,628 - WARN
[net.shibboleth.idp.profile.config.AbstractProfileConfiguration:285]
- ProfileConfiguration <a
href="http://shibboleth.net/ns/profiles/saml2/sso/browser:"
rel="nofollow noreferrer" target="_blank">http://shibboleth.net/ns/profiles/saml2/sso/browser:</a>
ServletRequest was null<br>
2017-05-25 15:23:45,909 - WARN
[net.shibboleth.idp.profile.config.AbstractProfileConfiguration:285]
- ProfileConfiguration <a
href="http://shibboleth.net/ns/profiles/saml2/sso/browser:"
rel="nofollow noreferrer" target="_blank">http://shibboleth.net/ns/profiles/saml2/sso/browser:</a>
ServletRequest was null<br>
2017-05-25 15:23:48,037 - WARN
[net.shibboleth.idp.profile.config.AbstractProfileConfiguration:285]
- ProfileConfiguration <a
href="http://shibboleth.net/ns/profiles/saml2/logout:"
rel="nofollow noreferrer" target="_blank">http://shibboleth.net/ns/profiles/saml2/logout:</a>
ServletRequest was null</p>
The first warning shows up as soon as the login screen is displayed
in the browser before logging in. The second one is immediately
after logging in. The third one is on logout. The functionality
doesn't seem affected.<br>
<br>
Here is my relying-party.xml file:<br>
<br>
<?xml version="1.0" encoding="UTF-8"?><br>
<beans xmlns=<a class="moz-txt-link-rfc2396E" href="http://www.springframework.org/schema/beans">"http://www.springframework.org/schema/beans"</a><br>
xmlns:context=<a class="moz-txt-link-rfc2396E" href="http://www.springframework.org/schema/context">"http://www.springframework.org/schema/context"</a><br>
xmlns:util=<a class="moz-txt-link-rfc2396E" href="http://www.springframework.org/schema/util">"http://www.springframework.org/schema/util"</a><br>
xmlns:p=<a class="moz-txt-link-rfc2396E" href="http://www.springframework.org/schema/p">"http://www.springframework.org/schema/p"</a><br>
xmlns:c=<a class="moz-txt-link-rfc2396E" href="http://www.springframework.org/schema/c">"http://www.springframework.org/schema/c"</a><br>
xmlns:xsi=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a><br>
xsi:schemaLocation="<a class="moz-txt-link-freetext" href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a>
<a class="moz-txt-link-freetext" href="http://www.springframework.org/schema/beans/spring-beans.xsd">http://www.springframework.org/schema/beans/spring-beans.xsd</a><br>
<a class="moz-txt-link-freetext" href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a>
<a class="moz-txt-link-freetext" href="http://www.springframework.org/schema/context/spring-context.xsd">http://www.springframework.org/schema/context/spring-context.xsd</a><br>
<a class="moz-txt-link-freetext" href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a>
<a class="moz-txt-link-freetext" href="http://www.springframework.org/schema/util/spring-util.xsd">http://www.springframework.org/schema/util/spring-util.xsd</a>"<br>
<br>
default-init-method="initialize"<br>
default-destroy-method="destroy"><br>
<br>
<bean id="shibboleth.UnverifiedRelyingParty"
parent="RelyingParty"><br>
<property name="profileConfigurations"><br>
<list><br>
</list><br>
</property><br>
</bean><br>
<br>
<bean id="shibboleth.DefaultRelyingParty"
parent="RelyingParty"><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="Shibboleth.SSO" /><br>
<bean parent="SAML2.SSO" /><br>
<ref bean="SAML2.ECP" /><br>
<ref bean="SAML2.Logout" /><br>
<ref bean="Liberty.SSOS" /><br>
</list><br>
</property><br>
</bean><br>
<br>
<bean id="SHA1SecurityConfig"
parent="shibboleth.DefaultSecurityConfiguration"<br>
p:signatureSigningConfiguration-ref="shibboleth.SigningConfiguration.SHA1"
/><br>
<br>
<util:list id="shibboleth.RelyingPartyOverrides"><br>
