Securing a site that uses mod_rewrite

[Fournier, Danny G]

I'm trying to secure a site that funnels all the requests to a page for
further processing. This page will parse the URL and attempt to find
content in a database/on disk. 

 

For instance :

my.domain.com/path/to/something will rewrite to somepath/00101/index.php
which in turn will look in a database for "path/to/something"

 

I'm trying to access the status page using the following URL (which
matches the handlerURL of my configuration):

my.domain.com/somepath/00101/esas.sso/status.

 

However, I keep getting the following error:

Shibboleth handler invoked at an unconfigured location.

 

Here some snippets of the various files involved.

 

shibboleth2.xml

--------------------

 

<RequestMapper type="Native">

                <RequestMap applicationId="default">

                                <Host name="my.domain.com"
scheme="http">                                             

                                                <!-- protect these -->


                                                <PathRegex regex=".*"
authType="shibboleth" applicationId="client-application2"
requireSession="true" requireSessionWith="Intranet" />

                                </Host>

                </RequestMap>

</RequestMapper>

 

...

 

<!-- Active Directory Override -->

<ApplicationOverride id="client-application2" entityID="urn:here"

                homeURL="http://my.domain.com"

                REMOTE_USER="eppn persistent-id targeted-id"

                signing="true" encryption="false">

                

                <!-- cookieProps adding ;secure will only send cookie
when it's over https. Since we were on http, it didn't send it, creates
a new session and returns us on homeURL instead of where we're going -->

                <Sessions lifetime="7200" timeout="1020"
checkAddress="false"

 
handlerURL="/somepath/00101/esas.sso" handlerSSL="false" 

 
cookieProps=";path=/somepath/00101/"

 
exportLocation="http://localhost/esas.sso/getassertion"
exportACL="127.0.0.1"

                                                  idpHistory="false"
idpHistoryDays="7">

                                <md:AssertionConsumerService
Location="/saml2/post" index="1"

 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>

                </Sessions>

                <Errors globalLogout="globalLogoutRedirect.html"

 
extGlobalLogoutUrl="{postLogoutURL}"/>

                                   

                <!-- if SLO is supported, configure notify URL below -->

                <!--Notify Channel="front"
Location="{logoutNotifyURL}"/-->

</ApplicationOverride>

 

 

 

.htaccess

-----------

 

RewriteRule     ^somepath/(.*).php     somepath/00101/index.php
[NC,L,QSA]

 

RewriteCond     %{REQUEST_FILENAME}     !-f

RewriteCond     %{REQUEST_FILENAME}     !-d

 

RewriteRule     (.*)         somepath/00101/index.php [L,QSA]

 

 

httpd.conf

-------------

 

<VirtualHost *:80>

                <Location />

                                AuthType shibboleth

                                require shibboleth

                                ShibUseHeaders On

                </Location>

</VirtualHost>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130515/c3155251/attachment-0001.html