Apache 2.4 producing 500 error when serving DirectoryIndex page from Shib SP protected areas

[Paul Beckett (ITCS)]

Scott,
The secure directory exists, and contains a single index.html (just for testing at the moment).
The apache server config includes: 
DirectoryIndex index.htm index.html

<Location /Shibboleth.sso>
SetHandler shib
</Location>
<IfModule mod_alias.c>
  <Location /shibboleth-sp>
    Allow from all
  </Location>
  Alias /shibboleth-sp/main.css /usr/local/share/shibboleth/main.css
</IfModule>
<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require valid-user
</Location>

Requests to /secure , /secure/ or /secure/index.html all result in this same behaviour : browser appears to receive no response.

Previously prior to the mod_shib.cpp patch, requesting /secure/index.html worked, but /secure/ would result in a 500 error. I think my config is broadly the same.... unfortunately it was all in a virtual server running on the PC that died - so have had to recreate from scratch. Tomorrow I could rebuild mod_shib without the mod_shib.cpp patch to verify I still get exactly the same behaviour (500 error when relying on DirectoryIndex, but otherwise get page) as I did before if that would be useful?

Thanks,
Paul


>-----Original Message-----
>From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
>On Behalf Of Cantor, Scott
>Sent: Wednesday, October 03, 2012 4:31 PM
>To: Shib Users
>Subject: Re: Apache 2.4 producing 500 error when serving DirectoryIndex
>page from Shib SP protected areas
>
>On 10/3/12 10:38 AM, "Paul Beckett (ITCS)" <P.Beckett at uea.ac.uk> wrote:
>>
>>Removing the hook to /AttrChecker, doesn't affect the behaviour (in
>>terms of the end result in the browser). I'm pretty sure it's passing
>>though the AttrChecker successfully, as it initially failed displaying
>>an error template (due to our not releasing a required field in our
>>IDP). When we released that field it now progresses to the " Please
>>wait while we transfer you to
>>https://ueacisr6test.uea.ac.uk/Shibboleth.sso/Metadata..." (my SP), the
>>same as if I remove the sessionHook entirely. My expectation was that
>>if the client requested https://ueacisr6test.uea.ac.uk/secure/ then
>>they would be authenticated and sent back to the original location
>>(https://ueacisr6test.uea.ac.uk/secure/) to see the content.
>
>Yes, correct. All that fits.
>
>>After the message is displayed, if I re-request the page:
>>https://ueacisr6test.uea.ac.uk/secure/ the browser whirrs away, but
>>nothing gets returned.
>
>Ok. Is there anything at that location or in that directory? Just want to make
>sure I can reproduce the scenario exactly so I can debug it.
>
>The basic problem is that Apache doesn't process subrequests properly
>(defined as "using the same sequence of module hooks and constraints as the
>original request"). I have to figure out what each case looks like and account
>for them.
>
>>Sorry the access log details I included were just the bit after the
>>client returned from the IDP, when no sessionHook was configured.
>>Access log details of the different sessionHook configurations is below.
>
>That's all expected. It's obviously hung in the /secure request in both cases. So
>the hook's not involved, and is working fine.
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to users-
>unsubscribe at shibboleth.net