<br>
<bean parent="RelyingPartyByName" c:relyingPartyIds="#{{<br>
'<a class="moz-txt-link-freetext" href="https://mysp.example.org/shibboleth">https://mysp.example.org/shibboleth</a>'<br>
}}"><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="Shibboleth.SSO"
p:postAuthenticationFlows="attribute-release" /><br>
<bean parent="SAML2.SSO"
p:postAuthenticationFlows="attribute-release" /><br>
<ref bean="SAML2.ECP" /><br>
<ref bean="SAML2.Logout" /><br>
<ref bean="Liberty.SSOS" /><br>
</list><br>
</property><br>
</bean><br>
</util:list><br>
<br>
</beans><br>
<br>
<br>
Can't see how the syntax is different than the stock version.<br>
<br>
<p style="color: #2b2e2f; font-family: 'Lucida Sans Unicode',
'Lucida Grande', 'Tahoma', Verdana, sans-serif; font-size: 14px;
line-height: 22px; margin: 15px 0" dir="auto">Thank you,<br>
</p>
<pre class="moz-signature" cols="72">George
</pre>
<div class="moz-cite-prefix">On 2017-05-26 11:55 AM,
<a class="moz-txt-link-abbreviated" href="mailto:users-request@shibboleth.net">users-request@shibboleth.net</a> wrote:<br>
</div>
<blockquote type="cite"
cite="mid:mailman.19.1495814159.2295.users@shibboleth.net">
<pre wrap="">Send users mailing list submissions to
<a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a>
To subscribe or unsubscribe via the World Wide Web, visit
<a class="moz-txt-link-freetext" href="http://shibboleth.net/mailman/listinfo/users">http://shibboleth.net/mailman/listinfo/users</a>
or, via email, send a message with subject or body 'help' to
<a class="moz-txt-link-abbreviated" href="mailto:users-request@shibboleth.net">users-request@shibboleth.net</a>
You can reach the person managing the list at
<a class="moz-txt-link-abbreviated" href="mailto:users-owner@shibboleth.net">users-owner@shibboleth.net</a>
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. Re: error on logout in Shibboleth IdP 3.3.1 (Daniel Lutz)
2. Re: WAYF alternatives (Chris Phillips)
3. Re: WAYF alternatives (Cantor, Scott)
4. Shibboleth 3.3.1 and Duo (privas)
----------------------------------------------------------------------
Message: 1
Date: Fri, 26 May 2017 14:48:33 +0200
From: Daniel Lutz <a class="moz-txt-link-rfc2396E" href="mailto:daniel.lutz@switch.ch"><daniel.lutz@switch.ch></a>
To: <a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a>
Subject: Re: error on logout in Shibboleth IdP 3.3.1
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:7024968f-e715-17c4-71b6-60ebe7e1a127@switch.ch"><7024968f-e715-17c4-71b6-60ebe7e1a127@switch.ch></a>
Content-Type: text/plain; charset=utf-8
Cantor, Scott schrieb am 24.05.17 um 18:24:
</pre>
<blockquote type="cite">
<pre wrap=""><a class="moz-txt-link-freetext" href="https://issues.shibboleth.net/jira/browse/IDP-1132">https://issues.shibboleth.net/jira/browse/IDP-1132</a>
You really should be off the legacy relying party file by now in any case.
</pre>
</blockquote>
<pre wrap="">
While testing logout with different responderIds and security configurations,
I've found another possible cause for these warnings:
During logout propagation to SPs, the PropagateLogout webflow defined in
system/flows/logout/logout-propagation-flow.xml probably doesn't expose
the ProfileRequestContext. This may lead to these warnings.
I've created an issue for this:
<a class="moz-txt-link-freetext" href="https://issues.shibboleth.net/jira/browse/IDP-1183">https://issues.shibboleth.net/jira/browse/IDP-1183</a>
I think that the warnings are harmless as long as the default responderId (entityId
of the IdP) and the default security configuration are in use.
- Daniel
</pre>
</blockquote>
<br>
</body>
</html>