IIS7 with SP-Plugin, authentication infinite loop
Stefan König
s.koenig at uni-tuebingen.de
Fri Jul 13 08:09:06 EDT 2012
Hello,
I (need to) use IIS7 with shibboleth SP ISAPI plugin for user access
control of an ASP.net application.
This application is located at:
https://idefix.worldtalk.de:82/RoleManager/ (server on localhost)
After first access to this location, the browser is redirected to the
Shibboleth-IdPs (https://pbm12.uni-tuebingen.de/idp/) Login page.
After Login I get into an infinite loop of HTTP-Request as shown below:
Possible Reason:
SP-Plugin doesn't recognize valid session or session is invalid
I've added some details on one of those requests to the application-URL
(including HTTP headers with cookies).
Thx for help & suggestions...
Regards
Stefan
First the log of requests (recorded by firefox):
[13:56:21.595] GET https://idefix.worldtalk.de:82/RoleManager/ [HTTP/1.1
302 Please Wait 137ms]
[13:56:21.732] GET
https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZJfT8IwFMW%2FytJ31rVuIA0jQXiQBIUw9MEX02130ti1s7cT%2FPaOP0ZMDM%2F33N%2B55%2BSOUNa6EZPWb80aPlpAH%2BxrbVAcBylpnRFWokJhZA0ofCGyycNC8DASjbPeFlaTYIIIzitrptZgW4PLwH2qAp7Wi5RsvW9QUKpKqNQ%2B3FmnSy%2F1e1iCuOU026o8txr8NkS09EDndLXMNiSYdecoIw%2FgX0yT14yHrVE930KuzBuYjtTRG9odVCkNZ8YaSuWg8DTLliSYz1LyCkmSsJgXMURVzKWMZFLIfHiT9JMqHg5YJ0NsYW7QS%2BNTwiPGe9Ggx242jImkLzh7IcHqnPtOmbLzv15SfhKhuN9sVr1TrmdweMzUCch4dKhaHI3dRfnXsfKncTI%2ByP7rFpsRvUCffBrx2LHms5XVqvgKJlrb3dSB9JASRuj4tPL3I8bf&RelayState=https%3A%2F%2Fidefix.worldtalk.de%3A82%2FRoleManager%2F
[HTTP/1.1 302 Moved Temporarily 216ms]
[13:56:21.952] GET https://pbm12.uni-tuebingen.de/idp/AuthnEngine
[HTTP/1.1 302 Moved Temporarily 14ms]
[13:56:21.969] GET https://pbm12.uni-tuebingen.de/idp/Authn/UserPassword
[HTTP/1.1 200 OK 855ms]
[13:56:22.857] GET https://pbm12.uni-tuebingen.de/idp/login.css
[HTTP/1.1 200 OK 60ms]
[13:56:22.859] GET https://pbm12.uni-tuebingen.de/idp/images/logo.jpg
[HTTP/1.1 200 OK 60ms]
-- PASSWORT PROMPT --
[13:56:39.154] POST
https://pbm12.uni-tuebingen.de/idp/Authn/UserPassword [HTTP/1.1 302
Moved Temporarily 513ms]
[13:56:39.675] GET
https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO [HTTP/1.1
200 OK 637ms]
[13:56:40.401] POST
https://idefix.worldtalk.de:82/Shibboleth.sso/SAML2/POST [HTTP/1.1 302
Moved 12ms]
[13:56:40.451] GET https://idefix.worldtalk.de:82/RoleManager/ [HTTP/1.1
302 Please Wait 87ms]
[13:56:40.539] GET
https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZLNbsIwEIRfJfKdGIefBIsgUTgUiRZE0h56qZxkaaw6dup1Cn37JkBVKlWcd%2FabndFOUVSq5vPGlXoHHw2g846V0shPg5g0VnMjUCLXogLkLufJ%2FGHNA7%2FPa2ucyY0i3hwRrJNGL4zGpgKbgP2UOTzt1jEpnauRUyoL2MujfzBWFU6od78AHgU0KWWWGQWu9BEN7egB3W6SlHjL9hypRQf%2BxdRZxQK%2F0bLnGsikfgPdklp6TduD9lLBhbGDQlrIHU2SDfFWy5i8ZsMwi4CNgUWRyLPhcLyfsDAYsX0wnkwGYStDbGCl0QntYhL0WdDrhz02SBnjozEf9l%2BIt73kvpO6aP1vl5SdRcjv03TbO%2Bd6BounTK2AzKZd1fxkbK%2FKv40VP42TWSf7r1usp%2FQKffap%2BWPLWi23Rsn8y5srZQ4LC8JBTBihs%2FPK34%2BYfQM%3D&RelayState=https%3A%2F%2Fidefix.worldtalk.de%3A82%2FRoleManager%2F
