Shibboleth login error

Yugandhar Veeramachaneni

unread,

Mar 27, 2016, 12:47:36 PM3/27/16

to Open edX operations

Hello all,

I tried integrating Shibboleth with my test instance. Once I supply my username and password, SSO is redirecting me to my test instance. However, post redirection to my instance, it's giving me this error - "Authentication failed: SAML login failed: ['invalid_response'] (There is no AttributeStatement on the Response)".

I followed the guide to enabling third party auth. Can you please point me to what I might be missing? I'll be happy to supply you with any additional information that you will require.

Thank you.

Braden MacDonald

unread,

Mar 27, 2016, 7:00:35 PM3/27/16

to opene...@googlegroups.com

Hi,

First, have you tried using TestShib? I would recommend starting with TestShib as an IdP since it is known to work. Once TestShib is working, then you can try another provider.

The error you're seeing is fairly common and can be a bit tricky to diagnose.

One reason it occurs is that your IdP may not like the Authn context parameter that edx-platform uses by default. You can try going to the edx SAML configuration, find the "other config str" section, and add

"SECURITY_CONFIG": { "requestedAuthnContext": false }

If that doesn't work, you may need to find a way to capture the SAML XML response being sent by the IdP in order to debug this.

Hope this helps,

--

Braden

@OpenCraft

--
You received this message because you are subscribed to the Google Groups "Open edX operations" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openedx-ops...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/openedx-ops/316faedf-f964-4c89-856b-7366d57cf245%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Yugandhar Veeramachaneni

unread,

Apr 14, 2016, 11:04:02 AM4/14/16

to Open edX operations

Hello Braden,

I have tried it with TestShib and it worked.

When I try to do it with my university (a member of InCommon, if that would help), I'm getting the error - "Authentication failed: SAML login failed: ['invalid_response'] (There is no AttributeStatement on the Response)".

Here is a log of SAML request and SAML Response.

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"

ID="ONELOGIN_94429aa544828cd7662d91aa2f5ce9d0d851b393"

Version="2.0"

ProviderName="Indiana University"

IssueInstant="2016-04-14T15:00:32Z"

Destination="https://idp.iu.edu/shibboleth-idp/profile/SAML2/Redirect/SSO"

ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

AssertionConsumerServiceURL="http://shibb-dev.gbps.link/auth/complete/tpa-saml/"

>

<saml:Issuer>http://shibb.gbps.link</saml:Issuer>

<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"

AllowCreate="true"

/>

</samlp:AuthnRequest>

SAML Response:

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"

Destination="http://shibb-dev.gbps.link/auth/complete/tpa-saml/"

ID="_7aee71f425edeb4bcf107cd35409978e"

InResponseTo="ONELOGIN_94429aa544828cd7662d91aa2f5ce9d0d851b393"

IssueInstant="2016-04-14T15:00:33.530Z"

Version="2.0"

>

<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"

Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"

>urn:mace:incommon:iu.edu</saml2:Issuer>

<saml2p:Status>

<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />

</saml2p:Status>

<saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"

ID="_62aeedb0edf1dc9da73b228eebce0e80"

IssueInstant="2016-04-14T15:00:33.530Z"

Version="2.0"

>

<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:incommon:iu.edu</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo>

<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />

<ds:Reference URI="#_62aeedb0edf1dc9da73b228eebce0e80">

<ds:Transforms>

<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />

<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

</ds:Transforms>

<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />

<ds:DigestValue>/PB0VglLFjJTNGZVoWTqvsnRT8Y=</ds:DigestValue>

</ds:Reference>

</ds:SignedInfo>

<ds:SignatureValue>R+KBF2W6JbFJThMWUfOid+06UarhMzXf929HFJGOBwfpSLtlYtznDukc4jWMFYgpjkfq9sBf9i4ch6qXJ9kqzhXXdASDfjyhnC+QyY0zSBSelATE1Zu8upA/sp1uMaKcNg74ygT6wFAzoQaCyrbMMuv54RQPGS80ho0y9KWet/jDsLEhTHu0y0Kytqxcvus+Asq5zbkfhnPOSM8KAMOmyCjAfOOWvG6BxijvwX8vQKoecIs5fcHBaaoXEK04X3b7YgF7r6PzTHRDxXyA2FAZ/oNKRKiqRwIjEAjYisvDNrfOku40FV8Hc19kdHANeI73CvzHjnj8g7EaifeefeNiTw==</ds:SignatureValue>

<ds:KeyInfo>

<ds:X509Data>

<ds:X509Certificate>MIIEnjCCA4agAwIBAgIJALK5W6TnLzRkMA0GCSqGSIb3DQEBBQUAMIGQMQswCQYDVQQGEwJVUzEQ

