Access Denied on passive resource after login

[Robert Fidler]

Hello,

I've recently inherited a Shibboleth server and am still learning, so please forgive me if my issue is something simple I've over looked. A client brought an issue to me and I haven't been able to fix it, even though from the looks of it it should work. What is happening is that a user pre log in can access a recourse that has passive session access, but once they log in to shin and try to access that URI that is setup for passive session, the client gets an 'Access Denied' message. When I look at the access logs on the web server, I am seeing a 403 get generated. This seems like something that should work and from what I can see in the documentation I am enabling the passive session correctly. So there must be another part of my config that is in conflict, but I can't determine what.


IDP 2.3.8

SP 2.5.2

iPlanet 7.0.12


Here is the shibboleth2.xml file, I have cleaned up (removed other hosts and cleaned up url's)


<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"

    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"

    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"

    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"

    clockSkew="180">


<RequestMapper type="Native">

    <RequestMap applicationId="default">

          <Host name="webappdev" authType="shibboleth" requireSession="false" applicationId="webappdev">

            <AccessControl>

                <Rule require="eduPersonAffiliation">nobody</Rule>

            </AccessControl>

            <Path name="humanresources" authType="shibboleth" requireSession="false" >

                <Path name="phpmy" authType="shibboleth" requireSession="false">

                </Path>

                <Path name="train" authType="shibboleth" requireSession="true" >

                    <AccessControl>

                        <Rule require="eduPersonAffiliation">staff</Rule>

                    </AccessControl>

                </Path>

            </Path>

        </Host>

    </RequestMap>

</RequestMapper>


<ApplicationDefaults entityID="https://prev-revproxy/shibboleth" REMOTE_USER="eppn persistent-id targeted-id">


    <Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem"

                   handlerSSL="false"  handlerURL="/Shibboleth.sso"

                   cookieProps="; path=/; secure; HttpOnly">


          <SSO entityID="https://idptest/idp/shibboleth<https://idptest.queensu.ca/idp/shibboleth>" discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">

                    SAML2 SAML1

          </SSO>


          <Logout>SAML2 Local</Logout>

               <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

               <Handler type="Status" Location="/Status" acl="127.0.0.1"/>

               <Handler type="Session" Location="/Session" showAttributeValues="false"/>

               <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

          </Sessions>


          <Errors supportContact="root at localhost"

               logoLocation="/shibboleth-sp/logo.jpg"

               styleSheet="/shibboleth-sp/main.css"/>



          <MetadataProvider type="XML" uri="https://idptest/idp/profile/Metadata/SAML"

               backingFilePath="/opt/shibboleth-sp.64/etc/shibboleth/idptest-metadata.xml"

               reloadInterval="120">

               <TransportOption provider="CURL" option="32">3</TransportOption>

          </MetadataProvider>


          <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>



          <AttributeResolver type="Query" subjectMatch="true"/>


          <ApplicationOverride id="webappdev" entityID="https://webappdev/shibboleth" >

                    <AttributeExtractor type="XML" file="AttributeRelease/webappdev-attribute-map.xml"/>

          </ApplicationOverride>


          <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>


          <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>


     </ApplicationDefaults>



     <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>


     <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>


</SPConfig>



Thank you for any help you can give.

Rob

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130818/8be7d209/attachment.html