Hi AL,
not sure if this is of help:
https://mail.internet2.edu/wws/arc/shibboleth-users/2004-07/msg00285.html
and I had a similar problem when setting up an SP. It came down to the
root cert of the cert used to sign the AuthenticationStatement
(response from the GET) wasn't in the SP's metadata file. I was using
a dummy setup but adding the root cert to the metadata solved the
problem. I know that Eduserv don't use the uk federation metadata and
you have to upload your signing cert to them before it will work.
Perhaps SD are not using the uk federation metadata either? or the
Globalsign root cert is not in their metadata? Have you contact SD
support? I've found that suppliers are quite good at troubleshooting
SP problems. Even if it's just a dump of their shibd.log
As for no POST after GET. That's what happens when the SP can't verify
the initial response to the GET. The POST is to get attributes. If it
can't verify the GET response, there's no point making a POST for
attributes.
Alistair
On 13 May 2008, at 13:01, Roberts A.L. wrote:
> Dear Shib Techies,
>
> I have previously reported to the list a problem we are having at
> Swansea University (UK) getting our IdP to interact successfully
> with the publisher Science Direct’s SP. Thanks for the assistance so
> far but we are still no nearer to resolving the situation. I am a
> little worried by this scenario. The situation is:
>
> 1) we have a problem with accessing an SP that belongs to the
> UK Fed
> 2) as far as the folks at UK Fed are concerned our IdP is
> working correctly
> 3) According to the Science Direct SP logs the problem is:
> ERROR {nl:OpenSSL [6004] sessionNew: path validation failure: unable
> to get local issuer certificate}} which is causing a failure with
> the message ‘The inter-institutional access system was unable to
> successfully build a login session…’
> 4) UK Fed says that there is nothing wrong with our
> certificate(s) (they are globalsign certs obtained via JANET)
> 5) Our IdP seems to be working fine for every other shib
> protected resource and I can find nothing wrong with our IdP config
> or any errors in the shib log to point at what is failing
> 6) I don’t know what else to do…
>
> My final stab at solving this is down to a difference between the
> way the SD SP and the Eduserv SP interact with our IdP. I have
> noticed that the SD SP does not make any POST Requests after
> establishing a connection via GET in contrast to the Eduserv SP
> which initiates a POST request following a GET. I have included a
> regular session in the shib-error log between the Eduserv SP and our
> Idp and the SD SP below. The salient lines occur just after the cert
> has been passed.
>
> If anyone has got any idea why the SD SP works differently to the
> Eduserv SP then I’d be very grateful.
>
> I’m worried because I now have nowhere to turn to resolve this
> issue. There is strong chance that I can get our users logged on to
> the SD site using the Shibboleth to Athens gateway, although that is
> not working for us at present. If that fails then what else can I
> do? IP resolving is fine for on-campus users but no good for those
> at home or out and about.
>
> Eduserv SP
> ************************************************
> 2008-05-12 16:24:26,428 DEBUG [IdP]
> -1164879503 - Received a request via GET for
> location (https://ccs-shibboleth1.systems.swan.ac.uk/shibboleth-idp/SSO
> ).
> 2008-05-12 16:24:26,427 DEBUG [IdP]
> -1164879503 - Matched handler location:
> (https?://[^:/]+(:(443|80))?/shibboleth-idp/SSO).
> 2008-05-12 16:24:26,427 INFO [IdP]
> -1164879503 - Processing Shibboleth v1.x SSO
> request.
> 2008-05-12 16:24:26,427 DEBUG [IdP]
> -1164879503 - Remote provider has identified
> itself as: (urn:mace:eduserv.org.uk:athens:federation:uk).
> 2008-05-12 16:24:26,427 INFO [IdP]
> -1164879503 - Found matching Relying Party
> for group (http://ukfederation.org.uk).
> 2008-05-12 16:24:26,427 INFO [IdP]
> -1164879503 - Provider is a member of
> Relying Party (http://ukfederation.org.uk).
> 2008-05-12 16:24:26,427 INFO [IdP]
> -1164879503 - Supplied consumer URL
> validated for this provider.
> 2008-05-12 16:24:26,427 DEBUG [IdP]
> -1164879503 - Found a supported name
> identifier format that matches the metadata for the relying party: (urn:mace:shibboleth:1.0:nameIdentifier
> ).
> 2008-05-12 16:24:26,427 DEBUG [IdP]
> -1164879503 - Assigning handle
> (_02ddc37e35bc13fdcbd0b209996e30f7) to principal ([log in to unmask]
> ).
> 2008-05-12 16:24:26,427 DEBUG [IdP]
> -1164879503 - User was authenticated via the
> default method for this relying party (urn:oasis:names:tc:SAML:1.0:am:unspecified
> ).
> 2008-05-12 16:24:26,427 DEBUG [IdP]
> -1164879503 - Metadata indicates support for
> POST profile.
> 2008-05-12 16:24:26,427 DEBUG [IdP]
> -1164879503 - Responding with POST profile.
