Shibboleth and multiple entry points to application

[Rob Brooks]

Ahh Yes, I had forgot to move the CononicalName out to the VH level.
Strange but Apache configtest did not complain about that.  I've done that
and restarted shibd and httpd.  When I say "shib logs" I really mean
shibd.log and native.log.  I see the SAML in the shibd.log

shib version:  shibboleth-2.5.1-1.2


Is the problem I'm having a problem with the IdP configuration?



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Peter Schober
Sent: Tuesday, April 16, 2013 7:55 AM
To: users at shibboleth.net
Subject: Re: Shibboleth and multiple entry points to application

* Rob Brooks <rbrooks at biz-tech-solutions.com> [2013-04-16 14:30]:
> It is running on CentOS 5.9 with Apache.  The VH that is using it has 
> this in the config:
> 
>      <Location />
>        AuthType shibboleth
>        ShibRequestSetting requireSession 1
>        require valid-user
>         UseCanonicalName On
>      </Location>

UseCanonicalName does not have a defined meaning in Location context, see
http://httpd.apache.org/docs/2.2/en/mod/core.html#usecanonicalname
Doesn't `apachectl -t` complain about that?
Move that up to server or vhost context to resolve that error.

> For example, if I request https://myserver.com/path1 I end up back at 
> https://myserver.com ... I can grep the shib logs (all set to
> DEBUG) and I don't find any mention of 'path1' so I'm unsure how SP 
> knows to return to that path after authentication.

"the shib logs" also includes the native log, for which you must possibly
take extra steps to have it created. See "After Installation"
on the page
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxRPMInstall
Also httpd needs to be restarted after changing native.logger in order for
that to become effective.
(Maybe you did all that, you didn't say and no way for me to know.)

What version of the RPM is that, btw?
# rpm -qa shibboleth
-peter
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net