New Shibboleth daemon on new server - user/wayf page just reloads over and over

[Cantor, Scott]

On 9/12/13 3:58 PM, "Ben Turner" <bturner at educause.edu> wrote:

>So I have made the adjustment you suggested with the version of the shibd
>service.  We're now running 2.5.2 again and the double ampersand has been
>corrected.

Not if the link you sent is the right one.

$ curl -ik 
https://new.educause.edu/Shibboleth.sso/DS?target=https%3A%2F%2Fnew.educaus
e.edu%2Fshib_login%2Fhome


Location: 
https://new.educause.edu/user/wayf?entityID=https%3A%2F%2Fnew.educause.edu%
2Fshibboleth-sp&return=https%3A%2F%2Fnew.educause.edu%2FShibboleth.sso%2FDS
%3FSAMLDS%3D1%26%26target%3Dcookie%253A1379082623_e14a

Linefeeds will mess with that, but if you look, you'll see this:

%3FSAMLDS%3D1%26%26target%3Dcookie%253A1379082623_e14a


That decodes as ?SAMLDS=1&&target=cookie:3A1379082623_e14a

But I verified not only does it not seem to break the code, but when I
manually take it out, it's not making any difference.


>Unfortunately we're still seeing the same behavior and we're still not
>seeing anything indicating an issue in the various log files.

I assume you have logging turned up. I don't know what all the handlers
actually log, but they won't log anything normally.

>Interestingly enough though, now when I restart the daemon service there
>isn't an incommon.xml file created as it was generating it successfully
>when we were using 2.3.1.  Maybe that has some significance?

I seriously doubt that's the case, but your logs would tell you if it
were. I suspect you're just not looking in /var/cache.

Since manually passing an entityID to /Shibboleth.sso/DS isn't working, my
suspicion is you have a broken configuration altogether. You seem to have
inappropriate SessionInitiator behavior here. Basically, you have a broken
config that's full of old syntax you don't need anyway, so try fixing the
problem by modernizing it.

Start with defaults, make only specific, relevant changes, do not create
SessionInitiators, and switch things to use /Shibboleth.sso/Login instead
of the way you're doing it now.

Otherwise I don't know what to tell you, but you can try posting your
SessionInitiator chain from that endpoint I suppose.

-- Scott