[JIRA] Resolved: (SSPCPP-408) ECP flow fails for Session configured inside of ApplicationOverride

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-408?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved SSPCPP-408.
---------------------------------

       Resolution: Fixed
    Fix Version/s: 2.5

http://svn.shibboleth.net/view/cpp-sp?rev=3547&view=rev

> ECP flow fails for Session configured inside of ApplicationOverride 
> --------------------------------------------------------------------
>
>                 Key: SSPCPP-408
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-408
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>          Components: Session Initiation
>    Affects Versions: 2.4.3
>            Reporter: skoranda at uwm.edu
>            Assignee: Scott Cantor
>             Fix For: 2.5
>
>
> Inside of <ApplicationDefaults> with this <Sessions> element configured
>         <Sessions lifetime="600" timeout="600" checkAddress="false"
>             handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="; path=/; secure" 
>             idpHistory="true" >
>              <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"
>                     relayState="cookie" entityID="https://my.idp.server/idp/shibboleth">
>                 <SessionInitiator type="Cookie" followMultiple="true" />
>                 <SessionInitiator type="SAML2" acsIndex="3" acsByIndex="false" template="bindingTemplate.html" ECP="true"/>
>             </SessionInitiator>
>             <LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
>                 <LogoutInitiator type="Local">
>                 </LogoutInitiator>
>             </LogoutInitiator>
>             <md:AssertionConsumerService Location="/SAML2/POST" index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
>             <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
>             <md:AssertionConsumerService Location="/SAML2/Artifact" index="3" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
>             <md:AssertionConsumerService Location="/SAML2/ECP" index="4" Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
>             <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
>             <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
>             <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
>             <!-- Status reporting service. -->
>             <Handler type="Status" Location="/Status" acl="127.0.0.1"/>
>             <!-- Session diagnostic service. -->
>             <Handler type="Session" Location="/Session" showAttributeValues="false"/>
>         </Sessions>
> if the following <ApplicationOverride> is defined
>        <ApplicationOverride id="wiki">
>             <Sessions lifetime="86400" timeout="86400" checkAddress="false"
>                 handlerURL="/WIKI_PATH/Shibboleth.sso" handlerSSL="true" cookieProps="; path=/; secure" 
>                 idpHistory="true" postData="ss:mem" postTemplate="/etc/shibboleth/wikiPost.html" >
>             </Sessions>
>         </ApplicationOverride>
> session initiation using a web browser and the 'wiki' application (the override) works but a ECP client cannot initiate a session because instead of the SOAP packet returned a 302 redirect is returned (standard browser flow).
> Changing the <ApplicationOverride> to instead be
>        <ApplicationOverride id="wiki">
>             <Sessions lifetime="86400" timeout="86400" checkAddress="false"
>                 handlerURL="/WIKI_PATH/Shibboleth.sso" handlerSSL="true" cookieProps="; path=/; secure" 
>                 idpHistory="true" postData="ss:mem" postTemplate="/etc/shibboleth/wikiPost.html" >
>               <md:AssertionConsumerService Location="/SAML2/ECP" index="4" Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
>             </Sessions>
>         </ApplicationOverride>
> works around the problem and enables the ECP flow to work. 
> It should not be necessary to repeat any of the endpoint information in
> an override.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira