Discussion:
IDP will not release attributes after Java resintall (most likely)
Kanuch, Andrew
2013-02-01 21:03:45 UTC
Permalink
Good Afternoon,

My IDP( which previously worked, and is version 2.3.6 on a Win Server 2008 R2 Box) is now no longer releasing attributes to SPs. I've attempted to fix it for the past two days, and my attempts have not been successful. I'm hoping you might be able to shed some light on a fix, or tell me if a fresh install might be a better route.

Earlier this week Java was updated on the server, and afterwards I was unable to successfully start the Apache Tomcat Service. (To be fair, I'm assuming the Java update caused the service to fail-I could be wrong. It's not a live box yet, so it could have not been working for two months and no one would have been aware--in theory.)

To fix it I have:


1. Uninstalled the new java.

2. Resinstalled an old version. (JRE6, v34)

3. Imported copies of my certificates for my LDAP server into the Java's key store because the old key store was deleted. (LDAP server is Active Directory)

I am now able to successfully start the Apache Tomcat Service on the server, and I can successfully authenticate with various SPs (TestShib, InCommon, Box) but...

... I cannot seem to pass attributes on to any of them.

The IDP audit Log shows:

"20130201T190340Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_ce87ff20d90e5753d37c8bfb7873d90f|https://sp.testshib.org/shibboleth-sp|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://icarus.sdstate.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_b9462eea45b03c3ff6e6349b60e8caff|andy.kanuch|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|||_3c770b9fa285c7e8d4dd816689c5575e,|"

If I understand how the logging mechanism formats output, the attributes being passed should appear at near the end after PasswordProtectedTransport, right?

I've confirmed the user/pass for the account that runs our LDAP queries, and tested it with an LDAP tool.

I ran ACCLI Command with the following: bin\aacli.bat --configDir=conf/ --principal=andy.kanuch --requester=https://sp.testshib.org/ (My first time, and I think the syntax is accurate.)

It returns:

Exception in thread "main" org.springframework.beans.factory.BeanCreationExcepti
on: Error creating bean with name 'shibboleth.HandlerManager': Initialization of
bean failed; nested exception is java.lang.NoClassDefFoundError: javax/servlet/
ServletRequest
at org.springframework.beans.factory.support.AbstractAutowireCapableBean...

(verbose, and then continues with...)

Caused by: java.lang.NoClassDefFoundError: javax/servlet/ServletRequest
at java.lang.Class.getDeclaredMethods0(Native Method)
at java.lang.Class.privateGetDeclaredMethods(Unknown Source)
at java.lang.Class.privateGetPublicMethods(Unknown Source)
at java.lang.Class.getMethods(Unknown Source)
at java.beans.Introspector.getPublicDeclaredMethods(Unknown Source)
at java.beans.Introspector.getTargetMethodInfo(Unknown Source)
at java.beans.Introspector.getBeanInfo(Unknown Source)
at java.beans.Introspector.getBeanInfo(Unknown Source)
at org.springframework.beans.CachedIntrospectionResults.<init>(CachedInt
rospectionResults.java:220)
at org.springframework.beans.CachedIntrospectionResults.forClass(CachedI
ntrospectionResults.java:144)

Am I using the the AACLI tool as intended? (To see if an IDP is releasing attributes for a specific SP profile?) Maybe I reverted back to the wrong version of Java? Or is there something else you might suggestion I have done in error?


Thank you for your time.
Kevin P. Foote
2013-02-01 21:21:12 UTC
Permalink
My IDP( which previously worked, and is version 2.3.6 on a Win Server 2008 R2 Box) is now no longer releasing attributes to SPs.....
Am I using the the AACLI tool as intended? (To see if an IDP is releasing attributes for a specific SP profile?) Maybe I reverted back to the wrong version of Java? Or is there something else you might suggestion I have done in error?
Andrew

Your idp-process.log will show you all you need to know on what
attributes are being obtained and which ones are being released..
Set your logging.xml file to DEBUG for shibboleth.

<logger name="edu.internet2.middleware.shibboleth">
<level value="DEBUG" />
</logger>

Next your aacli error..

You are correct in digging into things with aacli.. it will show you
what attributes you have for your principal and what is being released
if any..

To fix the aacli error copy the servlet-api.jar file found in your
tomcat/lib directory to your shibboleth-idp/lib directory. That should
fix you up on that front..

------
thanks
kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Kanuch, Andrew
2013-02-01 22:13:14 UTC
Permalink
Thanks, Kevin.