[HTTP/1.1 302 Moved Temporarily 22ms]
[13:56:40.574] GET https://pbm12.uni-tuebingen.de/idp/AuthnEngine
[HTTP/1.1 302 Moved Temporarily 5ms]
[13:56:40.580] GET
https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO [HTTP/1.1
200 OK 856ms]
[13:56:41.475] POST
https://idefix.worldtalk.de:82/Shibboleth.sso/SAML2/POST [HTTP/1.1 302
Moved 10ms]
[13:56:41.526] GET https://idefix.worldtalk.de:82/RoleManager/ [HTTP/1.1
302 Please Wait 2ms]
[13:56:41.557] GET
https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZLNTsMwEIRfJfI9cRL6azWVSnugUqFREzhwQU68pRaOHbwOhbcnaYooEup5Z7%2FZGe0MeaVqtmjcQe%2FgvQF03melNLLTICGN1cxwlMg0rwCZK1m2uN%2BwOAhZbY0zpVHEWyCCddLopdHYVGAzsB%2ByhMfdJiEH52pklEoBe%2FkZHI1VwnH1Fghgk5hmB1kURoE7BIiGdvSYptssJ96qPUdq3oF%2FMXVRRXHQaOm7BgqpX0G3pJZe0%2FagvVRwZuxASAulo1m2Jd56lZCXaVEKMQoH4UBMiiIcD%2Fh0H4sS%2BHQ0nALnrQyxgbVGx7VLSBxGsR%2BO%2FegmjyI2HLFB9Ey89Jz7VmrR%2Bl8vqehFyO7yPPX7XE9g8ZSpFZD5rKuanYztRfnXsfyncTLvZP91i%2FWMXqB7n5o9tKz1KjVKll%2FeQilzXFrgDhISETrvV%2F5%2BxPwb&RelayState=https%3A%2F%2Fidefix.worldtalk.de%3A82%2FRoleManager%2F
[HTTP/1.1 302 Moved Temporarily 285ms]
[13:56:41.846] GET https://pbm12.uni-tuebingen.de/idp/AuthnEngine
[HTTP/1.1 302 Moved Temporarily 21ms]
[13:56:41.902] GET
https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO [HTTP/1.1
200 OK 1037ms]
[13:56:42.982] POST
https://idefix.worldtalk.de:82/Shibboleth.sso/SAML2/POST [HTTP/1.1 302
Moved 10ms]
[13:56:43.026] GET https://idefix.worldtalk.de:82/RoleManager/ [HTTP/1.1
302 Please Wait 2ms]
[13:56:43.030] GET
https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZJPb4JAEMW%2FCtk7rID%2F2IiJ1UNNbCVCe%2BilWWComy67dGep9tsXxaY2aTzPm9%2Bb9zIz5LVs2KK1e7WDjxbQOsdaKmTnQUxao5jmKJApXgMyW7B08bBhgTdgjdFWF1oSZ4EIxgqtllphW4NJwXyKAp52m5jsrW2QUSpKqMTRO2gjS8vlu1cCmwY03Ys81xLs3kPU9EQPaLJNM%2BKsunOE4ifwL6bJaz%2FwWiVc20Iu1BuojtTRG9odVAkJF8YOSmGgsDRNt8RZr2Lyygse5sXEH0JYVWU0gmg0HBdhUJU8mkYcOhliC2uFlisbk2DgB%2B5g4vph5vtsNGbD8IU4ySX3nVBl53%2B7pLwXIbvPssTtcz2DwXOmTkDms1PV7Gxsrsq%2FjeU%2FjZP5SfZft9jM6BW692nYY8darxItRfHlLKTUh6UBbiEmPqHzfuXvR8y%2FAQ%3D%3D&RelayState=https%3A%2F%2Fidefix.worldtalk.de%3A82%2FRoleManager%2F
[HTTP/1.1 302 Moved Temporarily 119ms]
Details to one of those Requests to
https://idefix.worldtalk.de:82/RoleManager/ after IdP-Login:
--- Request Headers ---
GET /RoleManager/
Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding gzip, deflate
Accept-Language de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Connection keep-alive
Cookie a=796b384f1abd6e1fb9f18c448462a1e8;
_shibsession_64656661756c7475726e3a6964656669782e776f726c6474616c6b2e64653a7370=_36ac93a2072a28d5dc9097812dd6e1bf
Host idefix.worldtalk.de:82
