<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Hello all,
<div><br>
</div>
<div>I am working on implementing ECP client on idp 3.3.1 for mobile sso. I am not able to get the attribute query working. <span style="font-size: 10pt;"> </span><span style="font-size: 10pt;">In idp-process.log i see "</span><span style="font-size: 10pt;">A
non-proceed event occurred while processing the request: InvalidMessageContext" not sure what i am missing.</span><span style="font-size: 10pt;"> I get the following statusMessage in the response.</span></div>
<div>
<div><saml2p:Status></div>
<div> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/></div>
<div> <saml2p:StatusMessage>unexpected</saml2p:StatusMessage></div>
<div></saml2p:Status></div>
</div>
<div><br>
</div>
<div>I have enabled detailed error logging in idp.properties and in logback.xml, but i cannot get the exception trace in the logs. Following are the AttributeQuery request and the idp-process.log. Please help to get this working .</div>
<div><br>
</div>
<div>1). AttributeQuery request.</div>
<div>
<div><SOAP-ENV:Envelope </div>
<div> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"</div>
<div> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" </div>
<div> xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"</div>
<div> xmlns:ecp="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"></div>
<div> <SOAP-ENV:Header></div>
<div> <span style="white-space: pre;"> </span></div>
<div> </SOAP-ENV:Header></div>
<div> <SOAP-ENV:Body> </div>
<div> <samlp:AttributeQuery</div>
<div> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"</div>
<div> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"</div>
<div> ID="aaf23196-1773-2113-474a-fe114412ab72"</div>
<div> Version="2.0"</div>
<div> IssueInstant="2017-12-15T17:03:09.061Z"></div>
<div> <saml:Issuer></div>
<div> CES</div>
<div> </saml:Issuer></div>
<div> <saml:Subject></div>
<div> <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://ip-c0a882f9/idp/shibboleth" SPNameQualifier="CES">AAdzZWNyZXQxsKD7pGse7dEzbWyvmvaMGmOVlxCGOkdqWkRdowXjXRwr2ArK3Y/UzwCvqZJzp5Ejv+fJixz/aBywXzjX5uKEqzkt37uQCdZNdsffsa956Q==</saml:NameID></div>
<div> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"></div>
<div> <saml:SubjectConfirmationData Address="127.0.0.1" InResponseTo="123456789abcde" NotOnOrAfter="2017-12-15T17:08:52.881Z" Recipient="http://localhost:8080/idp/profile/saml/SOAP/ECP"/></div>
<div> </saml:SubjectConfirmation></div>
<div> </saml:Subject></div>
<div> <saml:Attribute</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</div>
<div> Name="urn:oid:2.5.4.42"</div>
<div> FriendlyName="userName"></div>
<div> </saml:Attribute></div>
<div> <saml:Attribute</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</div>
<div> Name="urn:oid:1.3.6.1.4.1.1466.115.121.1.26"</div>
<div> FriendlyName="sessionKey"></div>
<div> </saml:Attribute></div>
<div> <saml:Attribute</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</div>
<div> Name="urn:oid:1.3.6.1.4.1.1466.115.121.1.26"</div>
<div> FriendlyName="Role"></div>
<div> </saml:Attribute></div>
<div> <saml:Conditions NotBefore="2017-12-15T17:03:52.374Z" NotOnOrAfter="2017-12-15T17:08:52.374Z"></div>
<div> <saml:AudienceRestriction></div>
<div> <saml:Audience>CES</saml:Audience></div>
<div> </saml:AudienceRestriction></div>
<div> </saml:Conditions></div>
<div> </samlp:AttributeQuery> </div>
<div> </SOAP-ENV:Body> </div>
<div></SOAP-ENV:Envelope></div>
</div>
<div>=========<span style="font-size: 10pt;">=========</span><span style="font-size: 10pt;">=========</span><span style="font-size: 10pt;">=========</span><span style="font-size: 10pt;">=========</span></div>
<div><br>
</div>
<div>2). idp-process.log</div>
<div><br>
</div>
<div>
<div>2017-12-16 14:22:37,677 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:418] - Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint at location http://localhost:8080/idp/profile/SAML2/SOAP/ECP using binding
urn:oasis:names:tc:SAML:2.0:bindings:PAOS</div>
<div>2017-12-16 14:22:37,678 - DEBUG [net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:319] - Request is not a SAML 2 AuthnRequest</div>
<div>2017-12-16 14:22:37,678 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:184] - Profile Action PopulateSignatureSigningParameters: Signing enabled</div>
<div>2017-12-16 14:22:37,679 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:197] - Profile Action PopulateSignatureSigningParameters: Resolving SignatureSigningParameters for request</div>
<div>2017-12-16 14:22:37,679 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:229] - Profile Action PopulateSignatureSigningParameters: Adding metadata to resolution criteria for signing/digest algorithms</div>