MA4GA1UECBMHSW5kaWFuYTEUMBIGA1UEBxMLQmxvb21pbmd0b24xGzAZBgNVBAoTEkluZGlhbmEg

VW5pdmVyc2l0eTEnMCUGA1UECxMeVW5pdmVyc2l0eSBJbmZvcm1hdGlvbiBTeXN0ZW1zMRMwEQYD

VQQDEwppZHAuaXUuZWR1MB4XDTEyMDMwMjIxMDcyOFoXDTIyMDIyODIxMDcyOFowgZAxCzAJBgNV

BAYTAlVTMRAwDgYDVQQIEwdJbmRpYW5hMRQwEgYDVQQHEwtCbG9vbWluZ3RvbjEbMBkGA1UEChMS

SW5kaWFuYSBVbml2ZXJzaXR5MScwJQYDVQQLEx5Vbml2ZXJzaXR5IEluZm9ybWF0aW9uIFN5c3Rl

bXMxEzARBgNVBAMTCmlkcC5pdS5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDX

kJME1MEXwJMofzOWFq9Ax60yBxoDSbsuGUwsG8X4eXSXCGWuNjxTsUR3if71wnVuWA5j3O12MJat

PN40UlJUVpGI+yyTf+39Xq0ILjnCEpXvbx8BeteNC5rpDDZMQpbisST/wToHqxSbEwl05pIvmE9E

YitcO9c8VeEGd8jSSPnqMlxEqEBzG0aVFofoFk2eZvxPqNVeDD4fuy74oWYHG9JAEIVO60R7xqjC

hOcLfi0UnkuIyXK9j7objwuScFdzawUFwj8bqr0wYcQ89BMMAwPXqgqfckm216LnEy0xDQjWG7wW

w24mMFp3//V7V9uTQe/x47Lp3Zo4+OGjn0clAgMBAAGjgfgwgfUwHQYDVR0OBBYEFEPHwCKjNTNK

AJ3eUPP+clZUi45QMIHFBgNVHSMEgb0wgbqAFEPHwCKjNTNKAJ3eUPP+clZUi45QoYGWpIGTMIGQ

MQswCQYDVQQGEwJVUzEQMA4GA1UECBMHSW5kaWFuYTEUMBIGA1UEBxMLQmxvb21pbmd0b24xGzAZ

BgNVBAoTEkluZGlhbmEgVW5pdmVyc2l0eTEnMCUGA1UECxMeVW5pdmVyc2l0eSBJbmZvcm1hdGlv

biBTeXN0ZW1zMRMwEQYDVQQDEwppZHAuaXUuZWR1ggkAsrlbpOcvNGQwDAYDVR0TBAUwAwEB/zAN

BgkqhkiG9w0BAQUFAAOCAQEAFzO4fQSwWsuH7KT4NoXJ2StDarj5wkOX9uPWrrQtC9HqNBzxUu/F

b/gHe5Ethp3fuLrUCLsJP8yth/c5ifUgsIvYbvevMbxJvwa1DKoFxyy1Y7Z2WiQMPr5Dw65FDhiS

2k0srCw0Qv9G2oTq7i9EzrhdsCDtm9ywkVui4cklfF9p7VWBrd4zmIOhtltgrn5bQKkvd/C6IuDE

RcGUVm3H4bMVX0R310+623kBaTLsajy5DWB1nPufiuuDMvC4u5V5MFLuih4WNcHQDvlLKDYmTwwz

MuMUT66RYRu3TZsDL2LuGuOyTnT5YZXTUl4ADM7Oqe2rOQeUdCTNomTlqhpZlA==</ds:X509Certificate>

</ds:X509Data>

</ds:KeyInfo>

</ds:Signature>

<saml2:Subject>

<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"

NameQualifier="urn:mace:incommon:iu.edu"

SPNameQualifier="http://shibb.gbps.link"

>_47a7206802d6650e80fc4d45b3684fff</saml2:NameID>

<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">

<saml2:SubjectConfirmationData Address="167.88.123.224"

InResponseTo="ONELOGIN_94429aa544828cd7662d91aa2f5ce9d0d851b393"

NotOnOrAfter="2016-04-14T15:05:33.530Z"

Recipient="http://shibb-dev.gbps.link/auth/complete/tpa-saml/"

/>

</saml2:SubjectConfirmation>

</saml2:Subject>

<saml2:Conditions NotBefore="2016-04-14T15:00:33.530Z"

NotOnOrAfter="2016-04-14T15:05:33.530Z"

>

<saml2:AudienceRestriction>

<saml2:Audience>http://shibb.gbps.link</saml2:Audience>

</saml2:AudienceRestriction>

</saml2:Conditions>

<saml2:AuthnStatement AuthnInstant="2016-04-14T14:37:01.327Z"

SessionIndex="_7991c7c8545ae54035880aaf0681a85d"

>

<saml2:SubjectLocality Address="167.88.123.224" />

<saml2:AuthnContext>

<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>

</saml2:AuthnContext>

</saml2:AuthnStatement>

</saml2:Assertion>

</saml2p:Response>

Thanks for your help!

