SP behind VPN Gateway: handler locations

[Martin Haase]

Hi Peter, hi Scott,

thanks for your answers. It took me some time as we had a longer server
outage. I now brought the IdP past the ACS check, but differently than
Peter suggested. I just added to the SP's metadata at the IdP:

    <md:ACS...
Location="https://my.vpngateway.net/Shibboleth.sso/SAML2/POST/,DanaInfo=sp1.intra.net,SSL"
ResponseLocation="https://sp1.intra.net/Shibboleth.sso/SAML2/POST" />

This makes the IdP select and check for the intranet ACS URL but
redirect the message to the gateway's address.

The problem now: in its SAML Response, the IdP sets the destination URL
of the gateway's address as well. The SP does not like that, throwing a

opensaml::BindingException at
(https://sp1.intra.net/Shibboleth.sso/SAML2/POST)
SAML message delivered with POST to incorrect server URL.

I guess the same problem would happen with Peter's solution: the target
in the POST would be the gateway address while the SP receives it at the
intranet address.

Can this check be switched off?

And yes, I am of course aware of
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTroubleshootingCommonErrors#NativeSPTroubleshootingCommonErrors-SAMLmessagedeliveredwithPOSTtoincorrectserverURL
...:
    ad 1. I cannot seem to be able to set the SP's server address to the
gateway's address,
    ad 2. I cannot seem to be able to influence the gateway's rewrite
rules, and
    ad 3. how can I make the IdP redirect to a different URL than the
destination encoded in the SAML response?

As Scott suggested, I used the older config. Tried setting
ResponseLocation for the ACS handler as well, which was ignored. Tried
to set an absolute path there, but this got appended to the handlerURL
like a relative path. Setting an absolute handlerURL of
https://my.vpngateway.net/Shibboleth.sso while having the server listen
on https://sp1.intra.net even made things worse, I seemed to be unable
to access the SP at all.

Do you still have any ideas?

Regards,
Martin



Am 26.08.2011 11:30, schrieb Peter Schober:
> * Martin Haase <martin.haase at daasi.de> [2011-08-25 17:56]:
>> Now I configured this URL in the SP's metadata on the IdP side. The
>> problem is, the SP sends the above intranet URL as its ACS. Both do not
>> match, so the IdP complains that there's no peer endpoint available etc.
>> So how could I achieve that the SP is sending to the IdP the gateway
>> address as its ACS, whereas actually receiving the assertion on its
>> usual address?
> If the ACS URL check at the IdP alone prevents stuff from working you
> could apply https://issues.shibboleth.net/jira/browse/SIDP-499 to your
> IdP and have the SP sign AuthnRequests.
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
-----------------------------------------------------------------------
Dr. Martin Haase
DAASI International GmbH                   phone:     +49 7071 407109-6
Europaplatz 3                              Fax  :     +49 7071 407109-9
D-72072 Tübingen                           email: Martin.Haase at DAASI.de
Germany                                    Web  :   http://www.daasi.de

Directory Applications for Advanced Security and Information Management
-----------------------------------------------------------------------


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3765 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20110831/1fdaf99b/attachment-0001.bin