Shib, EzProxy, and safebrowsing

[Steven Carmody]

We recently reconfigured out EZP server to use Shib authN + authZ 
(replacing the previous ldap authN). We're certainly not the first site 
to do this. Its working fine (as expected) for most people; its not 
working for a handful of people.

We made a couple of site visits today, to people for whom it is not 
working. We brought along a vanilla laptop, and had the people use our 
machine to login; login failed for them. After a littel experimenting, 
and some use of the LIVE HTTP HEADERS plugin, here's the scenario that 
I'm seeing:

boot the laptop, launch firefox, click thru the pages to reach EZP, 
authenticate with my credentials, get returned to EZP, everything works 
fine. The HTTP trace only contains calls to the EZP and Shib IDP 
machines. Quit firefox.

Launch firefox, click thru the pages to reach EZP, authenticate with THE 
USER'S CREDENTIALS, get returned to EZP, stop with blank screen. The 
HTTP trace contains the expected calls to the EZP and Shib IDP machines. 
But, it now also contains GET commands like this:

http://safebrowsing.clients.google.com/safebrowsing/downloads?client=navclient-auto-ffox&appver=

The last three entries in the trace are the POST to EZP -- 
Shibboleth.sso/SAML2/POST, followed by two GETs to safebrowsing, and 
then it stops.....

The two sequences described above are done one immediately after the 
other, on the same machine.

Has anyone else ever seen behavior like this ?

Thanks!