Sun Java System SAML v2 Plug-in for Federation Services User's Guide
只搜尋這本書
以 PDF 格式下載這本書 (1229 KB)

Appendix B Log Message Reference

This appendix lists the possible log messages for each functional area of the SAML v2 Plug-in for Federation Services. The default location for SAML v2 logs in Access Manager is /var/opt/product-directory/logs. The default location for SAML v2 logs in Federation Manager is /var/opt/SUNWam/fm/logs.


Note –

Metadata is sometimes referred to as entity descriptor or entity configuration where entity generically refers to the entityID with which each provider is given a unique identifier. For more information on the entityID, see Extended Metadata Properties.


The table in this appendix documents the following log file items:

Id

The log identification number prefixed in the log itself by SAML2–

Description

The log message

Data

The data type to which the message pertains

Trigger

Reason for the message

Action

Possible corrective action


Note –

Please note the following:

  • Setting entity configuration refers to using saml2meta command to load an extended metadata configuration file.

  • Creating entity descriptor refers to using saml2meta command to load either a standard or an extended metadata configuration file.


Table B–1 Log Reference for SAML v2 Plug-in for Federation Services

Id

Description

Data

Trigger

Action

1

Invalid service provider entity identifier

Service provider entity identifier

Cannot process request.

Check the service provider entity identifier.

2

Invalid identity provider entity identifier

Identity provider entity identifier

Cannot process request.

Check the identity provider entity identifier.

3

Unable to retrieve service provider metadata.

Service provider entity identifier

Cannot retrieve service provider metadata.

  • Check that the data store is accessible.

  • Check the realm or organization name.

  • Check the service provider entity identifier.

4

Unable to retrieve identity provider metadata.

Identity provider entity identifier

Cannot retrieve identity provider metadata.

  • Check that the data store is accessible.

  • Check the realm or organization name.

  • Check the identity provider entity identifier.

5

Unable to retrieve Single Sign-on Service URL.

Identity provider entity identifier

Error retrieving Single Sign-on Service URL.

  • Check that the data store is accessible.

  • Check the realm or organization name.

  • Check the identity provider entity identifier.

6

Redirecting to Single Sign On Service

Single Sign On Service URL

Sending Authentication Request by redirecting to Single Sign-on Service URL.

7

Unable to retrieve a response using Response ID after local login.

Response ID

Response doesn't exist in the service provider cache.

Check the service provider's cache clean up interval configuration.

8

Unable to retrieve an artifact from HTTP Request.

Artifact

<SAMLart> is missing from HTTP Request

  • Check with sender.

  • Check web container server log.

9

Received artifact from HTTP Request.

Artifact value

Received <SAMLart> from HTTP Request in the process of single sign-on using Artifact Profile.

10

Unable to find identity provider entity identifier based on the value of the <SourceID> element in artifact.

  • Artifact value

  • Realm or organization name

No matching identity provider entity identifier found in metadata configuration.

Check that identity provider's metadata is loaded.

11

Unable to load identity provider's metadata.

  • Identity provider entity identifier

  • Realm or organization name

Unable to load identity provider's metadata.

  • Check that the identity provider's metadata is configured correctly.

  • Check the realm or organization name.

  • Check the identity provider entity identifier.

12

Unable to find the identity provider's Artifact Resolution Service URL.

Identity provider entity identifier

Artifact Resolution Service URL is not defined in identity provider's metadata.

Check that the identity provider's Artifact Resolution Service URL is defined in the standard metadata.

13

Unable to create <ArtifactResolve> element.

  • Hosted service provider entity identifier

  • Value of artifact

Error when creating <ArtifactResolve> instance.

Check implementation of Artifact Resolution Service URL.

14

Unable to obtain SOAP response from identity provider's Artifact Resolution Service URL.

  • Hosted service provider entity identifier

  • Identity provider's Artifact Resolution Service URL

Error in SOAP communication.

  • Check identity provider's Artifact Resolution Service URL.

  • Check SOAP message's authentication requirements against those for identity provider's Artifact Resolution Service.

15

Obtained response using artifact profile.

