Looping issue where no cookies are being sent in the response

[Bradley Wagner]

Hi Scott,

You're absolutely right! I was able to verify that indeed the
/Shibboleth.sso* URLs were not being handled by the module. So while the
IdP was correctly redirecting me to "POST
myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST", it was my app and
not the shibboleth module that was responding.

I'm using Apache 2.2 and Shibboleth 2.5.2. I was trying to protect all
resources from the root "/" excluding "/Shibboleth.sso*".

I took the syntax for excluding /Shibboleth.sso directly from the
apache22.config file that was created when I built shibboleth.

But I had to change it from:

<Location /Shibboleth.sso>
  Satisfy Any
  Allow from all
</Location>

to:

<Location /Shibboleth.sso>
  Require all granted
</Location>

and I'm not exactly sure why.

Perhaps the former only works when you're protecting specific resources
("/protected") instead of the root? Or maybe it's something odd in my
Apache configuration.

Regardless, works now. Thanks for the help.

Moral of the story is to make sure that the /Shibboleth.sso handlers are
accessible. I know /Shibboleth.sso/Status is only accessible from localhost
but it looks like /Shibboleth.sso/Session is a good one to test.


On Mon, Nov 4, 2013 at 4:53 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 11/4/13, 2:46 PM, "Bradley Wagner" <bradley.wagner at hannonhill.com>
> wrote:
>
> >Hi, I'm running into a loop problem with Shibboleth over SSL. But it
> >doesn't appear to be any of the usual issues that people run into.
> >Basically, it looks like the /Shibboleth.sso/SAML2/POST request is not
> >sending a cookie in the response and therefore
> > not setting a cookie in the browser and so I get stuck in an
> >authentication loop.
>
> There's no POST period. Whatever you think you see, that isn't it. There
> is no logging indicating it ever processes the POST. So by definition no
> cookie.
>
> >- POST
> >https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST
>
> If you see that, then you have the SP only partly configured because the
> *SP* isn't seeing that. Your web server isn't handing that off to my code.
>
> I suspect because you're ProxyPassing everything and not excluding
> /Shibboleth.sso. You can't do that.
>
> >I'm surprised I'm not seeing any logging about it unpacking the
> >SAMLResponse and extracting the attributes. Is that to be expected?
>
> Nope.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131104/87009ac5/attachment-0001.html