> 2008-05-12 16:24:26,432 DEBUG [IdP]
> -1164879503 - Dumping generated AuthN
> Assertion:
> <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion
> " xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema
> " xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> AssertionID="_7b140a12d88167f60556068745c4a42f"
> IssueInstant="2008-05-12T15:24:26.432Z" Issuer="urn:mace:inqueue:systems.swan.ac.uk
> " MajorVersion="1" MinorVersion="1"><Conditions
> NotBefore="2008-05-12T15:24:26.432Z"
> NotOnOrAfter
> ="2008-05-12T15:29:26.432Z"><AudienceRestrictionCondition><Audience>urn:mace:eduserv.org.uk:athens:federation:uk
> </Audience><Audience>http://ukfederation.org.uk</Audience></
> AudienceRestrictionCondition></Conditions><AuthenticationStatement
> AuthenticationInstant="2008-05-12T15:24:26.432Z"
> AuthenticationMethod="urn:oasis:names:tc:SAML:
> 1.0:am:unspecified"><Subject><NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier
> "
> NameQualifier
> =
> "urn:mace:inqueue:systems
> .swan.ac.uk">_02ddc37e35bc13fdcbd0b209996e30f7</
> NameIdentifier><SubjectConfirmation><ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer
> </ConfirmationMethod></SubjectConfirmation></
> Subject><SubjectLocality IPAddress="137.44.18.132"></
> SubjectLocality></AuthenticationStatement></Assertion>
> 2008-05-12 16:24:26,444 DEBUG [IdP]
> -1164879503 - Dumping generated SAML Response:
> <Response xmlns="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion
> " xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema
> " xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> IssueInstant="2008-05-12T15:24:26.432Z" MajorVersion="1"
> MinorVersion="1" Recipient="https://auth.athensams.net/saml/PostRcv"
> ResponseID="_65257a4b138f6351b095fc7e53d8e1c7"><ds:Signature
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo>
> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#
> "></ds:CanonicalizationMethod>
> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1
> "></ds:SignatureMethod>
> <ds:Reference URI="#_65257a4b138f6351b095fc7e53d8e1c7">
> <ds:Transforms>
> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature
> "></ds:Transform>
> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-
> c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#
> " PrefixList="code ds kind rw saml samlp typens #default xsd xsi"></
> ec:InclusiveNamespaces></ds:Transform>
> </ds:Transforms>
> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/
> xmldsig#sha1"></ds:DigestMethod>
> <ds:DigestValue>9QvMp55MQlg6ionQjWlEdCUjivQ=</ds:DigestValue>
> </ds:Reference>
> </ds:SignedInfo>
> <ds:SignatureValue>
> O7AiHLhxBmNxk8yAhh4nacE1K8IDyS+I99Y6ORlmAiWbvJPMojSakWjcvEIflr
> +vVhc3cw6gEmJZ
> ZrxD2dQDg8E5Lt
> +yshBR750xqBFfn8GmVVE0ywb5+N9F7OSgJFTxn4aG0OIScaH2L7gmscPenhi0
> MuaqKjOzFzo5xPP9TUo=
> </ds:SignatureValue>
> <ds:KeyInfo>
> <ds:X509Data>
> <ds:X509Certificate>
> MIIEGTCCAwGgAwIBAgILAQAAAAABE7uS4awwDQYJKoZIhvcNAQEFBQAwXzELMAkGA1UEBhMCQkUx
> EzARBgNVBAoTCkN5YmVydHJ1c3QxFzAVBgNVBAsTDkVkdWNhdGlvbmFsIENBMSIwIAYDVQQDExlD
> eWJlcnRydXN0IEVkdWNhdGlvbmFsIENBMB4XDTA3MDcxMjE3NTYxMVoXDTA4MDcxMjE3NTYxMVow
> gcQxCzAJBgNVBAYTAkdCMRcwFQYDVQQIEw5XZXN0IEdsYW1vcmdhbjEQMA4GA1UEBxMHU3dhbnNl
> YTElMCMGA1UEChMcVW5pdmVyc2l0eSBvZiBXYWxlcywgU3dhbnNlYTEMMAoGA1UECxMDTElTMSsw
> KQYDVQQDEyJjY3Mtc2hpYmJvbGV0aDEuc3lzdGVtcy5zd2FuLmFjLnVrMSgwJgYJKoZIhvcNAQkB
> FhlhLmwucm9iZXJ0c0Bzd2Fuc2VhLmFjLnVrMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDH
> o3KMw1GQ/5phHH4OwTZEJC85fctbB7V53Xqg/hHLnfVqyUJ+elOVod/
> 4cS5hvArirTG7OEtsjkhJ
> efhDRi8O3CJX2/VVma2puuS6srnxPFCXbSm9aIl
> +gSWzDSqnHwJHdCbKAy1QcGxt8o2Z5Do/mG4t
> Q5mViH3CvocmuuoLVQIDAQABo4HzMIHwMA4GA1UdDwEB/
> wQEAwIFoDAfBgNVHSMEGDAWgBRlZaM9
> 1zsRowoHJTfJQkpbdndQ4TAdBgNVHQ4EFgQUdfBFTNy0UvwnPtO0n8GosBOAvq8wOgYDVR0fBDMw
> MTAvoC2gK4YpaHR0cDovL2NybC5nbG9iYWxzaWduLm5ldC9lZHVjYXRpb25hbC5jcmwwTwYIKwYB
> BQUHAQEEQzBBMD8GCCsGAQUFBzAChjNodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24ubmV0L2NhY2Vy
> dC9lZHVjYXRpb25hbC5jcnQwEQYJYIZIAYb4QgEBBAQDAgbAMA0GCSqGSIb3DQEBBQUAA4IBAQCM
> QCyVRiHVzptLnFWssYMzhrEnJEf8Z7/
> LW8rTsl5cR6nUvB33asXb5HuSSP9EhCngaf0w2w3EI38U
> g4J
> +
> ot5iBA4tQ17TH0sCEmDq7LDAWHXkqhxJSwjW6K2WQrc0JHPwt29nEPgN5Dmw0h8OEOK7PpCO
> +7J0E1jQDz0NtzPPKxvq/zCO4ieIU9iLiLIRwMN/
> wXVSYemCtvS2FDvIE40FW8t4sVuGQd/fg0E+
> AFHVvhlX4gh0dDhQNx6WP/i/1kbnjVawnM+2ZlDqxEY/
> coBmVKA6PvvVnBzEIgpN2VuXkE5sSZGj
> xdy1wGH4A2yseB4eWaxOK5lNcTVYbXenlSsb
> </ds:X509Certificate>
> </ds:X509Data>
> </ds:KeyInfo></ds:Signature><Status><StatusCode
> Value="samlp:Success"></StatusCode></Status><Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion
> " AssertionID="_7b140a12d88167f60556068745c4a42f"
> IssueInstant="2008-05-12T15:24:26.432Z" Issuer="urn:mace:inqueue:systems.swan.ac.uk
> " MajorVersion="1" MinorVersion="1"><Conditions
> NotBefore="2008-05-12T15:24:26.432Z"
> NotOnOrAfter
> ="2008-05-12T15:29:26.432Z"><AudienceRestrictionCondition><Audience>urn:mace:eduserv.org.uk:athens:federation:uk
> </Audience><Audience>http://ukfederation.org.uk</Audience></
> AudienceRestrictionCondition></Conditions><AuthenticationStatement
> AuthenticationInstant="2008-05-12T15:24:26.432Z"
> AuthenticationMethod="urn:oasis:names:tc:SAML:
> 1.0:am:unspecified"><Subject><NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier
> "
> NameQualifier
> =
> "urn:mace:inqueue:systems
> .swan.ac.uk">_02ddc37e35bc13fdcbd0b209996e30f7</
> NameIdentifier><SubjectConfirmation><ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer
> </ConfirmationMethod></SubjectConfirmation></
> Subject><SubjectLocality IPAddress="137.44.18.132"></
> SubjectLocality></AuthenticationStatement></Assertion></Response>
> 2008-05-12 16:24:26,757 DEBUG [IdP]
> -249011892 - Received a request via POST
> for location (https://ccs-shibboleth1.systems.swan.ac.uk:8443/shibboleth-idp/AA
> ).
