Shibboleth.sso/Status 403 error

[Bai Shen]

On Mon, May 14, 2012 at 11:27 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 5/14/12 11:24 AM, "Bai Shen" <baishen.lists at gmail.com> wrote:
> >
> >I know how to set permissions.  I'm just not sure what they should be set
> >to.  All of my log files are owned by root:root.  These were automaticlly
> >created when I started the shibd and httpd services.
>
> The log directory is owned by root, the module runs as non-root, ergo, you
> get no log file.
>
>
If the module runs under httpd, which runs as root, why does it run as
non-root?


> I finally have a workaround for that, but in the meantime, that's the
> situation, as it has been for years and is documented in the wiki.
>
>
-nods-  I'm not trying to cause problems.  Just still learning how it all
works.


> >However, I don't have a native.log file.  According to
> >https://helpdesk.wisc.edu/ams/page.php?id=20454
> ><https://helpdesk.wisc.edu/ams/page.php?id=20454> I should create a
> >native.log file and set it's ownership to apache:apache.
>
> That doesn't fix anything when the directory itself is owned and locked by
> root. My advice is to ignore the issue unless you need the file.
>
>
I was only trying to get the file because the ACL errors were supposed to
be in it.


> >As for the ACL, it's not letting me connect even though I've set it to my
> >ip range of
> >192.168.1.0/24 <http://192.168.1.0/24>.
>
> There is no support for ranges until 2.5, which is clearly stated in the
> documentation.
>
>
I didn't realize that 2.5 wasn't out yet.

Since ranges are not supported, how do I change the ACL to allow all?  The
documentation says that it's supposed to default to that, but when I
installed Shibboleth, it was set to 127.0.0.1.

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120514/c061b9d7/attachment-0001.html