RE: SourceID.Net - SqlFederationhandler.

Hi David,

Thanks very much for your reply David. I'm able to understand the
process. I still have some doubts, but before that, regarding logout
error. Yes I always face this problem while logging out.=20
Given below is the stacktrace for your reference.

Server Error in '/idp-sample' Application.
------------------------------------------------------------------------
--------

Logout request received for a NameIdentifier which does not match the
current user session=20
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information
about the error and where it originated in the code.=20

Exception Details: System.ArgumentException: Logout request received for
a NameIdentifier which does not match the current user session

Source Error:=20


Line 412:            if (uid !=3D sess[Constants.Session.UserId])
Line 413:            {
Line 414:                throw new ArgumentException(
Line 415:                    "Logout request received for a
NameIdentifier which " +=20
Line 416:                    "does not match the current user session");
=20

Source File: d:\sourceid.net-0.3new\sourceid\httphandlers\logout.cs
Line: 414=20

Stack Trace:=20


[ArgumentException: Logout request received for a NameIdentifier which
does not match the current user session]
   SourceID.HttpHandlers.Logout.ConsumeRequest(HttpContext context) in
d:\sourceid.net-0.3new\sourceid\httphandlers\logout.cs:414
   SourceID.HttpHandlers.Logout.Process(HttpContext context) in
d:\sourceid.net-0.3new\sourceid\httphandlers\logout.cs:77
   SourceID.HttpHandlers.Logout.ProcessRequest(HttpContext context) in
d:\sourceid.net-0.3new\sourceid\httphandlers\logout.cs:50
=20
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication+IExecutio
nStep.Execute()
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&
completedSynchronously) +87


------------------------------------------------------------------------
--------
Version Information: Microsoft .NET Framework Version:1.1.4322.573;
ASP.NET Version:1.1.4322.573




And regarding my doubt, let's say my website acts as a service provider.
From my site I need to provide facility for my users to access another
website. Let say for example, similar to yahoo portal I have a website.
So from my site I have to provide access to lets say amazon.com for
online shopping.=20

1. How to proceed further in designing the application?=20
2. What are the necessary things I have to consisder?=20
3. I tried to create another application apart from sp-sample and
idp-sample. It just throws an error given below.

The located assembly's manifest definition with name
'Org.Mentalis.Security' does not match the assembly reference.=20
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information
about the error and where it originated in the code.=20

Exception Details: System.IO.FileLoadException: The located assembly's
manifest definition with name 'Org.Mentalis.Security' does not match the
assembly reference.

Source Error:=20


Line 182:            }
Line 183:
Line 184:            _SigningKey      =3D GetCrypto(
Line 185:                key_filename,
Line 186:                key_password,
=20

Source File: D:\SourceID.NET-0.3NEW\SourceID\Configuration.cs    Line:
184=20

Assembly Load Trace: The following information can be helpful to
determine why the assembly 'Org.Mentalis.Security' could not be loaded.


=3D=3D=3D Pre-bind state information =3D=3D=3D
LOG: DisplayName =3D Org.Mentalis.Security, Version=3D1.0.13.667,
Culture=3Dneutral, PublicKeyToken=3D085a8f6006888436
 (Fully-specified)
LOG: Appbase =3D file:///D:/Inetpub/wwwroot/IMEApp
LOG: Initial PrivatePath =3D bin
Calling assembly : (Unknown).
=3D=3D=3D

LOG: Publisher policy file is not found.
LOG: No redirect found in host configuration file
(D:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet.config).
LOG: Using machine configuration file from
D:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\config\machine.config.
LOG: Post-policy reference: Org.Mentalis.Security, Version=3D1.0.13.667,
Culture=3Dneutral, PublicKeyToken=3D085a8f6006888436
LOG: Attempting download of new URL
file:///D:/WINDOWS/Microsoft.NET/Framework/v1.1.4322/Temporary ASP.NET
Files/imeapp/efc927b6/3eccba53/Org.Mentalis.Security.DLL.
LOG: Attempting download of new URL
file:///D:/WINDOWS/Microsoft.NET/Framework/v1.1.4322/Temporary ASP.NET
Files/imeapp/efc927b6/3eccba53/Org.Mentalis.Security/Org.Mentalis.Securi
ty.DLL.
LOG: Attempting download of new URL
file:///D:/Inetpub/wwwroot/IMEApp/bin/Org.Mentalis.Security.DLL.
WRN: Comparing the assembly name resulted in the mismatch: PUBLIC KEY
TOKEN

