Looping issue where no cookies are being sent in the response

[Bradley Wagner]

Ha, now I'm confused again.

I just tried removing the:

<Location /Shibboleth.sso>
  Require all granted
</Location>

altogether and everything worked.

All URLs were protected by Shibboleth and proxied to my Tomcat app (once a
valid Shibb session was established) *except* for /Shibboleth.sso/* even
though I wasn't explicitly exposing those.

Is the Apache module smart enough to know how to do this on its own? This
is my entire working config at this point.

LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so

<VirtualHost *:443>
  ServerName blah.cascadeserver.com
  SSLEngine on
  SSLProxyEngine on
  SSLProtocol all
  SSLCertificateFile /path/to/crt
  SSLCertificateKeyFile /path/to/key
  SSLCertificateChainFile /path/to/intermediate.crt

  <Location />
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    Require valid-user
  </Location>

  ProxyPass / ajp://localhost:8009/
  ProxyPassReverse / ajp://localhost:8009/
</VirtualHost>


On Mon, Nov 4, 2013 at 6:09 PM, Bradley Wagner <
bradley.wagner at hannonhill.com> wrote:

> Hi Scott,
>
> You're absolutely right! I was able to verify that indeed the
> /Shibboleth.sso* URLs were not being handled by the module. So while the
> IdP was correctly redirecting me to "POST
> myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST", it was my app and
> not the shibboleth module that was responding.
>
> I'm using Apache 2.2 and Shibboleth 2.5.2. I was trying to protect all
> resources from the root "/" excluding "/Shibboleth.sso*".
>
> I took the syntax for excluding /Shibboleth.sso directly from the
> apache22.config file that was created when I built shibboleth.
>
> But I had to change it from:
>
> <Location /Shibboleth.sso>
>   Satisfy Any
>   Allow from all
> </Location>
>
> to:
>
> <Location /Shibboleth.sso>
>   Require all granted
> </Location>
>
> and I'm not exactly sure why.
>
> Perhaps the former only works when you're protecting specific resources
> ("/protected") instead of the root? Or maybe it's something odd in my
> Apache configuration.
>
> Regardless, works now. Thanks for the help.
>
> Moral of the story is to make sure that the /Shibboleth.sso handlers are
> accessible. I know /Shibboleth.sso/Status is only accessible from localhost
> but it looks like /Shibboleth.sso/Session is a good one to test.
>
>
> On Mon, Nov 4, 2013 at 4:53 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 11/4/13, 2:46 PM, "Bradley Wagner" <bradley.wagner at hannonhill.com>
>> wrote:
>>
>> >Hi, I'm running into a loop problem with Shibboleth over SSL. But it
>> >doesn't appear to be any of the usual issues that people run into.
>> >Basically, it looks like the /Shibboleth.sso/SAML2/POST request is not
>> >sending a cookie in the response and therefore
>> > not setting a cookie in the browser and so I get stuck in an
>> >authentication loop.
>>
>> There's no POST period. Whatever you think you see, that isn't it. There
>> is no logging indicating it ever processes the POST. So by definition no
>> cookie.
>>
>> >- POST
>> >https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST
>>
>> If you see that, then you have the SP only partly configured because the
>> *SP* isn't seeing that. Your web server isn't handing that off to my code.
>>
>> I suspect because you're ProxyPassing everything and not excluding
>> /Shibboleth.sso. You can't do that.
>>
>> >I'm surprised I'm not seeing any logging about it unpacking the
>> >SAMLResponse and extracting the attributes. Is that to be expected?
>>
>> Nope.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131104/e5449821/attachment.html