<div dir="ltr">The error I posted was to my SP. I am testing IDP to SP. IDP is CA SSO generating SAML Assertions after authentication.<div><br></div><div>I started with pointing it to testshib SP so that I can check if IDP is giving proper response. I found error. Since I didn't have more logs, I setup shibboleth SP on my other centos server and enabled debug logs. Didn't find much in shibd.log but ssl error log in SP's <span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">/var/log/httpd/ssl_error_log file makes these entries. </span></div><div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><span> </span>[Wed Jun 20 14:28:38.091829 2018] [mod_shib:error] [pid 1251] [client<span> </span></span><a href="http://123.201.54.30:18945/" rel="noreferrer" target="_blank" style="color:rgb(17,85,204)">123.201.54.30:18945</a><span style="color:rgb(80,0,80);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">] Invalid attribute: Id, referer:<span> </span></span><a href="https://cassoidp.shaku08.edu/affwebservices/public/saml2sso?SMASSERTIONREF=QUERY&SAMLRequest=fZJNU4MwFEX%2FCpN9CY1SSqYwg%2B3CzlTt2OrCjRPgVTJCgrzE6r83gB910204uTf3DAsUTd3yzJpK3cObBTTeR1Mr5MOHhNhOcS1QIleiAeSm4LvsZsOZH%2FC200YXuiZehgidkVottULbQLeD7l0W8HC%2FSUhlTIucUqxkjm0JjfaN6%2FGhtHTnznJdg6l8RE37aEa3d7s98VaOkUr0qX8ZhXCYLFsfK%2FFqg%2FkQIg6HI%2BQ4ViJtbV7LgvYDmKOJt14l5DkI4%2FhChBDnRRjF85AFBYSHQySiGYvzMHIYooW1QiOUSQgLpvNJMJuwYD%2B95Czi4fyJeNvvyVdSlVK9nPeTjxDy6%2F1%2BOxlXPUKHwyIHkHTRP5IPxd2J9%2FOx4kc2SU%2FVDmJPteCv2wU96RlLW37rgterrXauPr2srvVx2YEwkJApoel45f%2BfkX4B&RelayState=ss%3Amem%3A531967b93ad043fd65b381dc9f4dbf64562e71e1fa30a29efcad90074d7c0a1b&SAMLTRANSACTIONID=23fc9d12-a96163d2-1ebf1443-77008b54-13086b4d-ee8" rel="noreferrer" target="_blank" style="color:rgb(17,85,204)">https://cassoidp.shaku08.edu/affwebservices/public/saml2sso?SMASSERTIONREF=QUERY&SAMLRequest=fZJNU4MwFEX%2FCpN9CY1SSqYwg%2B3CzlTt2OrCjRPgVTJCgrzE6r83gB910204uTf3DAsUTd3yzJpK3cObBTTeR1Mr5MOHhNhOcS1QIleiAeSm4LvsZsOZH%2FC200YXuiZehgidkVottULbQLeD7l0W8HC%2FSUhlTIucUqxkjm0JjfaN6%2FGhtHTnznJdg6l8RE37aEa3d7s98VaOkUr0qX8ZhXCYLFsfK%2FFqg%2FkQIg6HI%2BQ4ViJtbV7LgvYDmKOJt14l5DkI4%2FhChBDnRRjF85AFBYSHQySiGYvzMHIYooW1QiOUSQgLpvNJMJuwYD%2B95Czi4fyJeNvvyVdSlVK9nPeTjxDy6%2F1%2BOxlXPUKHwyIHkHTRP5IPxd2J9%2FOx4kc2SU%2FVDmJPteCv2wU96RlLW37rgterrXauPr2srvVx2YEwkJApoel45f%2BfkX4B&RelayState=ss%3Amem%3A531967b93ad043fd65b381dc9f4dbf64562e71e1fa30a29efcad90074d7c0a1b&SAMLTRANSACTIONID=23fc9d12-a96163d2-1ebf1443-77008b54-13086b4d-ee8</a><br></span></div><div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">So I am confused if the error I see of invalid attribute ID is actually from shibboleth SP or SSL.</span></div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Jun 20, 2018 at 9:13 PM Kevin Foote <<a href="mailto:kevin.foote@colorado.edu">kevin.foote@colorado.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