<div>2017-12-16 14:22:37,679 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:237] - Profile Action PopulateSignatureSigningParameters: Resolved SignatureSigningParameters</div>
<div>2017-12-16 14:22:37,681 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:184] - Profile Action PopulateSignatureSigningParameters: Signing enabled</div>
<div>2017-12-16 14:22:37,682 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:197] - Profile Action PopulateSignatureSigningParameters: Resolving SignatureSigningParameters for request</div>
<div>2017-12-16 14:22:37,682 - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:211] - Profile Action PopulateSignatureSigningParameters: Found existing SecurityParametersContext to copy from</div>
<div>2017-12-16 14:22:37,683 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:299] - Profile Action PopulateEncryptionParameters: No encryption requested, nothing to do</div>
<div>2017-12-16 14:22:37,749 - DEBUG [org.opensaml.saml.common.profile.logic.AbstractNameIDPolicyPredicate:193] - Applying policy to NameID with Format urn:oasis:names:tc:SAML:2.0:nameid-format:transient</div>
<div>2017-12-16 14:22:37,749 - DEBUG [net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:170] - Profile Action ExtractSubjectFromRequest: Creating Subject for canonicalization around NameID AAdzZWNyZXQxTr/cgJ4EjwshlD+lfUBqNpnK1hLYRG1Z61OBN9pMGiiim/Pct3TVwhx+u3FbdFFDUpqPSJuHHe6wpQ1tJ2AKbJ3crV9kqws8cfH8i8xlBQ==</div>
<div>2017-12-16 14:22:37,750 - DEBUG [net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:197] - Profile Action ExtractSubjectFromRequest: Created subject canonicalization context</div>
<div>2017-12-16 14:22:37,751 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 7 canonicalization flows into SubjectCanonicalizationContext</div>
<div>2017-12-16 14:22:37,752 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/LegacyPrincipalConnector for applicability...</div>
<div>2017-12-16 14:22:37,752 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/LegacyPrincipalConnector was not applicable to this request</div>
<div>2017-12-16 14:22:37,753 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/SAML2Transient for applicability...</div>
<div>2017-12-16 14:22:37,753 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'</div>
<div>2017-12-16 14:22:37,753 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:186] - NameIDCanonicalizationFlowDescriptor c14n/SAML2Transient: format matches urn:oasis:names:tc:SAML:2.0:nameid-format:transient</div>
<div>2017-12-16 14:22:37,753 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/SAML2Transient</div>
<div>2017-12-16 14:22:37,756 - DEBUG [net.shibboleth.idp.saml.nameid.impl.BaseTransientDecoder:122] - Transient Decoder 'net.shibboleth.idp.saml.nameid.impl.TransientNameIDDecoder#a50afd5': using the store 'shibboleth.StorageService'</div>
<div>2017-12-16 14:22:37,757 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'</div>
<div>2017-12-16 14:22:37,758 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:186] - NameIDCanonicalizationFlowDescriptor c14n/SAML2Transient: format matches urn:oasis:names:tc:SAML:2.0:nameid-format:transient</div>
<div>2017-12-16 14:22:37,758 - INFO [net.shibboleth.idp.saml.nameid.impl.BaseTransientDecoder:96] - Transient Decoder 'net.shibboleth.idp.saml.nameid.impl.TransientNameIDDecoder#a50afd5': Could not find transient identifier</div>
<div>2017-12-16 14:22:37,759 - INFO [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:62] - Profile Action SelectSubjectCanonicalizationFlow: Moving incomplete flow c14n/SAML2Transient to intermediate set, reselecting a different one</div>
<div>2017-12-16 14:22:37,759 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/LegacyPrincipalConnector for applicability...</div>
<div>2017-12-16 14:22:37,759 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/LegacyPrincipalConnector was not applicable to this request</div>
<div>2017-12-16 14:22:37,760 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/SAML2CryptoTransient for applicability...</div>
<div>2017-12-16 14:22:37,760 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'</div>
<div>2017-12-16 14:22:37,760 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:186] - NameIDCanonicalizationFlowDescriptor c14n/SAML2CryptoTransient: format matches urn:oasis:names:tc:SAML:2.0:nameid-format:transient</div>
<div>2017-12-16 14:22:37,761 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/SAML2CryptoTransient</div>
<div>2017-12-16 14:22:37,763 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'</div>