> 2008-05-12 16:24:26,759 DEBUG [IdP]
> -249011892 - Dumping generated SAML Request:
> <samlp:Request xmlns="urn:oasis:names:tc:SAML:1.0:protocol"
> xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol
> " xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance
> " IssueInstant="2008-05-12T15:24:26.707Z" MajorVersion="1"
> MinorVersion="0"
> RequestID="cfa7c36322851f62c145a9b24ac30687"><samlp:AttributeQuery
> Resource
> ="urn:mace:eduserv.org.uk:athens:federation:uk"><saml:Subject xmlns="urn:oasis:names:tc:SAML:1.0:assertion
> "><saml:NameIdentifier Format="urn:mace:shibboleth:
> 1.0:nameIdentifier"
> NameQualifier="urn:mace:inqueue:systems.swan.ac.uk">_02ddc37e35bc13fdcbd0b209996e30f7</saml:NameIdentifier><saml:SubjectConfirmation><saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod></saml:SubjectConfirmation></saml:Subject></samlp:AttributeQuery></samlp:Request>
> 2008-05-12 16:24:26,759 DEBUG [IdP]
> -249011892 - Matched handler location: (.+:
> 8443/shibboleth-idp/AA).
> 2008-05-12 16:24:26,759 INFO [IdP]
> -249011892 - Processing SAML v1.1 Attribute
> Query request.
> 2008-05-12 16:24:26,764 INFO [IdP]
> -249011892 - Request contains credentials:
> (CN=gateway.athensams.net,OU=Athens,O=Eduserv,L=Bath,ST=Bath,C=GB).
> 2008-05-12 16:24:26,765 INFO [IdP]
> -249011892 - Remote provider has identified
> itself as: (urn:mace:eduserv.org.uk:athens:federation:uk).
> 2008-05-12 16:24:26,765 INFO [IdP]
> -249011892 - Metadata found for providerId:
> (urn:mace:eduserv.org.uk:athens:federation:uk).
> 2008-05-12 16:24:26,761 DEBUG [IdP]
> -249011892 - Attempting to match X509
> certificate.
> 2008-05-12 16:24:26,761 DEBUG [IdP]
> -249011892 - Inline validation was
> unsuccessful. Attmping PKIX...
> 2008-05-12 16:24:26,761 DEBUG [IdP]
> -249011892 - Matched against hostname.
> 2008-05-12 16:24:26,762 DEBUG [IdP]
> -249011892 - Attemping to validate against
> parent group.
> 2008-05-12 16:24:26,762 DEBUG [IdP]
> -249011892 - Constructed a trust list from
> key authority. Attempting path validation...
> 2008-05-12 16:24:26,763 DEBUG [IdP]
> -249011892 - Path successfully validated.
> 2008-05-12 16:24:26,763 INFO [IdP]
> -249011892 - Supplied credentials validated
> for this provider.
> 2008-05-12 16:24:26,763 DEBUG [IdP]
> -249011892 - Mapping authenticated provider
> (urn:mace:eduserv.org.uk:athens:federation:uk) to Relying Party.
> 2008-05-12 16:24:26,763 INFO [IdP]
> -249011892 - Found matching Relying Party
> for group (http://ukfederation.org.uk).
> 2008-05-12 16:24:26,763 INFO [IdP]
> -249011892 - Provider is a member of
> Relying Party (http://ukfederation.org.uk).
> 2008-05-12 16:24:26,763 INFO [IdP]
> -249011892 - Request contains SAML Subject
> Confirmation method: (urn:oasis:names:tc:SAML:1.0:cm:bearer).
> 2008-05-12 16:24:26,763 DEBUG [IdP]
> -249011892 - Name Identifier format: (urn:mace:shibboleth:1.0:nameIdentifier
> ).
> 2008-05-12 16:24:26,764 DEBUG [IdP]
> -249011892 - Attribute Query Handle
> recognized.
> 2008-05-12 16:24:26,768 INFO [IdP]
> -249011892 - Request is for principal ([log in to unmask]
> ).
> 2008-05-12 16:24:26,768 INFO [IdP]
> -249011892 - Request does not designate
> specific attributes, resolving all available.
> 2008-05-12 16:24:26,768 DEBUG [IdP]
> -249011892 - Received a query for all
> policies applicable to principal: ([log in to unmask]).
> 2008-05-12 16:24:26,768 DEBUG [IdP]
> -249011892 - Attempting to load site ARP
> from: (file:/usr/local/shibboleth-idp/etc/arps/arp.site.xml).
> 2008-05-12 16:24:26,768 DEBUG [IdP]
> -249011892 - Loading XML from (null) with
> Schema validation
> 2008-05-12 16:24:26,765 DEBUG [IdP]
> -249011892 - Returning site policy.
> 2008-05-12 16:24:26,765 DEBUG [IdP]
> -249011892 - Attempting to load user ([log in to unmask]
> ) ARP from: (file:[log in to unmask]
> ).
> 2008-05-12 16:24:26,766 DEBUG [IdP]
> -249011892 - No ARP found.
> 2008-05-12 16:24:26,766 DEBUG [IdP]
> -249011892 - Creating effective ARP from
> (1) polic(y|ies).
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Dumping ARP:
> <AttributeReleasePolicy xmlns="urn:mace:shibboleth:arp:1.0"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="urn:mace:shibboleth:arp:1.0 shibboleth-
> arp-1.0.xsd"><Description>Simplest possible ARP.</
> Description><Rule><Target><AnyTarget></AnyTarget></Target><Attribute
> name="urn:mace:dir:attribute-def:cn"><AnyValue release="deny"></
> AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-
> def:sn"><AnyValue release="deny"></AnyValue></Attribute><Attribute
> name="urn:mace:dir:attribute-def:eduPersonTargetedID"><AnyValue
> release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute
> name="PS"><AnyValue release="permit"></AnyValue></Attribute></Rule></
> AttributeReleasePolicy>
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Computed possible attribute
> release set.
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Possible attribute: PS
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Possible attribute: urn:mace:dir:attribute-def:eduPersonEntitlement
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Possible attribute: urn:mace:dir:attribute-def:eduPersonTargetedID
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Possible attribute: urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Possible attribute: urn:mace:dir:attribute-def:eduPersonPrincipalName
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Received a query for all
> policies applicable to principal: ([log in to unmask]).
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Attempting to load site ARP
> from: (file:/usr/local/shibboleth-idp/etc/arps/arp.site.xml).
> 2008-05-12 16:24:26,779 DEBUG [IdP]
> -249011892 - Loading XML from (null) with
> Schema validation
> 2008-05-12 16:24:26,784 DEBUG [IdP]
> -249011892 - Returning site policy.
