<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-forward-container"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext"></span><o:p></o:p>Hi,<br>
<div class="WordSection1">
<p class="MsoNormal">
I thought I'd share.<br>
<br>
It started as a logrotate problem. Intermittently, on Sunday
morning (after logrotate calls Apache to gracefully restart),<br>
the web server would stop processing Shib requests. The web
server's error log would say<br>
the Shib module wasn't loaded. Even though, the configuration
hadn't changed.<br>
<br>
i.e. error_log<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">[Thu Jun 22 16:35:52.624143 2017]
[authn_core:error] [pid 24175:tid 140396625647360] [client
137.151.185.174:33262]
<b>AH01796:</b> <b>AuthType shibboleth configured without
corresponding module</b>, referer:
<a href="https://my.fullerton.edu/Portal/Dashboard/"
moz-do-not-send="true">https://my.fullerton.edu/Portal/Dashboard/</a><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
The message says the module isn't loaded. But, later (during
debugging) I discovered it was loaded.<br>
<br>
It turned out to be a kinda race condition between the Apache
'access_compat_module'<br>
and the 'mod_shib' module. It would work most of the time. But
randomly fail.<br>
It seemed to happen during httpd start, or graceful-restart.<br>
<br>
Here's the particulars,<br>
<br>
I upgraded an application's host from Redhat 6 to Redhat 7.
Which means going from<br>
Apache 2.2 to Apache 2.4. The application (Moodle) is stable -
no major change.<br>
<br>
The Apache auth 'directives' changed between 2.2 and 2.4. So,
Apache 2.4 provides the 'access_compat_module'<br>
for backward compatibility.<br>
<br>
There is a known issue if the '/' is protected by a 2.2
directive, and the '/sub' is protected by a 2.4 directive.<br>
- <a
href="https://urldefense.proofpoint.com/v2/url?u=https-3A__httpd.apache.org_docs_2.4_upgrading.html&d=DwMGaQ&c=GlhIK-Z7Itify6iax27XCf9KYFXDgbS2ET58kP-Ckgw&r=PECDz6A-l9MuAjPqIySkt-u_WU110-YCTJR9SoBtdy4&m=c0n_HepGxDAiVX7zCQowRObeT75kLuwwe1TSsCI0F7A&s=kCkKri4HiTXaa93XqjUUSPw8bONNrQuf8qUiZo5iHnQ&e="
moz-do-not-send="true">https://httpd.apache.org/docs/2.4/upgrading.html</a><br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<h3>Mixing old and new directives: NOT WORKING AS EXPECTED<o:p></o:p></h3>
<pre><span class="kwd">DocumentRoot</span><span class="pln"> </span><span class="str">"/var/www/html"</span><span class="pln"><o:p></o:p></span></pre>
<pre><span class="pln"><o:p> </o:p></span></pre>
<pre><span class="pun"><</span><span class="tag">Directory</span><span class="pln"> </span><span class="str">"/"</span><span class="pun">></span><span class="pln"><o:p></o:p></span></pre>
<pre><span class="pln"> </span><span class="kwd">AllowOverride</span><span class="pln"> </span><span class="typ">None</span><span class="pln"><o:p></o:p></span></pre>
<pre><span class="pln"> </span><span class="kwd">Order</span><span class="pln"> deny</span><span class="pun">,</span><span class="pln">allow<o:p></o:p></span></pre>
<pre><span class="pln"> </span><span class="kwd">Deny</span><span class="pln"> from all<o:p></o:p></span></pre>
<pre><span class="pun"></</span><span class="tag">Directory</span><span class="pun">></span><span class="pln"><o:p></o:p></span></pre>
<pre><span class="pln"><o:p> </o:p></span></pre>
<pre><span class="pun"><</span><span class="tag">Location</span><span class="pln"> </span><span class="str">"/server-status"</span><span class="pun">></span><span class="pln"><o:p></o:p></span></pre>
<pre><span class="pln"> </span><span class="kwd">SetHandler</span><span class="pln"> server-status<o:p></o:p></span></pre>
<pre><span class="pln"> </span><span class="kwd">Require</span><span class="pln"> local<o:p></o:p></span></pre>