Yugandhar

Braden MacDonald

unread,

Apr 19, 2016, 12:15:17 AM4/19/16

to opene...@googlegroups.com

Hmm, I can see from the response that, as it says, the response is missing an AttributeStatement.

The response should contain a <saml2:AttributeStatement> tag, as a sibling of the <saml2:AuthnStatement> tag. However, it does not seem to be present.

Did you change the requestedAuthnContext setting as I mentioned in my last email? That change has resolved this issue for some SAML providers in the past. If you've already tried it, I think you should check the log files for your Shibboleth provider - this seems to be a problem with your provider not being configured to send SAML attributes for this type of login request.

--

Braden

@OpenCraft

To view this discussion on the web visit https://groups.google.com/d/msgid/openedx-ops/7ecd7ca9-f6d2-42f7-b70e-ac2b0b53f71a%40googlegroups.com.

Yugandhar Veeramachaneni

unread,

Apr 19, 2016, 7:02:22 AM4/19/16

to opene...@googlegroups.com

Hi Braden,

Thank you for the response. I did make the change to requestedAuthnContext as suggested. It didn't fix this. I initiated a support ticket with the provider. I'll update here after I find a fix for this.

Best,

Yugandhar Veeramachaneni

--
You received this message because you are subscribed to a topic in the Google Groups "Open edX operations" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/openedx-ops/d-rmACND180/unsubscribe.
To unsubscribe from this group and all its topics, send an email to openedx-ops...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/openedx-ops/CAEyJbEbJxc65DEjmKJHEdNU8R7NQaA_6-SY4dz35LJO30TtXng%40mail.gmail.com.

Yugandhar Veeramachaneni

unread,

Apr 28, 2016, 1:47:50 PM4/28/16

to Open edX operations

Hello Braden,

I got the IdP team to fix the response on their end. Now post authentication, I get a 500 Internal Server Error on the Open edX site.

This is the log I see -

[service_variant=lms][django.request][env:sandbox] ERROR [ip-172-31-52-15 27871] [base.py:213] - Internal Server Error: /auth/complete/tpa-saml/

Traceback (most recent call last):

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/core/handlers/base.py", line 109, in get_response

response = callback(request, *callback_args, **callback_kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/views/decorators/cache.py", line 89, in _wrapped_view_func

response = view_func(request, *args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/views/decorators/csrf.py", line 77, in wrapped_view

return view_func(*args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/apps/django_app/utils.py", line 51, in wrapper

return func(request, backend, *args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/apps/django_app/views.py", line 28, in complete

redirect_name=REDIRECT_FIELD_NAME, *args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/actions.py", line 43, in do_complete

user = backend.complete(user=user, *args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/backends/base.py", line 41, in complete

return self.auth_complete(*args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/backends/saml.py", line 310, in auth_complete

return self.strategy.authenticate(*args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/strategies/django_strategy.py", line 96, in authenticate

return authenticate(*args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/django/contrib/auth/__init__.py", line 45, in authenticate

user = backend.authenticate(**credentials)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/backends/base.py", line 82, in authenticate

return self.pipeline(pipeline, *args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/backends/base.py", line 85, in pipeline

out = self.run_pipeline(pipeline, pipeline_index, *args, **kwargs)

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/backends/base.py", line 112, in run_pipeline

result = func(*args, **out) or {}

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/pipeline/social_auth.py", line 10, in social_uid

return {'uid': backend.get_user_id(details, response)}

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/backends/saml.py", line 282, in get_user_id

uid = idp.get_user_permanent_id(response['attributes'])

File "/edx/app/edxapp/venvs/edxapp/local/lib/python2.7/site-packages/social/backends/saml.py", line 46, in get_user_permanent_id

self.conf.get('attr_user_permanent_id', OID_USERID)

KeyError: 'urn:oid:0.9.2342.19200300.100.1.1'

Any idea how to fix this?

Thanks,

Yugandhar

Braden MacDonald

unread,

Apr 28, 2016, 1:54:07 PM4/28/16

to opene...@googlegroups.com

Yep, that error means that edX is looking for the 'uid' attribute, but the Shibboleth server is not providing that attribute. You will either need to change the Shibboleth IdP configuration to provide that attribute, or go to the edX Shibboleth provider configuration at /admin/third_party_auth/samlproviderconfig/ and find the "User ID Attribute" field, and enter the OID URN of some other attribute that edX can use to uniquely identify the user. edX requires that your Shibboleth provider assert some kind of unique identifier for each user.

--

Braden

@OpenCraft

--
You received this message because you are subscribed to the Google Groups "Open edX operations" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openedx-ops...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/openedx-ops/947441da-3040-4382-a776-a4830bcf79c4%40googlegroups.com.

Reply all

Reply to author

Forward