Attributes missing in $_SERVER

[Karla Borecky]

Lorenz, have you tried using the aacli shell script (in the /bin directory
of the IdP install)? It will show you what would actually be released to a
given SP.

I usually make a copy of it, then edit it to specify the entity ID of the
SP I'm testing. Here's an example, using my own account as the principal
(the account being queried):

./aacli.sh --principal=kborecky --configDir=$IDP_HOME/conf --requester=
https://sp.smith.edu/shibboleth

Before you run it, you have to set the environment variables for IDP_HOME
and JAVA_HOME - this is what I use:

IDP_HOME=/opt/shibboleth-idp;export IDP_HOME
JAVA_HOME=/usr/lib64/jre;export JAVA_HOME

Note that you also need to have the servlet-api-2.4.jar in the IdP's lib
directory - newer installs of the IdP don't seem to have it, but you can
get it from an older version. (Not sure if that is still true, that it
isn't in there for newer versions...)

So, when you run this script, it will produce xml output that should list
the attributes you're expecting. If it doesn't, then I think you want to
check your attribute filter file to be sure you're releasing the attributes
to that SP..

If it does list them properly, then maybe you haven't configured them in
your SP's attribute map?

Hope this helps, and wasn't TMI -

Karla




On Tue, Aug 20, 2013 at 12:05 PM, Ulrich Lorenz PH Luzern <
lorenz.ulrich at phlu.ch> wrote:

>  Hello everyone****
>
> ** **
>
> I’m currently setting up a Vagrant box as development base for one of our
> projects. Since we authenticate using Shibboleth, the same is also needed
> for the dev environment.****
>
> ** **
>
> We’re running several SPs, all of them in PHP/MySQL environments, and
> didn’t have any problems apart from the usual beginner pitfalls.****
>
> ** **
>
> In my Vagrant box I have a really weird problem and didn’t find a hint how
> to solve it, neither in the logs, nor in the archive:****
>
> ** **
>
> The authentication to works fine and the IdP redirects back to the SP. The
> Shibboleth session looks OK:****
>
> ** **
>
> *Miscellaneous*****
>
> *Client Address:* 192.168.23.1****
>
> *Identity Provider:* https://idp.phlu.ch/idp/shibboleth****
>
> *SSO Protocol:* urn:oasis:names:tc:SAML:2.0:protocol****
>
> *Authentication Time:* 2013-08-20T15:46:44.611Z****
>
> *Authentication Context Class:*urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
> ****
>
> *Authentication Context Decl:* (none)****
>
> *Session Expiration (barring inactivity):* 479 minute(s)****
>
> ** **
>
> *Attributes*****
>
> *[some other attributes]*****
>
> *affiliation*: 2 value(s)****
>
> *givenName*: 1 value(s)****
>
> *homeOrganization*: 1 value(s)****
>
> *homeOrganizationType*: 1 value(s)****
>
> *mail*: 1 value(s)****
>
> *persistent-id*: 1 value(s)****
>
> *surname*: 1 value(s)****
>
> *uniqueID*: 1 value(s)****
>
> ** **
>
> Also the log states that the session was created:****
>
> ** **
>
> 2013-08-20 15:46:44 INFO Shibboleth.SessionCache [6]: new session created:
> ID (_****
>
> 9582827607e3554a4fc8b9da0d15b12c) IdP (https://idp.phlu.ch/idp/shibboleth)
> Proto****
>
> col(urn:oasis:names:tc:SAML:2.0:protocol) Address (192.168.23.1)****
>
> 2013-08-20 15:46:44 DEBUG Shibboleth.SSO.SAML2 [6]: ACS returning via
> redirect t****
>
> o: https://portal.phlu.dev/phlu.portal/account/authenticate****
>
> 2013-08-20 15:46:55 DEBUG Shibboleth.Listener [7]: dispatching message
> (find::St****
>
> orageService::SessionCache)****
>
> ** **
>
> But in the $_SERVER global variable, there are no traces of a valid
> Shibboleth session apart from the cookie:****
>
>   ["HTTP_COOKIE"]=>****
>
>   string(182) "_shibsession_64656661756c7468747470733a2f2f706f7274616c2e70686c752e6465762f73686962626f6c657468=_9582827607e3554a4fc8b9da0d15b12c; TYPO3_Flow_Session=tOfPgzFqptKsQcFewPCt9BJl7mIDj9Cu"****
>
> ** **
>
> I already turned on logging for Shibboleth (DEBUG level) but found no
> information about things going wrong. In the Apache log I don’t find any
> hints, too. Maybe there are other logs I don’t know (yet) that could help
> me.****
>
> ** **
>
> Any help or advice is appreciated.****
>
> ** **
>
> *My environment:*
>
> Ubuntu 12.10****
>
> Apache 2.2****
>
> PHP 5.4.6****
>
> Shibboleth SP 2.4.3****
>
> ** **
>
> Thanks and best regards,****
>
> ** **
>
> Lorenz****
>
> ** **
>
> .......................................................****
>
> PH Luzern****
>
> Lorenz Ulrich****
>
> Webentwickler****
>
> Löwengraben 14****
>
> 6004 Luzern****
>
> Tel:   +41 (0)41 228 70 25****
>
> Web:  www.phlu.ch****
>
> Mail: lorenz.ulrich at phlu.ch ****
>
> .......................................................****
>
> Erreichbarkeit: Di, Fr****
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130820/e0b739a6/attachment-0001.html