> 2008-05-12 16:24:26,785 DEBUG [IdP]
> -249011892 - Attempting to load user ([log in to unmask]
> ) ARP from: (file:[log in to unmask]
> ).
> 2008-05-12 16:24:26,781 DEBUG [IdP]
> -249011892 - No ARP found.
> 2008-05-12 16:24:26,781 DEBUG [IdP]
> -249011892 - Creating effective ARP from
> (1) polic(y|ies).
> 2008-05-12 16:24:26,793 DEBUG [IdP]
> -249011892 - Dumping ARP:
> <AttributeReleasePolicy xmlns="urn:mace:shibboleth:arp:1.0"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="urn:mace:shibboleth:arp:1.0 shibboleth-
> arp-1.0.xsd"><Description>Simplest possible ARP.</
> Description><Rule><Target><AnyTarget></AnyTarget></Target><Attribute
> name="urn:mace:dir:attribute-def:cn"><AnyValue release="deny"></
> AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-
> def:sn"><AnyValue release="deny"></AnyValue></Attribute><Attribute
> name="urn:mace:dir:attribute-def:eduPersonTargetedID"><AnyValue
> release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute
> name="PS"><AnyValue release="permit"></AnyValue></Attribute></Rule></
> AttributeReleasePolicy>
> 2008-05-12 16:24:26,793 INFO [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonEntitlement
> )
> 2008-05-12 16:24:26,789 DEBUG [IdP]
> -249011892 - Attribute (urn:mace:dir:attribute-def:eduPersonEntitlement
> ) depends on connector (directory).
> 2008-05-12 16:24:28,221 DEBUG [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonEntitlement
> )
> 2008-05-12 16:24:28,221 DEBUG [IdP]
> -249011892 - Found value(s) for attribute (urn:mace:dir:attribute-def:eduPersonEntitlement
> ).
> 2008-05-12 16:24:28,222 INFO [IdP]
> -249011892 - Resolving attribute: (PS)
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Attribute (PS) depends on
> connector (directory).
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Connector (directory) already
> resolved for this request, using cached version
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Resolving attribute: (PS)
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Found value(s) for attribute
> (PS).
> 2008-05-12 16:24:28,222 INFO [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> )
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Attribute (urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> ) depends on attribute (urn:mace:dir:attribute-def:eduPersonAffiliation
> ).
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Attribute (urn:mace:dir:attribute-def:eduPersonAffiliation
> ) depends on connector (directory).
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Connector (directory) already
> resolved for this request, using cached version
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonAffiliation
> )
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Found value(s) for attribute (urn:mace:dir:attribute-def:eduPersonAffiliation
> ).
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> )
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Found value(s) for attribute (urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> ).
> 2008-05-12 16:24:28,222 INFO [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonPrincipalName
> )
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Attribute (urn:mace:dir:attribute-def:eduPersonPrincipalName
> ) depends on connector (directory).
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Connector (directory) already
> resolved for this request, using cached version
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonPrincipalName
> )
> 2008-05-12 16:24:28,222 DEBUG [IdP]
> -249011892 - Found value(s) for attribute (urn:mace:dir:attribute-def:eduPersonPrincipalName
> ).
> 2008-05-12 16:24:28,223 INFO [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonTargetedID
> )
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Attribute (urn:mace:dir:attribute-def:eduPersonTargetedID
> ) depends on connector (directory).
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Connector (directory) already
> resolved for this request, using cached version
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Resolving attribute: (urn:mace:dir:attribute-def:eduPersonTargetedID
> )
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Found persistent ID value for
> attribute (urn:mace:dir:attribute-def:eduPersonTargetedID).
> 2008-05-12 16:24:28,223 INFO [IdP]
> -249011892 - Applying Attribute Release
> Policies.
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Processing the following
> attributes:
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Attribute: (urn:mace:dir:attribute-def:eduPersonEntitlement
> )
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Attribute: (PS)
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Attribute: (urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> )
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Attribute: (urn:mace:dir:attribute-def:eduPersonPrincipalName
> )
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Attribute: (urn:mace:dir:attribute-def:eduPersonTargetedID
> )
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Received a query for all
> policies applicable to principal: ([log in to unmask]).
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Attempting to load site ARP
> from: (file:/usr/local/shibboleth-idp/etc/arps/arp.site.xml).
> 2008-05-12 16:24:28,223 DEBUG [IdP]
> -249011892 - Loading XML from (null) with
> Schema validation
> 2008-05-12 16:24:28,227 DEBUG [IdP]
> -249011892 - Returning site policy.
> 2008-05-12 16:24:28,227 DEBUG [IdP]
> -249011892 - Attempting to load user ([log in to unmask]
> ) ARP from: (file:[log in to unmask]
> ).
> 2008-05-12 16:24:28,227 DEBUG [IdP]
> -249011892 - No ARP found.
> 2008-05-12 16:24:28,227 DEBUG [IdP]
> -249011892 - Creating effective ARP from
> (1) polic(y|ies).
> 2008-05-12 16:24:28,234 DEBUG [IdP]
> -249011892 - Dumping ARP:
> <AttributeReleasePolicy xmlns="urn:mace:shibboleth:arp:1.0"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="urn:mace:shibboleth:arp:1.0 shibboleth-
> arp-1.0.xsd"><Description>Simplest possible ARP.</
> Description><Rule><Target><AnyTarget></AnyTarget></Target><Attribute
> name="urn:mace:dir:attribute-def:cn"><AnyValue release="deny"></
> AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-
> def:sn"><AnyValue release="deny"></AnyValue></Attribute><Attribute
> name="urn:mace:dir:attribute-def:eduPersonTargetedID"><AnyValue
> release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation
> "><AnyValue release="permit"></AnyValue></Attribute><Attribute
> name="PS"><AnyValue release="permit"></AnyValue></Attribute></Rule></
> AttributeReleasePolicy>
> 2008-05-12 16:24:28,235 INFO [IdP]
> -249011892 - Found 5 attribute(s) for [log in to unmask]
> 2008-05-12 16:24:28,235 DEBUG [IdP]
> -249011892 - Adding defult scope of
> (swan.ac.uk) to value.
> 2008-05-12 16:24:28,235 DEBUG [IdP]
> -249011892 - Adding defult scope of
> (swan.ac.uk) to value.
> 2008-05-12 16:24:28,235 DEBUG [IdP]
> -249011892 - Adding defult scope of
> (swan.ac.uk) to value.
