Looping issue where no cookies are being sent in the response

Mon Nov 4 14:46:52 EST 2013

Hi, I'm running into a loop problem with Shibboleth over SSL. But it
doesn't appear to be any of the usual issues that people run into.
Basically, it looks like the /Shibboleth.sso/SAML2/POST request is not
sending a cookie in the response and therefore not setting a cookie in the
browser and so I get stuck in an authentication loop.

I've reviewed the [looping page](
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLooping) and
[flows and config](
https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig).

I've verified that all of my requests are happening over SSL.

I'm seeing the following requests:

- GET https://myserver.cascadeserver.com - redirects to IDP
- GET https://idp.school.edu - sets _idp_authn_lc_key cookie for
idp.blah.com
- POST https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST - post
data includes a RelayState and a SAMLResponse but the server response
doesn't set a cookie. It does include a redirect to my "target"
https://myserver.cascadeserver.com/login.act
- GET https://myserver.cascadeserver.com - because no cookie was set during
the POST, none is passed in this request and again no cookie is set in the
response

 and then it goes back to the IDP and loops indefinitely.

I've set both shibd.logger and native.logger root category to DEBUG and
attached the logging from 3 cycles of the loop below.

I'm surprised I'm not seeing any logging about it unpacking the
SAMLResponse and extracting the attributes. Is that to be expected?

I'm not seeing any problems per se. The main "symptom" is that the cookies
are not getting sent in the response, not being set in my browser and thus
not being sent in the subsequent requests.

Thanks!

shibd.log

2013-11-04 14:35:02 DEBUG Shibboleth.Listener [1]: dispatching message
(default/Login::run::SAML2SI)
2013-11-04 14:35:02 DEBUG XMLTooling.StorageService [1]: inserted record
(0f9eddbece19507bdf266a30e335ae15a8c5ab30fd43990a9d11c72dae0c480e) in
context (RelayState) with expiration (1383594302)
2013-11-04 14:35:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
validating input
2013-11-04 14:35:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
marshalling, deflating, base64-encoding the message
2013-11-04 14:35:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="
https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST" Destination="
https://idp.school.edu/idp/profile/SAML2/Redirect/SSO"
ID="_333270a428b0ef2cebaabc0493d38a76" IssueInstant="2013-11-04T19:35:02Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
https://myserver.cascadeserver.com/shibboleth</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest>
2013-11-04 14:35:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
message encoded, sending redirect to client
2013-11-04 14:35:03 DEBUG Shibboleth.Listener [1]: dispatching message
(default/Login::run::SAML2SI)
2013-11-04 14:35:03 DEBUG XMLTooling.StorageService [1]: inserted record
(dc774a67d7c09ceddcdcecfcd61205c61edfb9439e13490ae55641968225f166) in
context (RelayState) with expiration (1383594303)
2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
validating input
2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
marshalling, deflating, base64-encoding the message
2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="
https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST" Destination="
https://idp.school.edu/idp/profile/SAML2/Redirect/SSO"
ID="_51062bd5050319691cb4850db5c227b0" IssueInstant="2013-11-04T19:35:03Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
https://myserver.cascadeserver.com/shibboleth</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest>
2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
message encoded, sending redirect to client
2013-11-04 14:35:03 DEBUG Shibboleth.Listener [1]: dispatching message
(default/Login::run::SAML2SI)
2013-11-04 14:35:03 DEBUG XMLTooling.StorageService [1]: inserted record
(5cbe51db3513eb20a5e825f8b3d0789f1a30c0720fb0d3d6ff89ad43996fb269) in
context (RelayState) with expiration (1383594303)
2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
validating input
2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
marshalling, deflating, base64-encoding the message
2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="
https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST" Destination="
https://idp.school.edu/idp/profile/SAML2/Redirect/SSO"
ID="_86341d1ac119e7f14359d1f4194eb857" IssueInstant="2013-11-04T19:35:03Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
https://myserver.cascadeserver.com/shibboleth</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest>
2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]:
message encoded, sending redirect to client