<pre><span class="pun"></</span><span class="tag">Location</span><span class="pun">></span><span class="pln"><o:p></o:p></span></pre>
<pre><span class="pln"><o:p> </o:p></span></pre>
<pre><span class="pln">access</span><span class="pun">.</span><span class="pln">log </span><span class="pun">-</span><span class="pln"> GET </span><span class="pun">/</span><span class="pln">server-status </span><span class="lit">403</span><span class="pln"> </span><span class="lit">127.0</span><span class="pun">.</span><span class="lit">0.1</span><span class="pln"><o:p></o:p></span></pre>
<pre><span class="pln">error</span><span class="pun">.</span><span class="pln">log </span><span class="pun">-</span><span class="pln"> AH01797</span><span class="pun">:</span><span class="pln"> client denied by server configuration</span><span class="pun">:</span><span class="pln"> </span><span class="pun">/</span><span class="pln">var</span><span class="pun">/</span><span class="pln">www</span><span class="pun">/</span><span class="pln">html</span><span class="pun">/</span><span class="pln">server-status</span><o:p></o:p></pre>
</div>
</blockquote>
<p class="MsoNormal"><br>
It's taken me many weeks to get this far<br>
- capturing debug logs from faulted systems<br>
- debugging 'trace' log captures from working systems<br>
- reading 'mod_shib' source code<br>
- analyzing Apache work flows<br>
- understanding Apache/Shib module hooks<br>
<br>
And, I'm only about 90% sure I've gotten it right.<br>
<br>
My solution was to cut everything over to Apache 2.4's auth
'directives'<br>
<br>
<br>
Just for info<br>
<br>
<b>OLD Setup (worked fine)</b><br>
- Moodle 3.0<br>
- RedHat 6<br>
- Apache 2.2 prefork<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><Directory "/var/www/html/moodle"><br>
AllowOverride None<br>
Order allow,deny<br>
Allow from all<br>
</Directory><br>
<Location /auth/shibboleth/index.php><br>
AuthType shibboleth<br>
ShibCompatWith24 On<br>
ShibRequestSetting requireSession 1<br>
Require shib-session<br>
</Location><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
<b>New Setups</b><br>
- Moodle 3.2<br>
- RedHat 7<br>
- Apache 2.4 worker<br>
- This config does NOT work<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><Directory "/var/www/html/moodle"><br>
AllowOverride None<br>
<b>Order allow,deny<br>
Allow from all</b><br>
</Directory><br>
<Location /auth/shibboleth/index.php><br>
AuthType shibboleth<br>
ShibRequestSetting requireSession 1<br>
Require shib-session<br>
</Location><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
- This config seems OK<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><Directory "/var/www/html/moodle"><br>
AllowOverride None<br>
<b>Require all granted</b><br>
</Directory><br>
<Location /auth/shibboleth/index.php><br>
AuthType shibboleth<br>
ShibRequestSetting requireSession 1<br>
Require shib-session<br>
</Location><o:p></o:p></p>
</blockquote>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
In this instance, the error message from the Apache web server
lead me down the wrong rabbit hole.<br>
Just thought I'd share, and maybe help someone else.<br>
<br>
Time will tell if I got it right. I'll let you know if I got
it wrong.<br>
<br>
__Jim<o:p></o:p></p>
<div>
<p class="MsoNormal">-- <br>
<b>Jim O'Dell</b> <br>
Network Analyst <br>
<a href="http://www.fullerton.edu/" moz-do-not-send="true">California
State University Fullerton</a> <br>
Email: <a href="mailto:jodell@fullerton.edu"
moz-do-not-send="true">jodell@fullerton.edu</a> <br>
Phone: (657) 278-2256 <o:p></o:p></p>
<p>“if all you have is a hammer, everything looks like a nail”
-Abraham Maslow<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>