<div>2017-12-16 14:22:37,763 - DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:186] - NameIDCanonicalizationFlowDescriptor c14n/SAML2CryptoTransient: format matches urn:oasis:names:tc:SAML:2.0:nameid-format:transient</div>
<div>2017-12-16 14:22:37,765 - DEBUG [org.opensaml.saml.common.profile.impl.VerifyChannelBindings:154] - Profile Action VerifyChannelBindings: No channel bindings found to verify, nothing to do</div>
<div>2017-12-16 14:22:37,767 - DEBUG [org.opensaml.saml.saml2.profile.impl.PopulateECPContext:149] - Profile Action PopulateECPContext: RequestAuthenticated: false</div>
<div>2017-12-16 14:22:37,767 - DEBUG [org.opensaml.saml.saml2.profile.impl.PopulateECPContext:167] - Profile Action PopulateECPContext: Assertion encryption is not enabled, skipping session key generation</div>
<div>2017-12-16 14:22:37,768 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:90] - Profile Action InitializeAuthenticationContext: No inbound AuthnRequest, passive and forced flags will be off</div>
<div>2017-12-16 14:22:37,769 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2017-12-16T14:22:37.769+05:30,
isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, initialAuthenticationResult=null, authenticationResult=null, completionInstant=1970-01-01T05:30:00.000+05:30}</div>
<div>2017-12-16 14:22:37,770 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:159] - Profile Action ProcessRequestedAuthnContext: AuthnRequest message was not returned by lookup strategy</div>
<div>2017-12-16 14:22:37,772 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidMessageContext</div>
<div>2017-12-16 14:22:37,772 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] - Error event InvalidMessageContext will be handled with response</div>
<div>2017-12-16 14:22:37,774 - DEBUG [org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:217] - Profile Action AddStatusResponseShell: Setting Issuer to https://ip-c0a882f9/idp/shibboleth</div>
<div>2017-12-16 14:22:37,776 - DEBUG [org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:110] - Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to outgoing Response</div>
<div>2017-12-16 14:22:37,783 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:195] - Profile Action AddStatusToResponse: Detailed errors are enabled</div>
<div>2017-12-16 14:22:37,783 - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:230] - Profile Action AddStatusToResponse: Current state of request was mappable, setting StatusMessage to mapped value</div>
<div>2017-12-16 14:22:37,789 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:179] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND
message context</div>
<div>2017-12-16 14:22:37,789 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'</div>
<div>2017-12-16 14:22:37,790 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLOutboundDestinationHandler:62] - Adding destination to outbound SAML 2 protocol message: http://localhost:8080/idp/profile/SAML2/SOAP/ECP</div>
<div>2017-12-16 14:22:37,791 - DEBUG [org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52] - Message Handler: Checking outbound endpoint for allowed URL scheme: http://localhost:8080/idp/profile/SAML2/SOAP/ECP</div>
<div>2017-12-16 14:22:37,792 - DEBUG [org.opensaml.saml.common.SAMLObjectSupport:56] - Examining signed object for content references with exclusive canonicalization transform</div>
<div>2017-12-16 14:22:37,793 - DEBUG [org.opensaml.saml.common.SAMLObjectSupport:70] - Saw exclusive transform, declaring non-visible namespaces on signed object</div>
<div>2017-12-16 14:22:37,794 - DEBUG [org.opensaml.saml.common.SAMLObjectContentReference:165] - Adding list of inclusive namespaces for signature exclusive canonicalization transform</div>
<div>2017-12-16 14:22:37,812 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:PAOS</div>
<div>2017-12-16 14:22:37,813 - DEBUG [org.opensaml.saml.common.binding.impl.AddChannelBindingsHeaderHandler:85] - Message Handler: No ChannelBindings to add, nothing to do</div>
</div>
<div><br>
</div>
<div>Thank you for your time..!!</div>
<div><br>
</div>
<div>Thanks & Best Regards,</div>
<div>Shivang Goswami</div>
</div>
<P>Oxford University Press (UK) Disclaimer</P>
<P>This message is confidential. You should not copy it or disclose its contents
to anyone. You may use and apply the information for the intended purpose only.
OUP does not accept legal responsibility for the contents of this message. Any
views or opinions presented are those of the author only and not of OUP. If this
email has come to you in error, please delete it, along with any attachments.
Please note that OUP may intercept incoming and outgoing email
communications.</P>
</body>
</html>