> 2008-05-12 16:24:28,240 DEBUG [IdP]
> -249011892 - Dumping generated SAML Response:
> <Response xmlns="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion
> " xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema
> " xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> InResponseTo="cfa7c36322851f62c145a9b24ac30687"
> IssueInstant="2008-05-12T15:24:28.235Z" MajorVersion="1"
> MinorVersion="1"
> ResponseID="_7b147b9d433d9e2af580dcba10ed79a7"><Status><StatusCode
> Value="samlp:Success"></StatusCode></Status><Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion
> " AssertionID="_1bf660d0751bc6a1391b094c366f8577"
> IssueInstant="2008-05-12T15:24:28.235Z" Issuer="urn:mace:inqueue:systems.swan.ac.uk
> " MajorVersion="1" MinorVersion="1"><Conditions
> NotBefore="2008-05-12T15:24:28.235Z"
> NotOnOrAfter
> ="2008-05-12T15:54:28.235Z"><AudienceRestrictionCondition><Audience>urn:mace:eduserv.org.uk:athens:federation:uk
> </Audience><Audience>http://ukfederation.org.uk</Audience></
> AudienceRestrictionCondition></
> Conditions><AttributeStatement><Subject><NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier
> "
> NameQualifier
> =
> "urn:mace:inqueue:systems
> .swan.ac.uk">_02ddc37e35bc13fdcbd0b209996e30f7</
> NameIdentifier><SubjectConfirmation><ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer
> </ConfirmationMethod></SubjectConfirmation></Subject><Attribute
> xmlns:typens="urn:mace:shibboleth:1.0" AttributeName="urn:mace:dir:attribute-def:eduPersonEntitlement
> " AttributeNamespace="urn:mace:shibboleth:
> 1.0:attributeNamespace:uri"><AttributeValue
> xsi:type="typens:AttributeValueType">staff</AttributeValue></
> Attribute><Attribute xmlns:typens="urn:mace:shibboleth:1.0"
> AttributeName="PS" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri
> "><AttributeValue xsi:type="typens:AttributeValueType">swa#101</
> AttributeValue></Attribute><Attribute xmlns:typens="urn:mace:shibboleth:1.0
> " AttributeName="urn:mace:dir:attribute-
> def:eduPersonScopedAffiliation" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri
> "><AttributeValue Scope="swan.ac.uk"
> xsi:type="typens:AttributeValueType">staff</AttributeValue></
> Attribute><Attribute xmlns:typens="urn:mace:shibboleth:1.0"
> AttributeName="urn:mace:dir:attribute-def:eduPersonPrincipalName"
> AttributeNamespace="urn:mace:shibboleth:
> 1.0:attributeNamespace:uri"><AttributeValue Scope="swan.ac.uk"
> xsi:type="typens:AttributeValueType">LSROBERT</AttributeValue></
> Attribute><Attribute xmlns:typens="urn:mace:shibboleth:1.0"
> AttributeName="urn:mace:dir:attribute-def:eduPersonTargetedID"
> AttributeNamespace="urn:mace:shibboleth:
> 1.0:attributeNamespace:uri"><AttributeValue Scope="swan.ac.uk"
> xsi:type="typens:AttributeValueType">q5anQznoQdJCqOGRURDe/bt9PGc=</
> AttributeValue></Attribute></AttributeStatement></Assertion></
> Response>
> 2008-05-12 16:24:28,240 INFO [IdP]
> -249011892 - Successfully created response
> for principal ([log in to unmask]).
> 2008-05-12 16:24:28,632 DEBUG [IdP]
> Core - Memory-based artifact mapper
> cleanup thread searching for stale entries.
> 2008-05-12 16:24:30,905 DEBUG [IdP]
> Core - Checking for updates to
> resource (file:/usr/local/shibboleth-idp/etc/ukfederation-
> metadata.xml)
> 2008-05-12 16:24:33,297 DEBUG [IdP]
> Core - Resolver Cache cleanup thread
> searching cache for stale entries.
> 2008-05-12 16:24:33,376 DEBUG [IdP]
> Core - Memory cache handle cache
> cleanup thread searching for stale entries.
> 2008-05-12 16:25:28,643 DEBUG [IdP]
> Core - Memory-based artifact mapper
> cleanup thread searching for stale entries.
> 2008-05-12 16:25:30,916 DEBUG [IdP]
> Core - Checking for updates to
> resource (file:/usr/local/shibboleth-idp/etc/ukfederation-
> metadata.xml)
> 2008-05-12 16:25:33,308 DEBUG [IdP]
> Core - Resolver Cache cleanup thread
> searching cache for stale entries.
> 2008-05-12 16:25:33,388 DEBUG [IdP]
> Core - Memory cache handle cache
> cleanup thread searching for stale entries.
> 2008-05-12 16:26:28,656 DEBUG [IdP]
> Core - Memory-based artifact mapper
> cleanup thread searching for stale entries.
> 2008-05-12 16:26:30,928 DEBUG [IdP]
> Core - Checking for updates to
> resource (file:/usr/local/shibboleth-idp/etc/ukfederation-
> metadata.xml)
> 2008-05-12 16:26:33,320 DEBUG [IdP]
> Core - Resolver Cache cleanup thread
> searching cache for stale entries.
> 2008-05-12 16:26:33,399 DEBUG [IdP]
> Core - Memory cache handle cache
> cleanup thread searching for stale entries.
> 2008-05-12 16:27:28,667 DEBUG [IdP]
> Core - Memory-based artifact mapper
> cleanup thread searching for stale entries.
> 2008-05-12 16:27:30,939 DEBUG [IdP]
> Core - Checking for updates to
> resource (file:/usr/local/shibboleth-idp/etc/ukfederation-
> metadata.xml)
> 2008-05-12 16:27:33,331 DEBUG [IdP]
> Core - Resolver Cache cleanup thread
> searching cache for stale entries.
> 2008-05-12 16:27:33,411 DEBUG [IdP]
> Core - Memory cache handle cache
> cleanup thread searching for stale entries.
>
>
>
>
> Science Direct SP
> ******************************************
> 2008-05-12 16:27:54,255 DEBUG [IdP]
> -1118152515 - Received a request via GET for
> location (https://ccs-shibboleth1.systems.swan.ac.uk/shibboleth-idp/SSO
> ).
> 2008-05-12 16:27:54,256 DEBUG [IdP]
> -1118152515 - Matched handler location:
> (https?://[^:/]+(:(443|80))?/shibboleth-idp/SSO).
> 2008-05-12 16:27:54,256 INFO [IdP]
> -1118152515 - Processing Shibboleth v1.x SSO
> request.
> 2008-05-12 16:27:54,256 DEBUG [IdP]
> -1118152515 - Remote provider has identified
> itself as: (https://sdauth.sciencedirect.com/).