Referer https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO
User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0)
Gecko/20100101 Firefox/13.0.1
--- Response Headers ---
Cache-Control private,no-store,no-cache
Content-Length 40
Content-Type text/html
Date Fri, 13 Jul 2012 11:36:33 GMT
Expires 01-Jan-1997 12:00:00 GMT
Location
https://pbm12.uni-tuebingen.de/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZLNbsIwEIRfJfKdGCf8WiQShUORaIlI2kMvlZMsxapjp16n0LdvIFSlUsV5Z7%2FZGe0MRaVqPm%2FcXm%2FhowF03rFSGvl5EJHGam4ESuRaVIDcFTydP6x54Pd5bY0zhVHEmyOCddLohdHYVGBTsJ%2BygKftOiJ752rklMoSdvLoH4xVpRPq3S%2BBTwKa7mWeGwVu7yMaeqIHNNmkGfGW7TlSixP4F1PnFQv8RsueayCX%2Bg10S2rpNW0P2kkFF8YWSmmhcDRNN8RbLSPyOhRQsh3AYBJM8yGI8XA6YDApRVDko5yJVobYwEqjE9pFJOizoNcf91iYMcbDEQ%2FDF%2BIll9x3Upet%2F%2B2S8k6E%2FD7Lkl6X6xksnjO1AhLPTlXzs7G9Kv82Vvw0TuKT7L9usZ7RK3TnU%2FPHlrVaJkbJ4subK2UOCwvCQUQYoXG38vcj4m8%3D&RelayState=https%3A%2F%2Fidefix.worldtalk.de%3A82%2FRoleManager%2F
Server Microsoft-IIS/7.5
X-Powered-By ASP.NET
This is my shibboleth2.xml ... if other parts of the config are needed,
just ask:
---
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<!--
By default, in-memory StorageService, ReplayCache, ArtifactMap, and
SessionCache
are used. See example-shibboleth2.xml for samples of explicitly
configuring them.
-->
<!--
The InProcess section contains settings affecting web server modules.
Required for IIS, but can be removed when using other web servers.
-->
<InProcess logger="native.logger">
<ISAPI normalizeRequest="true" safeHeaderNames="true">
<!--
Maps IIS Instance ID values to the host scheme/name/port.
The name is
required so that the proper <Host> in the request map above
is found without
having to cover every possible DNS/IP combination the user
might enter.
-->
<Site id="1" name="idefix.worldtalk.de" scheme="https"
port="82"/>
<!--
When the port and scheme are omitted, the HTTP request's
port and scheme are used.
If these are wrong because of virtualization, they can be
explicitly set here to
ensure proper redirect generation.
-->
</ISAPI>
</InProcess>
<!--
To customize behavior for specific resources on IIS, and to link
vhosts or
resources to ApplicationOverride settings below, use the XML syntax
below.
See
https://spaces.internet2.edu/display/SHIB2/NativeSPRequestMapHowTo for help.
Apache users should rely on web server options/commands in most
cases, and can remove the
RequestMapper element. See
https://spaces.internet2.edu/display/SHIB2/NativeSPApacheConfig
-->
<RequestMapper type="Native">
<RequestMap>
<!--
The example requires a session for documents in /secure on
the containing host with http and
https on the default ports. Note that the name and port in
the <Host> elements MUST match
Apache's ServerName and Port directives or the IIS Site
name in the <ISAPI> element above.
