Shibboleth SP - PATH exclude in Request Mapper

Ragadeep Sriperumbudur ragadeep99 at hotmail.com
Mon Oct 29 16:05:57 EDT 2012 

Hello,

 

We are currently using Shibboleth SP with an Apache web server. Following
are the version details

 

-          Apache 2.2

-          Shibboleth 2.5

 

We have the application set up to work with an IdP and a default
Application.  The application setup works fine with Shibboleth directing the
user to the IdP for the login credentials when a secure resource is
accessed. We want to be able to let the user hit a Login page on the SP for
certain use cases. So, the following should occur

 

-          User gets redirected to the IdP login for any of the below links

https://myhost.com/MyApp

https://myhost.com/MyApp/xxx

 

-          User can access the below URL without getting redirected to the
IdP 

https://myhost.com/MyApp/Login.html

 

Fyi - I have followed the below email which was trying to do the same as us,
but this didn't work for us. We are probably missing something else

http://shibboleth.1660669.n2.nabble.com/shibboleth-SP-Problem-PATH-exclusion
-td5018479.html

 

The following are our settings 

 

*Apache config*

<Location /MyApp>

     AuthType shibboleth

     ShibUseHeaders On

     ShibRequestSetting requireSession 1

     require shibboleth

</Location>

 

*The Request Mapper entries in the shibboleth2.xml file are as below*

    <RequestMapper type="Native">

        <RequestMap applicationId="default">

            <Host name="myhost.com" scheme="https" >

             <Path name="MyApp" authType="shibboleth" requireSession="true">

                  <Path name="Login.html" authType="shibboleth"
requireSession="false" />

                </Path>

            </Host>

        </RequestMap>

    </RequestMapper>

 

*The following are logs from shibd_native.log*

2012-10-29 15:16:23 INFO Shibboleth.Config : loaded XML resource
(/etc/shibboleth/shibboleth2.xml)

2012-10-29 15:16:23 INFO Shibboleth.Config : Shibboleth SP Version 2.5.0

2012-10-29 15:16:23 INFO Shibboleth.Config : Library versions: log4shib
1.0.5, Xerces-C 3.1.1, XMLTooling-C 1.5.1, Shibboleth 1.5.0

2012-10-29 15:16:23 INFO Shibboleth.Config : building ListenerService of
type UnixListener...

2012-10-29 15:16:23 INFO Shibboleth.Config : no SessionCache specified,
using StorageService-backed instance

2012-10-29 15:16:23 INFO Shibboleth.Config : building RequestMapper of type
Native...

 

2012-10-29 15:16:23 INFO Shibboleth.Application : auto-configuring SSO
initiation for protocol (SAML2)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding SessionInitiator of
type (SAML2) to chain (/Login)

2012-10-29 15:16:23 INFO Shibboleth.Application : auto-configuring
ArtifactResolution endpoints for protocol (SAML2)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding
ArtifactResolutionService for Binding
(urn:oasis:names:tc:SAML:2.0:bindings:SOAP) at (/Artifact/SOAP)

2012-10-29 15:16:23 INFO Shibboleth.Application : auto-configuring SSO
endpoints for protocol (SAML2)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding
AssertionConsumerService for Binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST) at (/SAML2/POST)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding
AssertionConsumerService for Binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign) at
(/SAML2/POST-SimpleSign)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding
AssertionConsumerService for Binding
(urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact) at (/SAML2/Artifact)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding
AssertionConsumerService for Binding
(urn:oasis:names:tc:SAML:2.0:bindings:PAOS) at (/SAML2/ECP)

2012-10-29 15:16:23 INFO Shibboleth.Application : auto-configuring SSO
initiation for protocol (SAML1)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding SessionInitiator of
type (Shib1) to chain (/Login)

2012-10-29 15:16:23 INFO Shibboleth.Application : auto-configuring SSO
endpoints for protocol (SAML1)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding
AssertionConsumerService for Binding
(urn:oasis:names:tc:SAML:1.0:profiles:browser-post) at (/SAML/POST)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding
AssertionConsumerService for Binding
(urn:oasis:names:tc:SAML:1.0:profiles:artifact-01) at (/SAML/Artifact)

2012-10-29 15:16:23 INFO Shibboleth.Application : auto-configuring Logout
initiation for protocol (SAML2)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding LogoutInitiator of
type (SAML2) to chain (/Logout)

2012-10-29 15:16:23 INFO Shibboleth.Application : auto-configuring Logout
endpoints for protocol (SAML2)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding SingleLogoutService
for Binding (urn:oasis:names:tc:SAML:2.0:bindings:SOAP) at (/SLO/SOAP)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding SingleLogoutService
for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect) at
(/SLO/Redirect)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding SingleLogoutService
for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST) at (/SLO/POST)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding SingleLogoutService
for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact) at
(/SLO/Artifact)

2012-10-29 15:16:23 INFO Shibboleth.Application : auto-configuring Logout
initiation for protocol (Local)

2012-10-29 15:16:23 INFO Shibboleth.Application : adding LogoutInitiator of
type (Local) to chain (/Logout)

 

2012-10-29 15:16:23 DEBUG Shibboleth.RequestMapper : no resource
uri/path/name supplied, will load inline configuration

2012-10-29 15:16:23 DEBUG Shibboleth.RequestMapper : loading inline
configuration...

2012-10-29 15:16:23 DEBUG Shibboleth.RequestMapper : added Path mapping
(login.html)

2012-10-29 15:16:23 DEBUG Shibboleth.RequestMapper : added Path mapping
(MyApp)

2012-10-29 15:16:23 DEBUG Shibboleth.RequestMapper : Added <Host> mapping
for https://myhost.com 

2012-10-29 15:16:23 DEBUG Shibboleth.RequestMapper : Added <Host> mapping
for https://myhost.com:443

 

2012-10-29 15:19:12 DEBUG Shibboleth.Apache [11987] shib_check_user: mapped
https://myhost.com/MyApp/Login.html to default

 

2012-10-29 15:19:12 DEBUG Shibboleth.Listener [11987] shib_check_user:
sending message (default::getHeaders::Application)

2012-10-29 15:19:12 DEBUG Shibboleth.Listener [11987] shib_check_user:
trying to connect to listener

2012-10-29 15:19:12 DEBUG Shibboleth.Listener [11987] shib_check_user:
socket (22) connected successfully

2012-10-29 15:19:12 DEBUG Shibboleth.Listener [11987] shib_check_user: send
completed, reading response message

2012-10-29 15:19:12 DEBUG Shibboleth.SessionInitiator.SAML2 [11987]
shib_check_user: attempting to initiate session using SAML 2.0 with provider
(https://myidp.com/idp/shibboleth)

2012-10-29 15:19:12 DEBUG Shibboleth.Listener [11987] shib_check_user:
sending message (default/Login::run::SAML2SI)

2012-10-29 15:19:12 DEBUG Shibboleth.Listener [11987] shib_check_user: send
completed, reading response message

2012-10-29 15:19:13 DEBUG Shibboleth.Config : using local resource
(/etc/shibboleth/shibboleth2.xml), will monitor for changes

 

Could someone point out what if I am missing anything?

 

Thanks

Ragadeep

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121029/a7351a9e/attachment-0001.html

More information about the users mailing list