浏览器加载 successURL 时出现 OpenAM 错误 500 "Unable to do Single Sign On or Federation"

Question

我刚刚安装了 OpenAM 13.0.0，创建了一个托管 IDP，并注册了一个远程 SP。在远程 SP（一种名为 Questetra 的产品）中，我配置了实体 ID、登录 URL、注销 URL 和使用在 http://idp:8080/openam/saml2/jsp/exportmetadata.jsp?entityid=http://idp:8080/openam&realm=/[=]XML 中找到的值的证书16=]

问题：OpenAM 在浏览器加载 successURL.

的步骤中显示 500 Internal Server Error

知道发生了什么吗？
有什么调试技巧吗？ Tomcat 和 OpenAM 日志中没有什么特别之处。

缩短的 Wireshark 跟踪

HTTP/1.1 200 OK
[...]

{"successURL":"/SSORedirect/metaAlias/idp?ReqID=a41de50e29c99ff3422f82b7g660ch6&index=null&acsURL=http%3A%2F%2Fthesp%3A8080%2Fuserweb%2Fsaml%2FSSO%2Falias%2Fbpm&spEntityID=http%3A%2F%2Fthesp%3A8080%2Fuserweb%2F&binding=urn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Abindings%3AHTTP-POST"}

GET /openam/SSORedirect/metaAlias/idp?ReqID=a41de50e29c99ff3422f82b7g660ch6&index=null&acsURL=http%3A%2F%2Fthesp%3A8080%2Fuserweb%2Fsaml%2FSSO%2Falias%2Fbpm&spEntityID=http%3A%2F%2Fthesp%3A8080%2Fuserweb%2F&binding=urn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Abindings%3AHTTP-POST HTTP/1.1
[...]

HTTP/1.1 500 Internal Server Error
[...]

<html>[...]HTTP Status 500 - Unable to do Single Sign On or Federation[...]</html>

完整跟踪 https://gist.github.com/nicolas-raoul/5ff26f37a95bc8088c6af7fe6ea5e468

Tomcat 7.0.72，Ubuntu 2016.04.1 LTS，Firefox 50.1.0

Answer 1

我通过直接从 OpenAM 导出的元数据文件中获取证书值并再次直接输入该值来解决同样的错误，以确保它完全相同。

浏览器加载 successURL 时出现 OpenAM 错误 500 "Unable to do Single Sign On or Federation"

OpenAM error 500 "Unable to do Single Sign On or Federation" when browser loads successURL

single-sign-on

saml-2.0

openam

缩短的 Wireshark 跟踪