All geek questions in one place

Web Login Service - Denied Access (Shibboleth IdP 3)

I configured Shibboleth IdP 3 for authentication against LDAP (AD).

When I access the following URL

https: // FDQN-of-the-IdP / idp / status

I see the next page. enter image description here

IdP Logs

2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2015-11-24 10:39:43,394 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:108] - Message Handler:  No metadata returned for http://google.com/enterprise/gsa/xxxx in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer http://google.com/enterprise/gsa/xxxxx
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:284] - Resolving relying party configuration
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:290] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for request
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'IDP'
2015-11-24 10:39:43,394 - DEBUG [net.shibboleth.idp.profile.audit.impl.PopulateAuditContext:220] - Profile Action PopulateAuditContext: Adding 1 value for field 'SP'
2015-11-24 10:39:43,394 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for relying party configuration shibboleth.UnverifiedRelyingParty
2015-11-24 10:43:17,231 - INFO [net.shibboleth.utilities.java.support.security.BasicKeystoreKeyStrategy:327] - Default key version has not changed, still secret1

Why can't I access the status page?

+4
source share
1 answer

Make sure you have configured config \ access-control.xml correctly. IP-based default access control:   

    <entry key="AccessByIPAddress">
        <bean parent="shibboleth.IPRangeAccessControl"
            p:allowedRanges="#{ {'127.0.0.1/32', '192.0.0.0/32','::1/128', '192.168.120.148/32'} }" />
    </entry>

make sure you allow the IP address access to the IDP, it must also be in CIDR format

+3
source

Source: https://habr.com/ru/post/1617150/

More articles:


All Articles