> On Jun 20, 2018, at 8:59 AM, Kunal Shah <<a href="mailto:ks186033@gmail.com" target="_blank">ks186033@gmail.com</a>> wrote:<br>
> <br>
> On further research I found that this error is actually coming from /var/log/httpd/ssl_error_log<br>
<br>
Who’s ssl log .. yours? <br>
<br>
Your IdP metadata looks to be fine and it is registered correctly w/ the TS-SP. <br>
<br>
<br>
> [Wed Jun 20 14:28:38.091829 2018] [mod_shib:error] [pid 1251] [client <a href="http://123.201.54.30:18945" rel="noreferrer" target="_blank">123.201.54.30:18945</a>] Invalid attribute: Id, referer: <a href="https://cassoidp.shaku08.edu/affwebservices/public/saml2sso?SMASSERTIONREF=QUERY&SAMLRequest=fZJNU4MwFEX%2FCpN9CY1SSqYwg%2B3CzlTt2OrCjRPgVTJCgrzE6r83gB910204uTf3DAsUTd3yzJpK3cObBTTeR1Mr5MOHhNhOcS1QIleiAeSm4LvsZsOZH%2FC200YXuiZehgidkVottULbQLeD7l0W8HC%2FSUhlTIucUqxkjm0JjfaN6%2FGhtHTnznJdg6l8RE37aEa3d7s98VaOkUr0qX8ZhXCYLFsfK%2FFqg%2FkQIg6HI%2BQ4ViJtbV7LgvYDmKOJt14l5DkI4%2FhChBDnRRjF85AFBYSHQySiGYvzMHIYooW1QiOUSQgLpvNJMJuwYD%2B95Czi4fyJeNvvyVdSlVK9nPeTjxDy6%2F1%2BOxlXPUKHwyIHkHTRP5IPxd2J9%2FOx4kc2SU%2FVDmJPteCv2wU96RlLW37rgterrXauPr2srvVx2YEwkJApoel45f%2BfkX4B&RelayState=ss%3Amem%3A531967b93ad043fd65b381dc9f4dbf64562e71e1fa30a29efcad90074d7c0a1b&SAMLTRANSACTIONID=23fc9d12-a96163d2-1ebf1443-77008b54-13086b4d-ee8" rel="noreferrer" target="_blank">https://cassoidp.shaku08.edu/affwebservices/public/saml2sso?SMASSERTIONREF=QUERY&SAMLRequest=fZJNU4MwFEX%2FCpN9CY1SSqYwg%2B3CzlTt2OrCjRPgVTJCgrzE6r83gB910204uTf3DAsUTd3yzJpK3cObBTTeR1Mr5MOHhNhOcS1QIleiAeSm4LvsZsOZH%2FC200YXuiZehgidkVottULbQLeD7l0W8HC%2FSUhlTIucUqxkjm0JjfaN6%2FGhtHTnznJdg6l8RE37aEa3d7s98VaOkUr0qX8ZhXCYLFsfK%2FFqg%2FkQIg6HI%2BQ4ViJtbV7LgvYDmKOJt14l5DkI4%2FhChBDnRRjF85AFBYSHQySiGYvzMHIYooW1QiOUSQgLpvNJMJuwYD%2B95Czi4fyJeNvvyVdSlVK9nPeTjxDy6%2F1%2BOxlXPUKHwyIHkHTRP5IPxd2J9%2FOx4kc2SU%2FVDmJPteCv2wU96RlLW37rgterrXauPr2srvVx2YEwkJApoel45f%2BfkX4B&RelayState=ss%3Amem%3A531967b93ad043fd65b381dc9f4dbf64562e71e1fa30a29efcad90074d7c0a1b&SAMLTRANSACTIONID=23fc9d12-a96163d2-1ebf1443-77008b54-13086b4d-ee8</a><br>
> <br>
> does this make sense? something to do with cert ?<br>
<br>
Apache should not be doing anything with your SAML cert(s)<br>
<br>
(The reference to mod_shib:error is a bit baffling to me) <br>
<br>
> I have converted using dos2unix and reuploaded and error persists.<br>
<br>
Again your IdP MD looks fine no dos-ish issues that I can see.<br>
<br>
I'm not sure what else we can do for you set-up wise..<br>
<br>
I am a bit confused on what you are testing though… IdP or SP both or something else altogether :)<br>
<br>
HTH… <br>
<br>
--------<br>
thanks<br>
 kevin.foote<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>