Apache 2.4 producing 500 error when serving DirectoryIndex page from Shib SP protected areas

[Paul Beckett (ITCS)]

Sorry for the delay in responding, only got a replacement PC yesterday!

I couldn't manage to checkout the updated file from SVN, so applied the patch of diffs between 3765 and 4643.
http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/apache/mod_shib.cpp?r1=3643&r2=3765&pathrev=3765
I assume r3643 is the same as 2.5.0, as 2.5.0's release date seems to be newer than r3643's commit date?

Applying this patch has resulted in different behaviour .... but it's still not working for me. I'm not entirely sure if this is my configuration, or an issue with the Apache 2.4 module.

When requesting a page, I'm redirected to the IDP, successfully authenticate there, and get redirected back to my Apache 2.4 server running the SP, but instead of receiving the page all I see is the message:
" Please wait while we transfer you to https://ueacisr6test.uea.ac.uk/Shibboleth.sso/Metadata..."

If I replace the sessionHook="/Shibboleth.sso/AttrChecker" in Application defaults with sessionHook="/Shibboleth.sso/Session" , I can see I'm receiving attributes back from the IDP.

In the apache access log all I see is:
ueacisr6test.uea.ac.uk:443 139.222.120.221 - - [03/Oct/2012:13:16:23 +0100] 0 7569 "POST /Shibboleth.sso/SAML2/POST HTTP/1.1" 302 489 "https://testlogin.uea.ac.uk/oala/sso?SAMLRequest=lZJNT4MwGMe%2FCul9QJnA1gwS3A4u2ZQM9ODFlFJHY2mxT%2FHl2wtD47ws8dj0%2F9ZfugLayo5kvW3Ugb%2F2HKzz0UoF5HSRoN4ooikIIIq2HIhlpMj2OxK4PumMtpppiZwMgBsrtFprBX3LTcHNm2D8%2FrBLUGNtB8Tzek6ZABPZocQdDi5lbv%2FiFY2oKi25bVwA7Y3pgZffFSVyNoNSKDoG%2F8aMdqmPQp1laCqpN7iRs90k6InN%2BfIqDpd1WMe4Dv1FyKKYLtlzVMVhxPAgA%2Bj5VoGlyiYo8HEww%2F7Mn5c4IDgiePGInPz7eddC1UIdL7OoJhGQm7LMZ9P8B27gNH0QoHQ1EiWnYnPG%2BHIs%2FQGL0v9h3HNLa2rpyjurnTZ05Hbo2W5yLQX7dDIp9fvacGp5gjDy0sny91OkXw%3D%3D&RelayState=ss%3Amem%3Ae00149034f9541f6b9766afe4bdac43258eac3a7f0b7e3fc11174c69c2ba9b67" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1"

In the shibd.log all I see is:
2012-10-03 13:16:23 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: eduPersonTargetedID
2012-10-03 13:16:23 INFO Shibboleth.SessionCache [1]: new session created: ID (_9599c0fa5d154f3bcb351131a2bc01e5) IdP (https://testlogin.uea.ac.uk/entity) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (139.222.120.221)

Nothing is being logged to apache error log.

My shibboleth2.xml config is based on the example config and can be viewed at: http://www.uea.ac.uk/~s167/shibboleth2.xml

Any advice would be greatly appreciated.
Thanks,
Paul



>-----Original Message-----
>From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
>On Behalf Of Cantor, Scott
>Sent: Wednesday, September 19, 2012 3:00 AM
>To: Shib Users
>Subject: Re: Apache 2.4 producing 500 error when serving DirectoryIndex
>page from Shib SP protected areas
>
>This is recorded here:
>https://issues.shibboleth.net/jira/browse/SSPCPP-502
>
>The fix is recorded in the bug. It worked for me. If the OP is building from
>source and could try the patch, that would be good.
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to users-
>unsubscribe at shibboleth.net