SP issue: Shib-Identity-Provider not set for some IdPs

[Sara Hopkins]

Hello all,

I'm trying to help a client just now whose SP (Shibboleth 2.0 or 2.1 I 
believe) is seeing that the Shib-Identity-Provider variable is set upon 
authentication for some IdPs but not for others. This is in SAML2 
operation. The "failing" IdPs are known to work just fine with other 
SPs. The SP logs show successful authentication for all of these IdPs, 
and I can't see any obvious difference between working and failing IdPs 
in the SP logs, except that at the end for a working IdP the SP logs 
something like this:

2012-03-26 08:12:18 INFO Shibboleth.SessionCache [297]: new session 
created: ID (_3e70ccd790c81e51da798f5a01cc0c5a) IdP 
(https://idp.example.org/entity) 
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (192.168.92.21)

whereas for a failing IdP you get this:

2012-03-26 09:25:13 INFO Shibboleth.SessionCache [298]: new session 
created: ID (_60d61d331a250f71e9f72c9985595ead) IdP (none) 
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (192.168.92.21)

It seems fairly clear that it logs "none" instead of the IdP entity ID 
because Shib-Identity-Provider is not set, and this tallies with what my 
client's application code sees when it tries to access that variable. 
Unfortunately this brings me no closer to understanding why this is 
happening!

Their Apache config includes this:

<Location /shibboleth/protected.php>
     AuthType shibboleth
     ShibRequireSession On
     ShibUseHeaders On
     require valid-user
</Location>

Could problems be caused by protecting a file rather than a directory here?

The thing that really puzzles me is why it consistently always works for 
some IdPs and fails for others.

I'm sorry I haven't provided detailed logs or config files, but they 
aren't mine to publicise. I'll be very grateful for any suggestions of 
where to look and what to test.

Many thanks,

Sara
-- 
Sara Hopkins
Support Team
UK Access Management Federation for Education and Research
web:    http://www.ukfederation.org.uk/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.