=20

Stack Trace:=20


[FileLoadException: The located assembly's manifest definition with name
'Org.Mentalis.Security' does not match the assembly reference.]
   SourceID.Configuration.GetCrypto(String filename, String password,
String location_str, String store_name, String thumbprint, String
subject) +0
   SourceID.Configuration..ctor(HttpApplicationState application) in
D:\SourceID.NET-0.3NEW\SourceID\Configuration.cs:184
   SourceID.HttpHandlers.Manager.Init(HttpApplication context) in
D:\SourceID.NET-0.3NEW\SourceID\HttpHandlers\Manager.cs:48
   System.Web.HttpApplication.InitModules()
   System.Web.HttpApplication.InitInternal(HttpContext context,
HttpApplicationState state, MethodInfo[] handlers)
=20
System.Web.HttpApplicationFactory.GetNormalApplicationInstance(HttpConte
xt context)
   System.Web.HttpApplicationFactory.GetApplicationInstance(HttpContext
context) +256
   System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr)
+414

=20


------------------------------------------------------------------------
--------
Version Information: Microsoft .NET Framework Version:1.1.4322.573;
ASP.NET Version:1.1.4322.573


I'm able to guess that is due to invalid certification ( in the sense
that copied the same web.config file used in sp-sample, but the paths
were to change to point the corresponding application both in web.config
as well as provider.xml files.)=20

4. In the account_federations table there are two records for each
account.=20
cholan	Sample SourceID.NET Service Provider	idtWMJ5A%3d%3d::
idtWMJ5A%3d%3d::
cholan1	SourceID.NET Sample IDP	idtWMJ5A%3d%3d::	idtWMJ5A%3d%3d::

Can I use cholan account to access another website available in the
trust circle? Or do I have to federate my account with each site
available in the trust circle in order to access it (which will create
another 2 records in the account_federations table I suppose)?
Can you please help me to sort out the problem?

Thanks again for your support.

Cholan


-----Original Message-----
From: [email protected] [mailto:[email protected]] On
Behalf Of David Waite
Sent: Thursday, August 28, 2003 10:17 PM
To: [email protected]
Subject: Re: [SourceID SSO-dev] SourceID.Net - SqlFederationhandler.

Cholan NSamy wrote:

> Hi all,
>
> I have deployed the sourceID.net version0.3 in windows 2003, I'm=20
> working on sp-sample and idp-sample available along with the download.
>
> I have trying to understand how this SqlFederationHandler works.
>
> In that the table account_federations doesn't stores the password in
it.
>
> I am able to login with any password. Can any one help me out to clear

> my doubts?
>
I think this is a misunderstanding on what the Federation handlers do;=20
let me know if this helps.

This is correct behavior; the interface does not handle local=20
authentication; it handles storing and retrieving account-linking=20
information for the user with other federated sites.

You could say that Liberty-enabled 'Service Provider' (SP) sites have=20
two separate authentication mechanisms:
- The user logging directly into the SP with a username/password
credentials
- A trusted 'Identity Provider' (IDP) asserts that a user has the=20
associated identity.

The Identity Provider asserts this by using a unique key[1] value=20
associated with the user by the account linking. The IDP and SP both=20
know the user by this key, but do not share any user data by default,=20
including the account name(s) of the user on the two web sites.

The IFederationHandler interface allows a website designer to choose how

these keys are persisted. It does not look up other information=20
associated with the identity, or provide for checking the local SP=20
login. By not requiring this interface to support password lookup for=20
local authentication, it allows greater flexability for local=20
authentication methods (such as kerberos, SSPI, x.509 client=20
certificates...).

[1] Technical detail: This key is actually a pair of name identifiers;=20
the value is actually allowed to be different depending on if the SP is=20
talking to the IDP, or the IDP is talking to the SP. I just describe the

whole thing as a single 'key' to simplify the above description.

>    1. When federating, don't we have to store the password? If yes how
>       to store that? Because account_federations table doesn't have
>       that provision to store the password data.
>    2. I get a error when loging out. The error message is
>
> "Logout request received for a NameIdentifier which does not match the

> current user session"
>
> sess[Constants.Session.UserId] -- error: object 'sess' doesn't have an

> indexer
>
Hmm, that error is odd - looks like there is no session data in ASP.NET=20
associated with the user. Can you send me a stacktrace of the error, or=20
file a bug? Does it always fail on logout?

-David Waite

_______________________________________________
sso-dev mailing list
[email protected]
http://mail.sourceid.org/mailman/listinfo/sso-dev