Shibboleth 2.5 External Auth handler

[Christopher J. Hubing]

On Thu, 2 Aug 2012, Cantor, Scott wrote:

> On 8/2/12 4:05 PM, "Christopher J. Hubing" <cjh at psu.edu> wrote:
>>
>> I do have checkAddress="false" in the ApplicationDefaults element, so
>> the IP address shouldn't matter.
>
> If there's nothing logged indicating I'm right, then I will entertain
> other possibilities, but that's not what checkAddress means, the setting
> you want is consistentAddress (which is suicide to turn off).
>
> I'm verifying that it will work as intended, but the missing bit to
> configure should be to get REMOTE_ADDR set for the handler path:
>
> <Location /Shibboleth.sso/ExternalAuth>
> ShibRequestSetting REMOTE_ADDR X-Forwarded-For
> </Location>


I added that to my apache config and added the X-Forwarded-For header 
for the client address in the request to /Shibboleth.sso/ExternalAuth in 
my code and now I'm receiving the following error:

"Forbidden
You don't have permission to access /Shibboleth.sso/ExternalAuth on this 
server."

So, it appears that it's respecting the header, but also conflating it 
with the address of the calling script (which is localhost).



>
> (or RequestMap equiv, and with whatever header is preferred)
>
> I would make that happen implicitly if I could, but I don't have a way to
> do that from within the handler itself without writing more code than it's
> worth.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>

______________________________________________________________________
Christopher J. Hubing                Information Technology Services
cjh at psu.edu                          Emerging Technologies
+1 814 865 8772                      Pennsylvania State University
http://www.personal.psu.edu/cjh