  • Hosted service provider entity identifier

  • Remote identity provider entity identifier

  • Artifact value

  • XML response string (if log level was set to LL_FINE at run time)

Single Sign On using Artifact Profile.

16

Unable to obtain Artifact Response due to SOAP error.

Identity provider entity identifier

Error in SOAP communication.

Check identity provider configuration.

17

Received SOAP Fault instead of <ArtifactResponse>.

Identity provider entity identifier

Error in identity provider's Artifact Resolution Service.

  • Check identity provider's Artifact Resolution Service URL.

  • Check debug file for detailed information.

18

Received too many artifact responses.

Identity provider entity identifier

Identity provider sent more than one <ArtifactResponse> in SOAP message.

Check identity provider configuration.

19

Unable to instantiate <ArtifactResponse>.

Identity provider entity identifier

Error while instantiating <ArtifactResponse>.

  • Check identity provider configuration.

  • Check debug file for detailed information.

20

Unable to obtain <ArtifactResponse> from SOAP message.

Identity provider entity identifier

No <ArtifactResponse> is included in SOAP message.

Check identity provider configuration.

21

Unable to verify <ArtifactResponse> signature.

Identity provider entity identifier

Error while trying to verify signature on <ArtifactResponse>.

  • Check identity provider configuration.

  • Check debug file for detailed information.

22

Invalid InResponseTo attribute in <ArtifactResponse>.

Identity provider entity identifier

InResponseTo attribute in <ArtifactResponse> is missing or doesn't match Artifact Resolve ID.

Check identity provider configuration.

23

Invalid issuer in <ArtifactResponse>.

Identity provider entity identifier

Issuer in <ArtifactResponse> is missing or doesn't match with identity provider entity identifier.

Check identity provider configuration.

24

Invalid status code in <ArtifactResponse>.

  • Identity provider entity identifier

  • Status code (if log level was set to LL_FINE at run time)

Status in <ArtifactResponse> is missing or status code is not Success.

Check identity provider configuration.

25

Unable to instantiate responses from <ArtifactResponse>.

Identity provider entity identifier

Error occurred while instantiating <Response>.

Check debug file for detailed information.

26

<SAMLResponse> is missing from HTTP post interaction.

<SAMLResponse> attribute is missing from HTTP POST.

27

Unable to instantiate response from POST.

Error occurred while instantiating <Response>.

Check debug file for detailed information.

28

Unable to decode <Response>.

Error occurred while decoding <Response>.

Check debug file for detailed information.

29

Obtained response using POST profile.

XML string (if the log level was set to LL_FINE at run time)

Successful single sign-on using POST Profile.

30

Wrote federation information.

  • User name

  • <NameIDInfo> (if log level was set to LL_FINE at run time)

Successful user federation.

31

Redirect request to identity provider.

Redirection URL

Single logout.

32

Unable to find Assertion Consumer Service URL.

metaAlias

Single sign-on.

33

Unable to find return binding.

metaAlias

Single sign-on.

34

Unable to post a response to target.

Assertion Consumer Service URL

Single sign-on with POST binding.

35

Unable to create an artifact.

Identity provider entity identifier

Single sign-on with Artifact binding.

36

Received <AuthnRequest>.

  • Service provider entity identifier

  • Identity provider metaAlias

  • <AuthnRequest> XML string

Single sign-on.

37

Post response to service provider.

  • Service provider entity identifier

  • Identity provider metaAlias

  • <Response> XML string

Single sign-on with POST binding.

38

Send an artifact to SP.

  • Identity provider entity identifier

  • Identity provider realm or organization

  • Redirect URL

Single sign-on with Artifact binding.

39

Encountered invalid SOAP message error on identity provider.

Identity provider entity identifier

Single sign-on with Artifact binding.

40

Artifact response sent to service provider.

  • Identity provider entity identifier

  • Artifact string

  • Artifact response

Single sign-on with Artifact binding.

41

Entity descriptor obtained.

  • Entity identifier

  • Realm or organization

Obtain entity descriptor.

42

Encountered invalid realm or organization error while getting entity descriptor.

Realm or organization name

Obtain entity descriptor.

Check the realm or organization name.

43

Obtained invalid entity descriptor.

  • Entity identifier

  • Realm or organization name

Obtain entity descriptor.

Delete invalid metadata and import it again.

44

Encountered configuration error while getting entity descriptor.

  • Error message

  • Entity identifier

  • Realm or organization name

Obtain entity descriptor.

Check debug file for detailed information.

45

No entity identifier found.

Realm or organization name

Set entity descriptor.

Set entity identifier in provider metadata.

46

Invalid realm or organization error while setting entity descriptor.

Realm or organization name

Set entity descriptor.

Check the realm or organization name.

47

Entity descriptor doesn't exist.

  • Entity identifier

  • Realm or organization name

Set entity descriptor.

Create metadata for provider.

48

Entity descriptor was set.

  • Entity identifier

  • Realm or organization name

Set entity descriptor.

49

Encountered configuration error while setting entity descriptor.

  • Error message

  • Entity identifier

  • Realm or organization name

Set entity descriptor.

Check debug file for detailed information.

50

Invalid entity descriptor to set.

  • Entity identifier

  • Realm or organization name

Set entity descriptor.

Check entity descriptor if it follows the schema.

51

No entity identifier found while creating entity descriptor.

Realm or organization name

Creating entity descriptor.

Set entity identifier in entity descriptor.

52

Invalid realm found while creating entity descriptor.

Realm or organization name

Creating entity descriptor.

Check the realm name.

53

Configured entity descriptor found already found.

  • Entity identifier

  • Realm or organization name

Creating entity descriptor.

Delete existing entity descriptor before configuring new one.

54

Entity descriptor successfully created.

  • Entity identifier

  • Realm or organization name

Creating entity descriptor.

55

Configuration error occurred when creating entity descriptor.

  • Error message

  • Entity identifier

  • Realm or organization name

Creating entity descriptor.

Check debug file for detailed information.

56

Cannot create entity descriptor.

  • Entity identifier

  • Realm or organization name

Creating entity descriptor.

Check that the XML syntax of the entity descriptor follows the schema.

57

Invalid realm error occurred when deleting entity descriptor.

Realm or organization name

Deleting entity descriptor.

Check the realm or organization name.

58

Entity descriptor doesn't exist.

  • Entity identifier

  • Realm or organization name

Deleting entity descriptor.

59

Entity descriptor was successfully deleted.

  • Entity identifier

  • Realm or organization name

Deleting entity descriptor.

60

Configuration error while deleting entity descriptor.

  • Error message

  • Entity identifier

  • Realm or organization name

Deleting entity descriptor.

Check debug file for detailed information.

61

Successfully retrieved entity configuration.

  • Entity identifier

  • Realm or organization name

Getting entity configuration.

62

Invalid realm or organization error while getting entity configuration.

Realm or organization name

Getting entity configuration.

Check the realm or organization name.

63

Retrieved invalid entity configuration.

  • Entity identifier

  • Realm or organization name

Getting entity configuration.

Delete invalid entity configuration and import it again.

64

Configuration error while getting entity configuration.

  • Error message

  • Entity identifier

  • Realm or organization name

Getting entity configuration.

Check debug file for detailed information.

65

No entity identifier value found while setting entity configuration.

Realm or organization name

Setting entity configuration.

Define entity identifier in entity configuration.

66

Invalid realm value found while setting entity configuration.

Realm or organization name

Setting entity configuration.

Check the realm or organization name.

67

Entity configuration doesn't exist.

  • Entity identifier

  • Realm or organization name

Setting entity configuration.

Create an entity descriptor before setting entity configuration.

68

Entity configuration was successfully set.

  • Entity identifier

  • Realm or organization name

Setting entity configuration.

69

Configuration error occurred while setting entity configuration.

  • Error message

  • Entity identifier

  • Realm or organization name

Setting entity configuration.

Check debug file for detailed information.

70

Referenced entity configuration is invalid.

  • Entity identifier

  • Realm or organization name

Setting entity configuration.

Check that the XML syntax of the entity descriptor follows the schema.

71

No entity identifier found while creating entity configuration.

Realm or organization name

Creating entity configuration.

Define entity identifier in entity configuration.

72

Invalid realm or organization value while creating entity configuration.

