SessionInitiator triggering and return

[Russell Beall]

Hmmm…  guess I should have completed one last test before writing this.

I found that the "target" attribute gives me the behavior I need if I use it with a relative URL.  For some reason when I included the hostname, a hostname that is not the same as the hostname on the SP, the requested ACS URL changed to use that hostname, though it did not change the other parts of the ACS URL as specified by the handlerURL setting.

Russ.

On Jul 20, 2012, at 9:41 AM, Russell Beall wrote:

> Hi all (particularly Scott…),
> 
> I have found two unexpected configuration issues and I am wondering whether it is working as expected or if there is a problem.
> 
> This was tested with the current MacPorts release of Shib SP 2.4.3.
> 
> I am configuring some advanced uses of multiple session types at the SP and I need to trigger different SessionInitiators based on different links at the SP.  This is more than a discovery service because I might already have a session, but then will need to trigger another session from another source to provide additional data.
> 
> The first thing I thought should work, but didn't, was to use the following:
> <Location /myapp/Demo/LoginType2>                                             
>    AuthType shibboleth                                                       
>    ShibRequestSetting applicationId its-admin-workstations                   
>    ShibRequestSetting requireSessionWith sessioninit-login-type-2       
>    ShibRequestSetting requireSession true                                    
>    require valid-user                                                        
>    ShibRequireAll On                                                         
>    Order allow,deny                                                          
>    Allow from all                                                            
> </Location>                                                                   
> 
> This apache rule set works fine to initiate the session if there is not already a session.  However, if there is already a session which was triggered under a different SessionInitiator, this rule is ignored even though it should be required to have a session under the SessionInitiator with the indicated identifier.
> 
> I already found the workaround to go ahead and use the initiator location specified using the handlerURL plus the Location value.
> 
> However…  when I started using this method to trigger a session, I need it to return to a specific target URL at the SP when the session has been processed.  Luckily (I thought), there is an option for this which I thought was supposed to be "target" on the SessionInitiator config.
> 
> Using "target" did not achieve what appears to be the description on the SessionInitiator wiki page, which seems to be to act like an override to the homeURL setting.  Instead, I found that the target setting actually changed the handlerURL and my IdP began to reject requests because it was being asked to return attributes to an unregistered ACS URL.
> 
> What is the correct behavior of this "target" option?
> 
> Is there a correct way to override the homeURL setting on a per-SessionInitiator basis?
> 
> Thanks,
> Russ.
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net