Programmatic Access to SP Attributes

[Jeff Gehly]

Cantor, Scott E. wrote
> 
>> So I have a WebLogic 12c IdP "working" with a Shibboleth SP for version
>> 2.4.3
>> running on IIS 7.5.  The IdP and SP are both running on my local machine,
>> while I figure out how to do all this.  There are some page protection
>> issues,
>> but I worked around them by hitting the /Login with a target parameter
>> set
>> to the site I need to have SSO access to (I'm more worried about the
>> communications between IdP and SP than site protection at the moment).
> 
> If you're not protecting the pages at all, then there's no data for your
> to read there. So it's the same issue.
> 
> -- Scott
> 

So based upon this, it seems like my real problem stems from the fact that I
my configuration settings are set in such a way that the SP is not properly
protecting my page.  My page is a single ASP .NET page (Default.aspx with
Default.aspx.vb code behind) that resides on IIS at
http://localhost:8101/secure/Default.aspx.

So in my shibboleth2.xml, I set this in the ISAPI section:

<Site id="1" name="localhost" port="80" />
<Site id="3" name="localhost" port="8101"/>

Then I have this in my RequestMap section:

<Host name="localhost" port="80">
	<Path name="secure" authType="shibboleth" requireSession="true" />
</Host>
<Host name="localhost" port="8101"  redirectToSSL="443" >
        <Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>

I set the ApplicationDefaults to an entityID of
https://localhost:8101/shibboleth-sp, with signing and encryption both set
to true.  I left REMOTE_USER untouched from the default configuration.  I've
set the meta data provider for my IdP to an XML file on my local system, and
left the rest of the settings to default.  My metadata and certificates are
loaded on the IdP site and a service provider partner is configured for
Shibboleth's SP endpoints.


When I hit the page http://localhost:8101/secure/Default.aspx, I get taken
directly to the page.  The native.log shows these entries:

2012-07-31 15:05:08 DEBUG Shibboleth.ISAPI [2836] isapi_shib: mapped
https://localhost/secure/Default.aspx to default
2012-07-31 15:05:09 DEBUG Shibboleth.ISAPI [2836] isapi_shib: mapped
https://localhost/secure/Default.aspx to default
2012-07-31 15:05:09 DEBUG Shibboleth.ISAPI [2836] isapi_shib: mapped
https://localhost/favicon.ico to default

Now where I get confused is that if I hit the /Login directly, everything
seems to work exactly like it should.  I'm getting a prompt for
username/password, and then (if I provide the target for redirect) I get
taken back to the site.  I'm even seeing a log entry saying that it is
parsing the attributes from the response and putting them into a new
session.  Is this just evidence that I've messed up the site protection
piece, but otherwise it works?  Or is there something else that I'm missing?

I do see an SSL error on the server (handshake status is NOT_HANDSHAKING),
but I don't know if that would impact the site protection or not given that
I'm still getting the response when I hit Shibboleth's /Login.  If it wasn't
already obvious, I am a novice at SSL, SSO, and Shibboleth.



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Programmatic-Access-to-SP-Attributes-tp7581007p7581017.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.