Login issue

Thu Jul 4 06:27:59 EDT 2013

Hi Scott and Peter,

I managed to fix the xml issue and, I dont see anymore any error in shibd.log as in other logs. But still
I can't login.  Since I am not seeing any error in my logs, I am quite blocked on what to check and process further.

Any further orientation would be really helpful.

Kind regards

Gilles Rubens Badouet

Student ID: 3940347

Faculty of Engineering and Computing

MSc Network Computing Course

Mobile: 07424486426

________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of users-request at shibboleth.net [users-request at shibboleth.net]
Sent: 03 July 2013 18:18
To: users at shibboleth.net
Subject: users Digest, Vol 25, Issue 20

Send users mailing list submissions to
        users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
        http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
        users-request at shibboleth.net

You can reach the person managing the list at
        users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."

Today's Topics:

   1. RE: Can Shibboleth IdP handle something like Domain/Group?
      (Eric Goodman)
   2. Re: Remote IdP not responding? (Christopher Bongaarts)
   3. RE: shibboleth - stopped working after package update
      (Cantor, Scott)
   4. RE: shibboleth - stopped working after package update
      (Cantor, Scott)
   5. RE: help - multi vhosts with one single IdP configuration
      entry (Cantor, Scott)
   6. RE: Session Closes on Browser Close (Cantor, Scott)
   7. RE: Login issue  (Cantor, Scott)

----------------------------------------------------------------------

Message: 1
Date: Wed, 3 Jul 2013 16:24:02 +0000
From: Eric Goodman <Eric.Goodman at ucop.edu>
Subject: RE: Can Shibboleth IdP handle something like Domain/Group?
To: Shib Users <users at shibboleth.net>
Message-ID:
        <CAAD65CCC876B544AFE2DD38197F758A047E8101 at p-irc-exmbx02.AD.UCOP.EDU>
Content-Type: text/plain; charset="us-ascii"

FWIW, I've actually always run different containers for various reasons (e.g., load testing, allowing devs to shell into test envs but not prod ones). I've found that running multiple shib instances is much easier than running and populating the multiple backend datastores that you're likely to need if you have, e.g., test accounts that you don't want in your prod datastore.

Whether an LDAP, AD, etc. the work we've always run into is around managing that extra datastore. Running the second shib instance has never been that much overhead.

--- Eric

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, July 02, 2013 8:46 PM
To: Shib Users
Subject: RE: Can Shibboleth IdP handle something like Domain/Group?

> When this was proposed to me I hinted at Scott's answer by asking
> whether it would really be any easier to manage one complex instance
> rather than five on separate VMs.  The answer seems to be that it is
> mainly convenient for the server admins; multiple servers for them to
> administer and update versus one server; the more complex application
> layer isn't their problem and I was directed to investigate the possibility.

I didn't mean multiple VMs, I said virtualize the IdP. I don't see why you can't have one container running different copies (or multiple containers I suppose).

> And even that seems to still leave the problem of pulling the
> appropriate set of attributes - that is, the set of "my" attributes
> from the appropriate repository corresponding the service instance I ask to use.

That's down to creative querying and scripting, but like I said, brittle.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------

Message: 2
Date: Wed, 03 Jul 2013 11:32:50 -0500
From: Christopher Bongaarts <cab at umn.edu>
Subject: Re: Remote IdP not responding?
To: users at shibboleth.net
Message-ID: <51D45232.4020004 at umn.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

On 7/1/2013 7:10 PM, Roger Jagoda wrote:
> The only thing remaining is the Session initiation. We protect a page
> on our side (SP) and trigger the Shibboleth session with the usual
> vhost configuration:
>
> <Location /secure/protected.php>
>     AuthType shibboleth
>     ShibRequireSession On
>     require valid-user
>     ShibUseHeaders On
> </Location>
>
>
> What is the best way of forcing the redirection to the appropriate
> URL.

Apologies if this was already answered in a disconnected part of the
thread....

Add this line to your <Location> block:

ShibRequestSetting entityID https://shibboleth.testdb.idp2.edu

The SP will generate the necessary redirects and SAML requests for you.

References:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig

--
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

------------------------------

Message: 3
Date: Wed, 3 Jul 2013 17:01:05 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: shibboleth - stopped working after package update
To: Shib Users <users at shibboleth.net>
Message-ID:
        <BA63CEAE152A7742B854C678D9491383946011DC at CIO-KRC-D1MBX01.osuad.osu.edu>

Content-Type: text/plain; charset="us-ascii"

> My question is: Why the use of Satisfy Any when the login handler is on
> /Shibboleth.sso/Login? My drupal site points its login handler to that location.
> If that Satisfy Any directive is there, it cannot authenticate.

As Peter said, that's not possible, or certainly not correct anyway. Handlers are never protected *by* the SP, they have to run. People were complaining that their root server configs were accidentally blocking access to them.

There is no package issue if a change exposes an incorrect configuration in the first place.

-- Scott

------------------------------

Message: 4
Date: Wed, 3 Jul 2013 17:02:14 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: shibboleth - stopped working after package update
To: Shib Users <users at shibboleth.net>
Message-ID:
        <BA63CEAE152A7742B854C678D9491383946011F5 at CIO-KRC-D1MBX01.osuad.osu.edu>

Content-Type: text/plain; charset="us-ascii"

> This modification causes a redirection loop with an SP of ours. If I
> comment it out, everything works again.

I don't see how that's possible, but would be fascinated to learn how. What is not in doubt is that your SP had an incorrect Apache configuration to start with. If we know in what way, we can document around that.

-- Scott

------------------------------

Message: 5
Date: Wed, 3 Jul 2013 17:04:41 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: help - multi vhosts with one single IdP configuration
        entry
To: Shib Users <users at shibboleth.net>
Message-ID:
        <BA63CEAE152A7742B854C678D94913839460121B at CIO-KRC-D1MBX01.osuad.osu.edu>

Content-Type: text/plain; charset="us-ascii"

> ACS had to be configured in IdP, not in SP.

That's what metadata means, yes.

> This was established by using FQDN handler URL  in SP configuration:

You should NOT do that, in virtually any case. That's a sign you have a misconfigured system to begin with.

-- Scott

------------------------------

Message: 6
Date: Wed, 3 Jul 2013 17:09:23 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: Session Closes on Browser Close
To: Shib Users <users at shibboleth.net>
Message-ID:
        <BA63CEAE152A7742B854C678D949138394601252 at CIO-KRC-D1MBX01.osuad.osu.edu>

Content-Type: text/plain; charset="us-ascii"

> If there are alternatives that /only/ use cookies with an Expires
> attribute that satisfy your needs (in most cases that means
> cross-domain WebSSO with rich attribute support) feel free to use
> that instead.

Heh, this is certainly the first time anybody has complained that Shibboleth sessions are too fragile.

In any case, cookieLifetime has been there since 2.1, you can use it if you really want to set an expiration time for them that goes beyond session.

In fact, I've been meaning to play with that as a means if possibly getting around the Firefox and Chrome nonsense. It seems that "persistent" cookies are now the way to achieve non-persistence.

-- Scott

------------------------------

Message: 7
Date: Wed, 3 Jul 2013 17:17:46 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: Login issue
To: Shib Users <users at shibboleth.net>
Message-ID:
        <BA63CEAE152A7742B854C678D949138394601297 at CIO-KRC-D1MBX01.osuad.osu.edu>

Content-Type: text/plain; charset="us-ascii"

 > I am using 8443 for IdP https access because the standard 443 is already used
> in IIS for my SP.

Which is why we advised not doing this on one host.

> Concerning the current issue, I added <logger
> name="edu.vt.middleware.ldap.jaas.JaasAuthenticator" level="DEBUG" />
> in my logging.xml file
> but still cant see any change in IdP side. In LDAP logs, I cant neither see any
> issue related to IdP.

Then there's a failure occurring before it gets that far.

> I cant see in an SP log file (shibd.log) the following error  messages and would
> like to understand and know how solve it.

Fix the XML in your file. The error is strange looking and is probably an indication you have a namespace error in however you've added the broken element, or possibly have added two elements where only one is permitted.

You should be able to solve errors like that by reading the documentation, which describes the content permitted in those files.

-- Scott

------------------------------

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

End of users Digest, Vol 25, Issue 20
*************************************