Realm or organization name

Creating entity configuration.

Check the realm or organization name.

73

Entity descriptor doesn't exist while creating entity configuration.

  • Entity identifier

  • Realm or organization name

Creating entity configuration.

Create entity descriptor before creating entity configuration.

74

Entity configuration already exists.

  • Entity identifier

  • Realm or organization name

Creating entity configuration.

Delete existing entity configuration first.

75

Entity configuration was successfully created.

  • Entity identifier

  • Realm or organization name

Creating entity configuration.

76

Configuration error occurred while creating entity configuration.

  • Error message

  • Entity identifier

  • Realm or organization name

Creating entity configuration.

Check debug file for detailed information.

77

Entity configuration cannot be created.

  • Entity identifier

  • Realm or organization name

Creating entity configuration.

Check that the XML syntax of the entity descriptor follows the schema.

78

Invalid realm or organization value while deleting entity configuration.

Realm or organization name

Deleting entity configuration.

Check the realm or organization name.

79

Entity configuration doesn't exist.

  • Entity identifier

  • Realm or organization name

Deleting entity configuration.

Check debug file for detailed information.

80

Entity configuration was successfully deleted.

  • Entity identifier

  • Realm or organization name

Deleting entity configuration.

81

Configuration error occurred while deleting entity configuration.

  • Error message

  • Entity identifier

  • Realm or organization name

Deleting entity configuration.

Check debug file for detailed information.

82

Value of realm or organization is invalid.

Realm or organization name

Retrieving all hosted entities.

Check the realm or organization name.

83

Configuration error occurred while retrieving all hosted entities.

  • Error message

  • Realm or organization name

Retrieving all hosted entities.

Check debug file for detailed information.

84

Successfully retrieved all hosted entities.

  • Error message

  • Realm or organization name

Retrieving all hosted entities.

85

Value of realm or organization is invalid.

Realm or organization name

Retrieving all remote entities.

Check the realm or organization name.

86

Configuration error occurred while retrieving all remote entities.

  • Error message

  • Realm or organization name

Retrieving all remote entities.

Check debug file for detailed information.

87

Successfully retrieved all remote entities.

  • Error message

  • Realm or organization name

Retrieving all remote entities.

88

InResponseTo attribute in response is invalid.

Response ID

Service provider receiving a response to single sign-on request.

Check debug file for detailed information.

89

Issuer in response is invalid, not configured or not trusted by the hosted provider.

  • Hosted entity identifier

  • Realm or organization name

  • Response identifier

Service provider receiving a response to single sign-on request.

Check configuration.

90

Status code in response does not denote success.

<ResponseID> status code (if log level was set to LL_FINE at run time)

Service provider receiving a response to single sign-on request.

Most likely an error occurred at identity provider. Check the status code and contact identity provider, if needed.

91

Assertion in response was not encrypted.

Response ID

Service provider requested that the response's assertion be encrypted, but it received an assertion(s) that was (were) not encrypted.

  • Check configuration.

  • Notify identity provider regarding the requirement.

92

Response has no assertion.

Response ID

Service provider received a single sign-on response that contained no assertion.

Check error code of the response and notify identity provider, if needed.

93

Issuer in assertion is invalid, not configured at service provider, or not trusted by the service provider.

Assertion ID

Service provider receiving a response to single sign-on request.

Check configuration

94

Issuer in assertion did not match the issuer in the response or other assertions in the response.

Assertion ID

Service provider receiving a response to single sign-on request.

Check debug file for detailed information.

95

Assertion was not signed or the signature is not valid.

Assertion ID

Service provider requested that the assertion in a response to a single sign-on request be signed but it received an assertion(s) that was (were) not signed or one that contained an invalid signature.

  • Check configuration.

  • Check debug file for detailed information.

96

<SubjectConfirmationData> element had no subject.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Check debug file for the assertion received.

  • Contact identity provider, if needed.

97

<SubjectConfirmationData> element had no recipient.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Check debug file for the assertion received.

  • Contact identity provider, if needed.

98

Service provider that received the response is not the intended recipient.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Check debug file for the assertion received.

  • Check metadata.

