query about SP behavior ...

[Steven Carmody]

Hi,

I have a 2.5.2 SP. It works wonderfully, except that in one case the 
Shib flow seems to be getting interrupted.

There are two Shib-protected resources:

-- one is the standard /secure/info.php . That works correctly.

-- the other is a simple php script. There are two copies. One is 
unprotected; after you click submit it POSTs to the other copy at 
/secure . This goes correctly to the DS, and then IDP; when the IDP 
POSTs to Shibboleth.sso/SAML2/POST , however, the flow stops.

I have two LIVE HTTP HEADERS traces:

http://stc.cis.brown.edu/~stc/info-php-trace.txt

http://stc.cis.brown.edu/~stc/postdata-trace.txt

Here's the sessions element from the shibboleth2.xml file:

         <Sessions lifetime="28800" timeout="3600" checkAddress="false"
                   relayState="ss:mem" handlerSSL="false"
                   postData="ss:mem" postTemplate="postTemplate.html" >

One thing I've noticed, when looking in the trace at the POSTs from the 
IDP back to the SP, is that there's a slight difference in the set of 
cookies being provided (info.php first):

Cookie: 
SESSab910f4627e1b10f3f8698799971071a=7362f8b7ea5cdeb7ea5d69392e635543; 
SESS8d6e650b96809c3e145728c896a58284=82ef012e9c9ab41c73c16a2ced077ed8; 
SESSedce72cc6697d92cd723795b7154e83b=2c19b7a685261a95dfb6fe6f826f7e2a; 
SESSf7a59d95e76744e0daf637919d816370=8ba3c161b8575977dcd909f06172cd73; 
ezproxy=nEuDYmOAqBZH5Ft; 
BrownTicketReturnInfo=http://www.brown.edu/information-technology/modules/user/user.css%3f4; 
_saml_idp=aHR0cHM6Ly9zdGMtdGVzdDE2LmNpcy5icm93bi5lZHUvaWRwL3NoaWJib2xldGg%3D



Cookie: 
SESSab910f4627e1b10f3f8698799971071a=7362f8b7ea5cdeb7ea5d69392e635543; 
SESS8d6e650b96809c3e145728c896a58284=82ef012e9c9ab41c73c16a2ced077ed8; 
SESSedce72cc6697d92cd723795b7154e83b=2c19b7a685261a95dfb6fe6f826f7e2a; 
SESSf7a59d95e76744e0daf637919d816370=8ba3c161b8575977dcd909f06172cd73; 
ezproxy=nEuDYmOAqBZH5Ft; 
BrownTicketReturnInfo=http://www.brown.edu/information-technology/modules/user/user.css%3f4; 
_shibpost_71b1228d04b11f6e71a928bc121fc3f4fd0eab4a80e0e6813eaefc4c679c6e46=ss:mem:613b61b5d4c785616aa58f60f575fd3cb68c9786672d2ed8f0c78be41b8956ef; 
_saml_idp=aHR0cHM6Ly9zdGMtdGVzdDE2LmNpcy5icm93bi5lZHUvaWRwL3NoaWJib2xldGg%3D

I'm stumped as to why the flow with the PHP script stops -- any thoughts 
or suggestions ?

Thanks!