> 2008-05-12 16:27:54,256 INFO [IdP]
> -1118152515 - Found matching Relying Party
> for group (http://ukfederation.org.uk).
> 2008-05-12 16:27:54,256 INFO [IdP]
> -1118152515 - Provider is a member of
> Relying Party (http://ukfederation.org.uk).
> 2008-05-12 16:27:54,256 INFO [IdP]
> -1118152515 - Supplied consumer URL
> validated for this provider.
> 2008-05-12 16:27:54,256 DEBUG [IdP]
> -1118152515 - Found a supported name
> identifier format that matches the metadata for the relying party: (urn:mace:shibboleth:1.0:nameIdentifier
> ).
> 2008-05-12 16:27:54,256 DEBUG [IdP]
> -1118152515 - Assigning handle
> (_b3fcf671c94f219746f4fe305cce9d05) to principal ([log in to unmask]
> ).
> 2008-05-12 16:27:54,256 DEBUG [IdP]
> -1118152515 - User was authenticated via the
> default method for this relying party (urn:oasis:names:tc:SAML:1.0:am:unspecified
> ).
> 2008-05-12 16:27:54,256 DEBUG [IdP]
> -1118152515 - Responding with POST profile.
> 2008-05-12 16:27:54,257 DEBUG [IdP]
> -1118152515 - Dumping generated AuthN
> Assertion:
> <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion
> " xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema
> " xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> AssertionID="_8eb77f95f7ab09776b637f22622114aa"
> IssueInstant="2008-05-12T15:27:54.257Z" Issuer="urn:mace:inqueue:systems.swan.ac.uk
> " MajorVersion="1" MinorVersion="1"><Conditions
> NotBefore="2008-05-12T15:27:54.257Z"
> NotOnOrAfter
> ="2008-05-12T15:32:54.257Z"><AudienceRestrictionCondition><Audience>https://sdauth.sciencedirect.com/
> </Audience><Audience>http://ukfederation.org.uk</Audience></
> AudienceRestrictionCondition></Conditions><AuthenticationStatement
> AuthenticationInstant="2008-05-12T15:27:54.256Z"
> AuthenticationMethod="urn:oasis:names:tc:SAML:
> 1.0:am:unspecified"><Subject><NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier
> "
> NameQualifier
> =
> "urn:mace:inqueue:systems
> .swan.ac.uk">_b3fcf671c94f219746f4fe305cce9d05</
> NameIdentifier><SubjectConfirmation><ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer
> </ConfirmationMethod></SubjectConfirmation></
> Subject><SubjectLocality IPAddress="137.44.18.132"></
> SubjectLocality></AuthenticationStatement></Assertion>
> 2008-05-12 16:27:54,268 DEBUG [IdP]
> -1118152515 - Dumping generated SAML Response:
> <Response xmlns="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion
> " xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema
> " xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> IssueInstant="2008-05-12T15:27:54.257Z" MajorVersion="1"
> MinorVersion="1" Recipient="https://sdauth.sciencedirect.com/SHIRE"
> ResponseID="_9c2636f847e4f8903392dd7e7189a695"><ds:Signature
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo>
> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#
> "></ds:CanonicalizationMethod>
> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1
> "></ds:SignatureMethod>
> <ds:Reference URI="#_9c2636f847e4f8903392dd7e7189a695">
> <ds:Transforms>
> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature
> "></ds:Transform>
> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-
> c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#
> " PrefixList="code ds kind rw saml samlp typens #default xsd xsi"></
> ec:InclusiveNamespaces></ds:Transform>
> </ds:Transforms>
> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/
> xmldsig#sha1"></ds:DigestMethod>
> <ds:DigestValue>qcBufyc4nnbLDF9sXDnmHmVfmgM=</ds:DigestValue>
> </ds:Reference>
> </ds:SignedInfo>
> <ds:SignatureValue>
> SWXMF/9n+TI8i/1F7gOZts89kf2AXZPw8KBRHfAtRDHURGgCQ8gDXjWm1AxqcgCX
> +YbhXCcK7yYM
> 8U3TByNxeTAdqd8k+sQZSIVYkyjMK2t7UCuS6ovx
> +DUsqgjcXj7hPSGdI8QaHGIcsBr2k8mCY5Y8
> aCzeP0YGbgqSJ/zvcDU=
> </ds:SignatureValue>
> <ds:KeyInfo>
> <ds:X509Data>
> <ds:X509Certificate>
> MIIEGTCCAwGgAwIBAgILAQAAAAABE7uS4awwDQYJKoZIhvcNAQEFBQAwXzELMAkGA1UEBhMCQkUx
> EzARBgNVBAoTCkN5YmVydHJ1c3QxFzAVBgNVBAsTDkVkdWNhdGlvbmFsIENBMSIwIAYDVQQDExlD
> eWJlcnRydXN0IEVkdWNhdGlvbmFsIENBMB4XDTA3MDcxMjE3NTYxMVoXDTA4MDcxMjE3NTYxMVow
> gcQxCzAJBgNVBAYTAkdCMRcwFQYDVQQIEw5XZXN0IEdsYW1vcmdhbjEQMA4GA1UEBxMHU3dhbnNl
> YTElMCMGA1UEChMcVW5pdmVyc2l0eSBvZiBXYWxlcywgU3dhbnNlYTEMMAoGA1UECxMDTElTMSsw
> KQYDVQQDEyJjY3Mtc2hpYmJvbGV0aDEuc3lzdGVtcy5zd2FuLmFjLnVrMSgwJgYJKoZIhvcNAQkB
> FhlhLmwucm9iZXJ0c0Bzd2Fuc2VhLmFjLnVrMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDH
> o3KMw1GQ/5phHH4OwTZEJC85fctbB7V53Xqg/hHLnfVqyUJ+elOVod/
> 4cS5hvArirTG7OEtsjkhJ
> efhDRi8O3CJX2/VVma2puuS6srnxPFCXbSm9aIl
> +gSWzDSqnHwJHdCbKAy1QcGxt8o2Z5Do/mG4t
> Q5mViH3CvocmuuoLVQIDAQABo4HzMIHwMA4GA1UdDwEB/
> wQEAwIFoDAfBgNVHSMEGDAWgBRlZaM9
> 1zsRowoHJTfJQkpbdndQ4TAdBgNVHQ4EFgQUdfBFTNy0UvwnPtO0n8GosBOAvq8wOgYDVR0fBDMw
> MTAvoC2gK4YpaHR0cDovL2NybC5nbG9iYWxzaWduLm5ldC9lZHVjYXRpb25hbC5jcmwwTwYIKwYB
