Shibboleth 2.5 External Auth handler

[Cantor, Scott]

On 8/2/12 4:32 PM, "Christopher J. Hubing" <cjh at psu.edu> wrote:
>
>I added that to my apache config and added the X-Forwarded-For header
>for the client address in the request to /Shibboleth.sso/ExternalAuth in
>my code and now I'm receiving the following error:
>
>"Forbidden
>You don't have permission to access /Shibboleth.sso/ExternalAuth on this
>server."
>
>So, it appears that it's respecting the header, but also conflating it
>with the address of the calling script (which is localhost).

Yes, that's the issue I was referring to in my second email. I just filed
a bug on it. It's an API race condition of sorts. I'll fix it for the
release.

It would be good if you could sidestep it for now just to complete
testing, but that's more or less the only bit I hadn't actually tested end
to end, I never tried using the cookie.

-- Scott