Problem with SP configuration with ApplicationOverride

[Paulo Rodrigues]

Hi all, 

we are trying to configure a SP with ApplicationOverride. Our environment is Apache 2.2 running in RHEL 6. 

As far as I could grasp from the documentation, this seems to be the way to go: 

<ApplicationDefaults id="default" policyId="default" 
entityID="http://host1.rnp.br" REMOTE_USER="eppn persistent-id targeted-id" 
signing="false" encryption="false" attributePrefix="AJP_"> 
<Sessions lifetime="28800" timeout="3600" checkAddress="false" 
handlerURL="/Shibboleth.sso" handlerSSL="false" 
exportLocation="http://localhost/Shibboleth.sso/GetAssertion" 
exportACL="127.0.0.1" idpHistory="false" idpHistoryDays="7"> 

<SessionInitiator type="Chaining" Location="/DS" id="DS" 
relayState="cookie"> 
<SessionInitiator type="SAML2" defaultACSIndex="1" 
acsByIndex="false" template="bindingTemplate.html" /> 
<SessionInitiator type="Shib1" defaultACSIndex="5" /> 
<SessionInitiator type="SAMLDS" 
URL="https://my-ds-server.rnp.br/WAYF" /> 
</SessionInitiator> 

<md:AssertionConsumerService Location="/SAML2/POST" 
index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" /> 
<md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" 
index="2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" /> 
<md:AssertionConsumerService Location="/SAML2/Artifact" 
index="3" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" /> 
<md:AssertionConsumerService Location="/SAML2/ECP" 
index="4" Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" /> 
<md:AssertionConsumerService Location="/SAML/POST" 
index="5" Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" /> 
<md:AssertionConsumerService Location="/SAML/Artifact" 
index="6" Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" /> 

<LogoutInitiator type="Chaining" Location="/Logout" 
relayState="cookie"> 
<LogoutInitiator type="SAML2" template="bindingTemplate.html" /> 
<LogoutInitiator type="Local" /> 
</LogoutInitiator> 

<md:SingleLogoutService Location="/SLO/SOAP" 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" /> 
<md:SingleLogoutService Location="/SLO/Redirect" 
conf:template="bindingTemplate.html" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" /> 
<md:SingleLogoutService Location="/SLO/POST" 
conf:template="bindingTemplate.html" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" /> 
<md:SingleLogoutService Location="/SLO/Artifact" 
conf:template="bindingTemplate.html" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" /> 

<md:ManageNameIDService Location="/NIM/SOAP" 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" /> 
<md:ManageNameIDService Location="/NIM/Redirect" 
conf:template="bindingTemplate.html" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" /> 
<md:ManageNameIDService Location="/NIM/POST" 
conf:template="bindingTemplate.html" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" /> 
<md:ManageNameIDService Location="/NIM/Artifact" 
conf:template="bindingTemplate.html" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" /> 

<md:ArtifactResolutionService Location="/Artifact/SOAP" 
index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" /> 

<Handler type="MetadataGenerator" Location="/Metadata" 
signing="false" /> 

<Handler type="Status" Location="/Status" acl="127.0.0.1" /> 

<Handler type="Session" Location="/Session" 
showAttributeValues="false" /> 

</Sessions> 
... 
<CredentialResolver type="File" 
key="/etc/certs/host1.rnp.br.key" certificate="/etc/certs/host1.rnp.br.crt" 
keyName="host1.rnp.br" /> 

<ApplicationOverride id="app2" 
entityID="https://host2.rnp.br" homeURL="https://host2.rnp.br" 
REMOTE_USER="inetOrgPerson-mail uid eppn persistent-id targeted-id"> 
<CredentialResolver type="File" 
key="/etc/certs/host2.rnp.br.key" certificate="/etc/certs/host2.rnp.br.crt" 
keyName="host2.rnp.br" /> 
</ApplicationOverride> 
(I have pasted only what I believe is relevant, if something else is needed please let me know) 

Now, this has been published successfully in the Federation - albeit /Shibboleth.sso/Metadata returns same entityId and ID attributes when requested from host1 and host2), but when I go to https://host2/login and authenticate in the IdP I receive the dreaded No peer endpoint available to which to send SAML response. 

AFAIK, no error is generated in the IdP logs, but in the SP logs, something odd shows up in DEBUG: 

2013-12-12 15:53:42 DEBUG Shibboleth.Listener [3]: dispatching message (host2::getHeaders::Application) 
2013-12-12 15:53:45 DEBUG Shibboleth.Listener [4]: dispatching message (default/DS::run::SAML2SI) 
2013-12-12 15:53:45 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]: validating input 
2013-12-12 15:53:45 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]: marshalling, deflating, base64-encoding the message 
2013-12-12 15:53:45 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]: marshalled message: 
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://host2.rnp.br/Shibboleth.sso/SAML2/POST" Destination="https://my-idp/idp/profile/SAML2/Redirect/SSO" ID="_fa95447f03ee12345ec5482e161ae94a" IssueInstant="2013-12-12T17:53:45Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"> http://host1.rnp.br </saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest> 
2013-12-12 15:53:45 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]: message encoded, sending redirect to client 

As you can see, the saml:Issuer is the default entityId, not the app2 I tried access to. 


I'm completely stuck here, as is the IdP support team. Any help would be appreciated. 



Paulo Rodrigues 
Coordenador de Projetos 
Tel: +55 (21) 2102-4117 
Cel: +55 (21) 8788-5800 
GSC - Gerência de Sistemas Corporativos - Diretoria de Gestão 
RNP – Rede Nacional de Ensino e Pesquisa 
http://www.rnp.br 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131212/9dec5390/attachment-0001.html