> BQUHAQEEQzBBMD8GCCsGAQUFBzAChjNodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24ubmV0L2NhY2Vy
> dC9lZHVjYXRpb25hbC5jcnQwEQYJYIZIAYb4QgEBBAQDAgbAMA0GCSqGSIb3DQEBBQUAA4IBAQCM
> QCyVRiHVzptLnFWssYMzhrEnJEf8Z7/
> LW8rTsl5cR6nUvB33asXb5HuSSP9EhCngaf0w2w3EI38U
> g4J
> +
> ot5iBA4tQ17TH0sCEmDq7LDAWHXkqhxJSwjW6K2WQrc0JHPwt29nEPgN5Dmw0h8OEOK7PpCO
> +7J0E1jQDz0NtzPPKxvq/zCO4ieIU9iLiLIRwMN/
> wXVSYemCtvS2FDvIE40FW8t4sVuGQd/fg0E+
> AFHVvhlX4gh0dDhQNx6WP/i/1kbnjVawnM+2ZlDqxEY/
> coBmVKA6PvvVnBzEIgpN2VuXkE5sSZGj
> xdy1wGH4A2yseB4eWaxOK5lNcTVYbXenlSsb
> </ds:X509Certificate>
> </ds:X509Data>
> </ds:KeyInfo></ds:Signature><Status><StatusCode
> Value="samlp:Success"></StatusCode></Status><Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion
> " AssertionID="_8eb77f95f7ab09776b637f22622114aa"
> IssueInstant="2008-05-12T15:27:54.257Z" Issuer="urn:mace:inqueue:systems.swan.ac.uk
> " MajorVersion="1" MinorVersion="1"><Conditions
> NotBefore="2008-05-12T15:27:54.257Z"
> NotOnOrAfter
> ="2008-05-12T15:32:54.257Z"><AudienceRestrictionCondition><Audience>https://sdauth.sciencedirect.com/
> </Audience><Audience>http://ukfederation.org.uk</Audience></
> AudienceRestrictionCondition></Conditions><AuthenticationStatement
> AuthenticationInstant="2008-05-12T15:27:54.256Z"
> AuthenticationMethod="urn:oasis:names:tc:SAML:
> 1.0:am:unspecified"><Subject><NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier
> "
> NameQualifier
> =
> "urn:mace:inqueue:systems
> .swan.ac.uk">_b3fcf671c94f219746f4fe305cce9d05</
> NameIdentifier><SubjectConfirmation><ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer
> </ConfirmationMethod></SubjectConfirmation></
> Subject><SubjectLocality IPAddress="137.44.18.132"></
> SubjectLocality></AuthenticationStatement></Assertion></Response>
> 2008-05-12 16:27:56,511 DEBUG [IdP]
> -2137456726 - Received a request via GET for
> location (https://ccs-shibboleth1.systems.swan.ac.uk/shibboleth-idp/SSO
> ).
> 2008-05-12 16:27:56,511 DEBUG [IdP]
> -2137456726 - Matched handler location:
> (https?://[^:/]+(:(443|80))?/shibboleth-idp/SSO).
> 2008-05-12 16:27:56,511 INFO [IdP]
> -2137456726 - Processing Shibboleth v1.x SSO
> request.
> 2008-05-12 16:27:56,511 DEBUG [IdP]
> -2137456726 - Remote provider has identified
> itself as: (https://sdauth.sciencedirect.com/).
> 2008-05-12 16:27:56,511 INFO [IdP]
> -2137456726 - Found matching Relying Party
> for group (http://ukfederation.org.uk).
> 2008-05-12 16:27:56,512 INFO [IdP]
> -2137456726 - Provider is a member of
> Relying Party (http://ukfederation.org.uk).
> 2008-05-12 16:27:56,512 INFO [IdP]
> -2137456726 - Supplied consumer URL
> validated for this provider.
> 2008-05-12 16:27:56,512 DEBUG [IdP]
> -2137456726 - Found a supported name
> identifier format that matches the metadata for the relying party: (urn:mace:shibboleth:1.0:nameIdentifier
> ).
> 2008-05-12 16:27:56,512 DEBUG [IdP]
> -2137456726 - Assigning handle
> (_a790d1ff5277621d9c58548a1a6aa990) to principal ([log in to unmask]
> ).
> 2008-05-12 16:27:56,512 DEBUG [IdP]
> -2137456726 - User was authenticated via the
> default method for this relying party (urn:oasis:names:tc:SAML:1.0:am:unspecified
> ).
> 2008-05-12 16:27:56,512 DEBUG [IdP]
> -2137456726 - Responding with POST profile.
> 2008-05-12 16:27:56,512 DEBUG [IdP]
> -2137456726 - Dumping generated AuthN
> Assertion:
> <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion
> " xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema
> " xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> AssertionID="_8d267fdf9a2cc45e69d1d99ae6226082"
> IssueInstant="2008-05-12T15:27:56.512Z" Issuer="urn:mace:inqueue:systems.swan.ac.uk
> " MajorVersion="1" MinorVersion="1"><Conditions
> NotBefore="2008-05-12T15:27:56.512Z"
> NotOnOrAfter
> ="2008-05-12T15:32:56.512Z"><AudienceRestrictionCondition><Audience>https://sdauth.sciencedirect.com/
> </Audience><Audience>http://ukfederation.org.uk</Audience></
> AudienceRestrictionCondition></Conditions><AuthenticationStatement
> AuthenticationInstant="2008-05-12T15:27:56.512Z"
> AuthenticationMethod="urn:oasis:names:tc:SAML:
> 1.0:am:unspecified"><Subject><NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier
> "
> NameQualifier
> =
> "urn:mace:inqueue:systems
> .swan.ac.uk">_a790d1ff5277621d9c58548a1a6aa990</
> NameIdentifier><SubjectConfirmation><ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer
> </ConfirmationMethod></SubjectConfirmation></
> Subject><SubjectLocality IPAddress="137.44.18.132"></
> SubjectLocality></AuthenticationStatement></Assertion>
> 2008-05-12 16:27:56,524 DEBUG [IdP]
> -2137456726 - Dumping generated SAML Response:
> <Response xmlns="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion
> " xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema
> " xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> IssueInstant="2008-05-12T15:27:56.513Z" MajorVersion="1"
> MinorVersion="1" Recipient="https://sdauth.sciencedirect.com/SHIRE"
> ResponseID="_bc7adf50c76d5c64a8d4065c06230bea"><ds:Signature
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
> <ds:SignedInfo>
> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#
> "></ds:CanonicalizationMethod>
> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1
> "></ds:SignatureMethod>
> <ds:Reference URI="#_bc7adf50c76d5c64a8d4065c06230bea">
> <ds:Transforms>
> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature
> "></ds:Transform>
> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-
> c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#
> " PrefixList="code ds kind rw saml samlp typens #default xsd xsi"></
> ec:InclusiveNamespaces></ds:Transform>
> </ds:Transforms>
> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/
> xmldsig#sha1"></ds:DigestMethod>
> <ds:DigestValue>+p7FzmYGAMEhtjKy91HCW+G2iMI=</ds:DigestValue>
> </ds:Reference>
> </ds:SignedInfo>
> <ds:SignatureValue>
> McK3fBbRphZjC14fFdyHhJnCuyxY4z4VcOy+FMdl9UYguNW5RbAJspxumrLLB
> +mAAd8OlUv06HlO
> Bbl+J7ru
> +Wo0aeZkpOEYVWCgIgeXc1v3Bv0ymyuIm47Pj65K8DKVlg9jzH04bSUr9zGzt5I0+nIr
> LyKGgev1pG+B0HDgj7E=
> </ds:SignatureValue>
> <ds:KeyInfo>
> <ds:X509Data>
> <ds:X509Certificate>
> MIIEGTCCAwGgAwIBAgILAQAAAAABE7uS4awwDQYJKoZIhvcNAQEFBQAwXzELMAkGA1UEBhMCQkUx
> EzARBgNVBAoTCkN5YmVydHJ1c3QxFzAVBgNVBAsTDkVkdWNhdGlvbmFsIENBMSIwIAYDVQQDExlD
> eWJlcnRydXN0IEVkdWNhdGlvbmFsIENBMB4XDTA3MDcxMjE3NTYxMVoXDTA4MDcxMjE3NTYxMVow
> gcQxCzAJBgNVBAYTAkdCMRcwFQYDVQQIEw5XZXN0IEdsYW1vcmdhbjEQMA4GA1UEBxMHU3dhbnNl
> YTElMCMGA1UEChMcVW5pdmVyc2l0eSBvZiBXYWxlcywgU3dhbnNlYTEMMAoGA1UECxMDTElTMSsw
> KQYDVQQDEyJjY3Mtc2hpYmJvbGV0aDEuc3lzdGVtcy5zd2FuLmFjLnVrMSgwJgYJKoZIhvcNAQkB
> FhlhLmwucm9iZXJ0c0Bzd2Fuc2VhLmFjLnVrMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDH
> o3KMw1GQ/5phHH4OwTZEJC85fctbB7V53Xqg/hHLnfVqyUJ+elOVod/
> 4cS5hvArirTG7OEtsjkhJ
> efhDRi8O3CJX2/VVma2puuS6srnxPFCXbSm9aIl
> +gSWzDSqnHwJHdCbKAy1QcGxt8o2Z5Do/mG4t
> Q5mViH3CvocmuuoLVQIDAQABo4HzMIHwMA4GA1UdDwEB/
> wQEAwIFoDAfBgNVHSMEGDAWgBRlZaM9
> 1zsRowoHJTfJQkpbdndQ4TAdBgNVHQ4EFgQUdfBFTNy0UvwnPtO0n8GosBOAvq8wOgYDVR0fBDMw
> MTAvoC2gK4YpaHR0cDovL2NybC5nbG9iYWxzaWduLm5ldC9lZHVjYXRpb25hbC5jcmwwTwYIKwYB
> BQUHAQEEQzBBMD8GCCsGAQUFBzAChjNodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24ubmV0L2NhY2Vy
> dC9lZHVjYXRpb25hbC5jcnQwEQYJYIZIAYb4QgEBBAQDAgbAMA0GCSqGSIb3DQEBBQUAA4IBAQCM
> QCyVRiHVzptLnFWssYMzhrEnJEf8Z7/
> LW8rTsl5cR6nUvB33asXb5HuSSP9EhCngaf0w2w3EI38U
> g4J
> +
> ot5iBA4tQ17TH0sCEmDq7LDAWHXkqhxJSwjW6K2WQrc0JHPwt29nEPgN5Dmw0h8OEOK7PpCO
> +7J0E1jQDz0NtzPPKxvq/zCO4ieIU9iLiLIRwMN/
> wXVSYemCtvS2FDvIE40FW8t4sVuGQd/fg0E+
> AFHVvhlX4gh0dDhQNx6WP/i/1kbnjVawnM+2ZlDqxEY/
> coBmVKA6PvvVnBzEIgpN2VuXkE5sSZGj
> xdy1wGH4A2yseB4eWaxOK5lNcTVYbXenlSsb
> </ds:X509Certificate>
> </ds:X509Data>
> </ds:KeyInfo></ds:Signature><Status><StatusCode
> Value="samlp:Success"></StatusCode></Status><Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion
> " AssertionID="_8d267fdf9a2cc45e69d1d99ae6226082"
> IssueInstant="2008-05-12T15:27:56.512Z" Issuer="urn:mace:inqueue:systems.swan.ac.uk
> " MajorVersion="1" MinorVersion="1"><Conditions
> NotBefore="2008-05-12T15:27:56.512Z"
> NotOnOrAfter
> ="2008-05-12T15:32:56.512Z"><AudienceRestrictionCondition><Audience>https://sdauth.sciencedirect.com/
> </Audience><Audience>http://ukfederation.org.uk</Audience></
> AudienceRestrictionCondition></Conditions><AuthenticationStatement
> AuthenticationInstant="2008-05-12T15:27:56.512Z"
> AuthenticationMethod="urn:oasis:names:tc:SAML:
> 1.0:am:unspecified"><Subject><NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier
> "
> NameQualifier
> =
> "urn:mace:inqueue:systems
> .swan.ac.uk">_a790d1ff5277621d9c58548a1a6aa990</
> NameIdentifier><SubjectConfirmation><ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer
> </ConfirmationMethod></SubjectConfirmation></
> Subject><SubjectLocality IPAddress="137.44.18.132"></
> SubjectLocality></AuthenticationStatement></Assertion></Response>
> 2008-05-12 16:28:28,678 DEBUG [IdP]
> Core - Memory-based artifact mapper
> cleanup thread searching for stale entries.2008-05-12 16:28:30,950
> DEBUG [IdP] Core - Checking for
> updates to resource (file:/usr/local/shibboleth-idp/etc/ukfederation-
> metadata.xml)
> 2008-05-12 16:28:33,343 DEBUG [IdP]
> Core - Resolver Cache cleanup thread
> searching cache for stale entries.
>
>
> Regards
> AL
>
> Mr. Alexander Roberts
> Web Development Officer
> Library and Information Services
> Swansea University/Prifysgol Abertawe
> +44 (0)1792 513239
>
--------------
mov eax,1
mov ebx,0
int 80h
|