The the applet in place the AACLI (with the following argument: bin\aacli.bat --configDir=conf/ --principal=andy.kanuch --requester=https://sp.testshib.org/ )

Returns data for the four attributes listed in my Attribute Filter Policy :

<?xml version="1.0" encoding="UTF-8"?><saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Attribute FriendlyName="eduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">andy.kanuch-B3sqeG8WtU+***@public.gmane.org</saml2:AttributeValue>
</saml2:Attribute>


<saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">member</saml2:AttributeValue>
</saml2:Attribute>

<saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

<saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Andrew</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>


Which matches correctly.

Highlights from the debug (After I changed the flag and logged into Testshib again) show:

15:27:04.484 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:137] - shibboleth.AttributeResolver resolved, for principal andy.kanuch, the attributes: [eduPersonPrincipalName, eduPersonAffiliation, commonName, transientId, eduPersonScopedAffiliation, surname, givenName, eduPersonTargetedID.old, eduPersonTargetedID, title, postalCode, email, telephoneNumber, locality, stateProvince, displayName]

So it's finding the attributes, and I guess it's not a LDAP cert issue. But it also shows: )

15:27:04.484 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter policy testshibby is active for principal andy.kanuch
15:27:04.484 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.filtering.provider.ShibbolethAttributeFilteringEngine:134] - Filter policy testshibby is not active for principal andy.kanuch

So, I think that means I should check my Attribute Filter Policy to make sure it's setup correctly? I have listed it below, and I think I'm using the PermitValueRule correctly?


<afp:AttributeFilterPolicy id="testshibby">
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://sp.testshib.org/" ignoreCase="true"/>

<afp:AttributeRule attributeID="eduPersonAffiliation">
<!-- Permit value rule that releases any value. -->
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>

<afp:AttributeRule attributeID="givenName">
<!-- Permit value rule that releases any value. -->
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>

<afp:AttributeRule attributeID="eduPersonPrincipalName">
<!-- Permit value rule that releases any value. -->
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>

<afp:AttributeRule attributeID="eppn">
<!-- Permit value rule that releases any value. -->
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
</afp:AttributeFilterPolicy>


The wiki only has two pages on AttributeFilterPolicy. Are there other dependencies I might be overlooking?

Thanks,

Andy



-----Original Message-----
From: users-bounces-***@public.gmane.org [mailto:users-bounces-***@public.gmane.org] On Behalf Of Kevin P. Foote
Sent: Friday, February 01, 2013 3:21 PM
To: Shib Users
Subject: Re: IDP will not release attributes after Java resintall (most likely)
My IDP( which previously worked, and is version 2.3.6 on a Win Server 2008 R2 Box) is now no longer releasing attributes to SPs.....
Am I using the the AACLI tool as intended? (To see if an IDP is releasing attributes for a specific SP profile?) Maybe I reverted back to the wrong version of Java? Or is there something else you might suggestion I have done in error?
Andrew

Your idp-process.log will show you all you need to know on what attributes are being obtained and which ones are being released..
Set your logging.xml file to DEBUG for shibboleth.

<logger name="edu.internet2.middleware.shibboleth">
<level value="DEBUG" />
</logger>

Next your aacli error..

You are correct in digging into things with aacli.. it will show you what attributes you have for your principal and what is being released if any..

To fix the aacli error copy the servlet-api.jar file found in your tomcat/lib directory to your shibboleth-idp/lib directory. That should fix you up on that front..

------
thanks
kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Cantor, Scott
2013-02-01 22:24:30 UTC
Permalink
Post by Kanuch, Andrew
Thanks, Kevin.
bin\aacli.bat --configDir=conf/ --principal=andy.kanuch
--requester=https://sp.testshib.org/ )
I would imagine testshib's entityID has a shibboleth on the end if it
follows the typical pattern.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Kanuch, Andrew
2013-02-01 22:39:22 UTC
Permalink
Thanks, Scott!

That made Testshib work for me. I'll have to check on the other two attribute filter policy rule sets and what I'm using for their SP's labels.

Have a good weekend!

-----Original Message-----
From: users-bounces-***@public.gmane.org [mailto:users-bounces-***@public.gmane.org] On Behalf Of Cantor, Scott
Sent: Friday, February 01, 2013 4:25 PM
To: Shib Users
Subject: Re: IDP will not release attributes after Java resintall (most likely)
Post by Kanuch, Andrew
Thanks, Kevin.
bin\aacli.bat --configDir=conf/ --principal=andy.kanuch
--requester=https://sp.testshib.org/ )
I would imagine testshib's entityID has a shibboleth on the end if it follows the typical pattern.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org
Loading...