-->
<Host name="idefix.worldtalk.de" scheme="https" port="82">
<Path name="RoleManager" applicationId="RoleManager"
authType="shibboleth" requireSession="true" exportAssertion="true"/>
</Host>
</RequestMap>
</RequestMapper>
<!--
The ApplicationDefaults element is where most of Shibboleth's SAML
bits are defined.
Resource requests are mapped by the RequestMapper to an
applicationId that
points into to this section (or to the defaults here).
-->
<ApplicationDefaults
entityID="urn:idefix.worldtalk.de:sp"
REMOTE_USER="eppn persistent-id targeted-id">
<!--
Controls session lifetimes, address checks, cookie handling,
and the protocol handlers.
You MUST supply an effectively unique handlerURL value for each
of your applications.
The value defaults to /Shibboleth.sso, and should be a relative
path, with the SP computing
a relative value based on the virtual host. Using
handlerSSL="true", the default, will force
the protocol to be https. You should also add a cookieProps
setting of "; path=/; secure"
in that case. Note that while we default checkAddress to
"false", this has a negative
impact on the security of the SP. Stealing cookies/sessions is
much easier with this disabled.
-->
<Sessions lifetime="28800" timeout="3600" checkAddress="false"
relayState="ss:mem" handlerSSL="true" cookieProps="; path=/; secure">
<!--
Configures SSO for a default IdP. To allow for >1 IdP, remove
entityID property and adjust discoveryURL to point to
discovery service.
(Set discoveryProtocol to "WAYF" for legacy Shibboleth
WAYF support.)
You can also override entityID on /Login query string, or
in RequestMap/htaccess.
-->
<SSO entityID="https://pbm12.uni-tuebingen.de/idp/shibboleth"
discoveryProtocol="SAMLDS"
discoveryURL="https://pbm12.uni-tuebingen.de/idp/DS/WAYF">
SAML2 SAML1
</SSO>
<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>
<!-- Extension service that generates "approximate"
metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata"
signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1"/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session"
showAttributeValues="true"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<!--
Allows overriding of error template information/filenames. You can
also add attributes with values that can be plugged into the
templates.
-->
<Errors supportContact="webmaster at idefix.worldtalk.de"
logoLocation="/shibboleth-sp/logo.jpg"
styleSheet="/shibboleth-sp/main.css"/>
<!-- Example of remotely supplied batch of signed metadata. -->
<!--
<MetadataProvider type="XML"
uri="http://federation.org/federation-metadata.xml"
backingFilePath="federation-metadata.xml"
reloadInterval="7200">
<MetadataFilter type="RequireValidUntil"
maxValidityInterval="2419200"/>
<MetadataFilter type="Signature" certificate="fedsigner.pem"/>
</MetadataProvider>
-->
<!-- Example of locally maintained metadata. -->
<MetadataProvider type="XML"
file="C:/opt/shibboleth-sp/etc/shibboleth/pbm12-metadata.xml"
validate="false" />
<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true"
path="attribute-map.xml"/>
<!-- Use a SAML query if no attributes are supplied during SSO. -->
<AttributeResolver type="Query" subjectMatch="false"/>
<!-- Default filtering policy for recognized attributes, lets
other data pass. -->
<AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/>
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem"
certificate="sp-cert.pem"/>
<!--
The default settings can be overridden by creating
ApplicationOverride elements (see
the
https://spaces.internet2.edu/display/SHIB2/NativeSPApplicationOverride
topic).
Resource requests are mapped by web server commands, or the
RequestMapper, to an
applicationId setting.
Example of a second application (for a second vhost) that has a
different entityID.
Resources on the vhost would map to an applicationId of "admin":
-->
<ApplicationOverride id="RoleManager">
<Sessions lifetime="28800" timeout="3600"
checkAddress="false"
handlerURL="https://idefix.worldtalk.de:82/Shibboleth.sso" />
</ApplicationOverride>
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate
runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>
<!-- Low-level configuration about protocols and bindings available
for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>
</SPConfig>
--- END --
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4480 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/users/attachments/20120713/50416307/attachment.bin
More information about the users
mailing list