  • Contact identity provider, if needed.

99

Time defined in <SubjectConfirmationData> element is invalid.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Synchronize the time between service provider and identity provider.

  • Increase the time skew attribute in the service provider entity configuration.

100

Assertion received by service provider had a time defined in the <notBefore> attribute of <SubjectConfirmationData> element.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Check debug file for the assertion received.

  • Contact identity provider, if needed.

101

Assertion received by service provider contained a different <InResponseTo> attribute from the one in the response, or it contained no <InResponseTo> value but the response did.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Check debug file for the assertion received.

  • Contact identity provider, if needed.

102

Assertion received by service provider contained no conditions.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Check debug file for the assertion received.

  • Contact identity provider, if needed.

103

Assertion received by service provider contained no <AudienceRestriction>.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Check debug file for the assertion received.

  • Contact identity provider, if needed.

104

Assertion received by service provider was not the intended audience of the single sign-on assertion.

Assertion ID

Service provider received an assertion in a response to a single sign-on request.

  • Check debug file for the assertion received.

  • Check metadata.

  • Contact identity provider, if needed.

105

Successfully found authentication assertion in the response.

  • Assertion ID

  • <Subject> (if log level was set to LL_FINE at run time)

  • SessionIndex, if any

Both the response and assertion(s) inside the response are valid.

106

Invalid single sign-on token was found in the request.

Single sign-on token value

Provider initiated single logout without a single sign-on token.

107

No entity identifier is specified in the request.

Entity identifier value

Provider initiated a request without an entity identifier.

Specify EntityID parameter in request URL.

108

No metaAlias is specified in a request.

Value of metaAlias

Provider initiated a request without metaAlias.

Specify metaAlias parameter in request URL.

109

Successful redirection of request to authentication page.

URL to Authentication page

Request initiated without a single sign-on token.

110

Provider cannot decode URL encoded Query parameter.

URL encoded Query parameter

Initiate to decode incorrectly URL encoded Query parameter.

111

Cannot instantiate MNI Response because of incorrect XML value.

XML value of MNI Response

Provider can't parse MNI Response with incorrect XML string.

112

Cannot instantiate MNI Request because of incorrect XML value.

XML value of MNI Request

Provider can't parse MNI Request with incorrect XML string.

113

Cannot instantiate single logout Response because of incorrect XML value.

XML value of single logout Response

Provider can't parse single logout Response with incorrect XML string.

114

Cannot instantiate single logout request because of incorrect XML value.

XML value of single logout request

Provider can't parse single logout request with incorrect XML string.

115

Cannot verify signature in MNI request.

MNI request with signature

Signature in MNI request is incorrect.

116

Cannot verify signature in MNI response.

MNI response with signature

Signature in MNI response is incorrect.

117

Cannot verify signature in single logout request.

Single logout request with signature

Signature in single logout request is incorrect.

118

Cannot verify signature in single logout response.

Single logout response with signature

Signature in single logout response is incorrect.

119

Cannot decrypt <EncryptedID>.

Exception message

Provider attempts to decrypt an encrypted <EncryptedID>.

120

MNI response throws error.

Status message

MNI request caused problem.

121

Single logout response throws error.

Status message

Single logout request caused problem.

122

Entity role is not specified in the request.

Entity Role value

Initiated request contains no Entity Role value.

Specify Entity Role parameter in the request.

123

Successfully retrieved circle of trust from cache.

  • Name of the circle of trust

  • Realm or organization name

Obtained the circle of trust from cache.

124

Invalid realm while getting the circle of trust.

Realm or organization name

Obtain the circle of trust

Check the realm or organization value.

125

Obtained the circle of trust from directory.

  • Name of the circle of trust

  • Realm or organization name

Obtain the circle of trust

126

Error while retrieving circle of trust from directory.

  • Error message

  • Name of the circle of trust

  • Realm or organization name

Obtain the circle of trust

  • Check configuration.

  • Check debug file for detailed information.

127

Invalid realm value found while retrieving all circles of trust.

Realm or organization name

Getting all circles of trust.

Check the realm or organization value.

128

Error while retrieving all circles of trust.

