Circular login issue.

[PARDEE, MARTIN (MARTIN)]

Folks:

I have an Idp set up on a CentOS Linux box, and can authenticate against it using an SP on a Windows 7 IIS box.

I recently added an SP to the same Linux box as the Idp so that I could understand the setup of an apache native SP.

I'm running apache 2.3,  with a virtual host.

My IdP is running under tomcat 6 on the same box.

After running through the usual issues of ensuring that metadata was consistent across the shibboleth2.xml file,  the relyin-party.xml file and the idp-metadat.xml file,  I was faced with a persistent problem at login time.  My user id was succesfully authenticated but I repeatedly received errors about sending  a POST message to an invalid host.

The server that this runs on is : 'dt-safe1.client.research.att.com'

The EntityID that I use for the SP is 'safehost.research.att.com'


This problem went away when I changed the ServerName line in my apache httpd.conf file from 'dt-safe1.client.research.att.com'

To 'safehost.research.att.com',  which is BOTH the name of my entity AND the name of a virtual host in this same apache httpd.conf file.


It leaves me , however,  with a situation in which my IdP successfully authenticates my USER ID and then IMMEDITALY returns me to the login page requesting a new login ID.

I suspect that I have set up some sort of cycle in my naming convention,  but so far can't figure this out on my own.

Does anyone have any experience with this sort of "circular" behavior in shibboleth?


Thanks,

Martin pardee


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120621/828b4d1c/attachment.html