Shibboleth Setup works on windows - on Linux redirect loop at /idp/profile/SAML2/Redirect/SSO

[Peter Schober]

* morph3us87 at web.de <morph3us87 at web.de> [2013-10-03 14:42]:
> sorry for the html mail, it was the default setting from webmail
> :/. Hope it is now only text :)

It doesn't need to be "only text". Just not "only HTML".

> I know. But Windows 7 is also not supported, and it works. I think
> the OS should also work. I installed sp via apt-get. So I think
> somebody tested the sp in ubuntu.

It's in "universe" so probably just copied over from Debian.
Anyway.

> I'm using SSL with self generated certificates.
> 
> My cookieProps line:
> 
> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" handlerURL="http://111.11.11.1/Shibboleth.sso" checkAddress="false" handlerSSL="false" cookieProps="http">

So you're not setting the SP session cookie to secure, so any use of
TLS/SSL /should/ be irrelevant (which is the most likely source of
such errors).
Btw, is there a speicifc reason you have changed from the default
handlerURL value?

> I'm not really sure about all the settings. At the end I want ssl at
> every site. I created certificates for apache and tomcat (idp
> created it itself).

The IdP does not create a TLS/SSL certificate for you. The one it
creates has nothing to do with TLS/SSL and and such with the topic at
hand (looping).

> I found sometimes a hint to change handlerSSL=true and
> cookieProps="; path=/; secure", but did not work for me. But maybe
> it would work for me and I have to change so other lines also, no
> idea :(

Guessing what configuration means and does and trying out things
purely empirically is not the best way to spend your time. Use the
documentation. Use the log files (the documentation states which and
what to look for). Use your browsers features (e.g. Firefox's Live
HTTP Header or SAMLtracer) to trace the requests. Looping mostly comes
from HTTP Cookie issues, which in turn come from TLS or hostname issues.
-peter