native.log

2013-11-04 14:35:02 DEBUG Shibboleth.Apache [16087] shib_check_user: mapped
https://myserver.cascadeserver.com/ to default
2013-11-04 14:35:02 DEBUG Shibboleth.SessionInitiator.SAML2 [16087]
shib_check_user: attempting to initiate session using SAML 2.0 with
provider (https://idp.school.edu/idp/shibboleth)
2013-11-04 14:35:02 DEBUG Shibboleth.Listener [16087] shib_check_user:
sending message (default/Login::run::SAML2SI)
2013-11-04 14:35:02 DEBUG Shibboleth.Listener [16087] shib_check_user: send
completed, reading response message
2013-11-04 14:35:03 DEBUG Shibboleth.Apache [16087] shib_check_user: mapped
https://myserver.cascadeserver.com/login.act to default
2013-11-04 14:35:03 DEBUG Shibboleth.SessionInitiator.SAML2 [16087]
shib_check_user: attempting to initiate session using SAML 2.0 with
provider (https://idp.school.edu/idp/shibboleth)
2013-11-04 14:35:03 DEBUG Shibboleth.Listener [16087] shib_check_user:
sending message (default/Login::run::SAML2SI)
2013-11-04 14:35:03 DEBUG Shibboleth.Listener [16087] shib_check_user: send
completed, reading response message
2013-11-04 14:35:03 DEBUG Shibboleth.Apache [16087] shib_check_user: mapped
https://myserver.cascadeserver.com/login.act to default
2013-11-04 14:35:03 DEBUG Shibboleth.SessionInitiator.SAML2 [16087]
shib_check_user: attempting to initiate session using SAML 2.0 with
provider (https://idp.school.edu/idp/shibboleth)
2013-11-04 14:35:03 DEBUG Shibboleth.Listener [16087] shib_check_user:
sending message (default/Login::run::SAML2SI)
2013-11-04 14:35:03 DEBUG Shibboleth.Listener [16087] shib_check_user: send
completed, reading response message

Here's my Apache config:

LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so

# Ensures handler will be accessible.
<Location /Shibboleth.sso>
  Satisfy Any
  Allow from all
</Location>

ProxyIOBufferSize 65536

<VirtualHost *:80>
  RewriteEngine on
  RewriteRule ^(.*)$ https://myserver.cascadeserver.com$1 [R=301,L]
</VirtualHost>

<VirtualHost *:443>
  ServerName  myserver.cascadeserver.com
  SSLEngine on
  SSLProxyEngine on
  SSLProtocol all
  SSLCertificateFile /path/to/crt
  SSLCertificateKeyFile /path/to/key
  SSLCertificateChainFile /path/to/intermediate_crt
  <Location />
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    require valid-user
  </Location>

  ProxyPass / ajp://localhost:8009/
  ProxyPassReverse / ajp://localhost:8009/
</VirtualHost>

Here's my shibboleth2.xml file:

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">

    <ApplicationDefaults entityID="
https://myserver.cascadeserver.com/shibboleth"
                         REMOTE_USER="eppn uid persistent-id targeted-id"
                         attributePrefix="AJP_">

        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true"
cookieProps="https">

            <SSO entityID="https://idp.school.edu/idp/shibboleth">
              SAML2
            </SSO>
            <Logout>SAML2 Local</Logout>
            <Handler type="MetadataGenerator" Location="/Metadata"
signing="false"/>
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
            <Handler type="Session" Location="/Session"
showAttributeValues="false"/>
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

        <Errors supportContact="support at hannonhill.com"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>

        <MetadataProvider type="XML" uri="
https://idp.school.edu/idp-metadata.xml"
              reloadInterval="7200"
              backingFilePath="example-metadata.xml">
        </MetadataProvider>

        <AttributeExtractor type="XML" validate="true"
reloadChanges="false" path="attribute-map.xml"/>

        <AttributeResolver type="Query" subjectMatch="true"/>
        <AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/>

        <!-- CredentialResolver type="File" key="/path/to/key"
certificate="/path/to/crt" / -->
    </ApplicationDefaults>

    <SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>
    <ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>
</SPConfig>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131104/bf1993d5/attachment-0001.html 