  • Error message

  • Search pattern

  • Realm or organization name

Getting all circles of trust.

  • Check configuration.

  • Check debug file for detailed information.

129

Invalid name identifier throws error while modifying circle of trust.

Realm or organization name

Modifying the circle of trust.

Check the name identifier of circle of trust descriptor.

130

Invalid realm or organization name while modifying circle of trust.

Realm or organization name

Modifying the circle of trust.

Check the realm or organization value.

131

Modified circle of trust.

  • Name of the circle of trust

  • Realm or organization name

Modifying the circle of trust.

132

Error while modifying the circle of trust.

  • Error message

  • Name of the circle of trust

  • Realm or organization name

Modifying the circle of trust.

Check debug for more detailed error message.

133

Invalid name identifier throws error while creating circle of trust.

Realm or organization name

Creating circle of trust.

Check the name identifier of circle of trust descriptor.

134

Circle of trust being created already exists.

  • Name of the circle of trust

  • Realm or organization name

Creating circle of trust.

Check the name identifier of circle of trust descriptor.

135

Invalid realm or organization error while creating the circle of trust.

Realm or organization name

Creating circle of trust.

Check the realm or organization value.

136

Circle of trust successfully created.

  • Name of the circle of trust

  • Realm or organization name

Creating circle of trust.

137

Invalid realm or organization error while deleting the circle of trust.

Realm or organization name

Deleting circle of trust.

Check the realm value.

138

Circle of trust successfully deleted.

  • Name of the circle of trust

  • Realm or organization name

Deleting circle of trust.

139

Error while deleting the circle of trust.

  • Error message

  • Name of the circle of trust

  • Realm or organization name

Deleting circle of trust.

Check debug file for more detailed information.

140

Invalid realm or organization error while getting list of all active circles of trust.

Realm or organization name

Retrieving list of all active circles of trust.

Check the realm or organization value.

141

Error thrown while getting list of all active circles of trust.

  • Error message

  • Realm or organization name

Getting all active circle of trust.

Check debug file for more detailed information.

142

Invalid name identifier error thrown.

Realm or organization name

Adding member to circle of trust.

Check the name of the circle of trust.

143

No entity identifier found while adding member to circle of trust.

Realm or organization name

Adding member to the circle of trust.

Check the entity identifier.

144

Invalid realm or organization error thrown.

Realm or organization name

Adding member to the circle of trust.

Check the realm or organization value.

145

Configuration error thrown.

  • Error message

  • Name of the circle of trust

  • Entity identifier

  • Realm or organization name

Adding member to the circle of trust.

Check debug file for more detailed information.

146

Invalid name identifier error thrown.

Realm or organization name

Removing member from circle of trust.

Check the name of the circle of trust.

147

No entity identifier found.

  • Name of the circle of trust

  • Realm or organization name

Removing member from circle of trust.

Check the entity identifier in metadata.

148

Configuration error thrown.

  • Error message

  • Name of the circle of trust

  • Entity identifier

  • Realm or organization name

Removing member from circle of trust.

Check debug file for more detailed information.

149

Invalid realm or organization found.

Realm or organization name

Listing trusted providers in circle of trust.

Check the realm or organization value.

150

Configuration error thrown.

  • Error message

  • Name of the circle of trust

  • Realm or organization name

Listing trusted providers in circle of trust.

Check debug file for more detailed information.

151

Invalid realm or organization error thrown.

Realm or organization name

Removing trusted provider from circle of trust.

Check the realm or organization value.

152

Configuration error thrown.

  • Error message

  • Name of the circle of trust

  • Entity identifier

  • Realm or organization name

Determining if entity is member of circle of trust.

Check debug file for more detailed information.

153

Issuer in request is invalid.

  • Hosted entity identifier

  • Realm or organization name

  • Request ID

Issuer in request is not configured or not trusted by the hosted provider

Check configuration.

154

Invalid realm or organization error thrown.

Realm or organization name

Retrieving all entities.

Check the realm or organization name.

155

Configuration error thrown.

  • Error message

  • Realm or organization name

Retrieving all entities.

Check debug file for detailed information.

156

Successfully btained all entities.

Realm or organization name

Retrieving all entities.