SP Request not redirecting to IDP

[junaid.akbar at wipro.com]

Hi,

I am trying to implement following scenario,

1. User will access specific URL e.g. mydomain.domain.com
2. Apache receive this request and based on entityID https://mydomain.domain.com, user should be redirected to IDP URL.
3- Once User authenticated, IDP returned with SAML Token and Apache/Shibboleth should allow user to access actual contents e.g. https://mydomain.domain.com pass SAML authentication because of Akamai authentication token.

I have following questions if someone can help me here,

- I am using a domain name e.g. https://mydomain.domain.com and I used it as entityID, do I need to use following URL as 'https://mydomain.domain.com/shibboleth?

- I am using external IDP and they provided me metadata which I have copied in /etc/shibboleth/. I used following configuration to define this metadata but what URL I should use and entityID under SSO? When I have defined metadata file then do I really need to define entityID under <sso?

- Few documentations saying that use this type of url, https://myidp.domain.com/idp/shibboleth? We have different URL in metadata than why we need to define it here?

- After defining all these property how request will route to idp once use hit https://mydomain.domain.com?


<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">

<ApplicationDefaults entityID="https://mydomain.domain.com"
REMOTE_USER="eppn persistent-id targeted-id">

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true" cookieProps="https">

<SSO entityID="https://mydomain.domain.com">
SAML2 SAML1
</SSO>

<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>

<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="false"/>

<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>

<Errors supportContact="root at localhost"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>


<!-- Example of locally maintained metadata. -->
<MetadataProvider type="XML" file="saml20_BP_metadata_TFIM_UAT_22AUG2013.xml"/>

<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

<!-- Use a SAML query if no attributes are supplied during SSO. -->
<AttributeResolver type="Query" subjectMatch="true"/>

<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>


<ApplicationOverride id="aralappid" entityID="https://mydomain.domain.com">
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationOverride>

</ApplicationDefaults>

<!-- Policies that determine how to process and authenticate runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

<!-- Low-level configuration about protocols and bindings available for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>


- I have multiple virtual hosts defined in vhost.conf and would like to trigger shibboleth for one virtual host? I have defined following in vhost.conf file.

<Location />
AuthType shibboleth
ShibCompatWith24 On
ShibRequestSetting requireSession 1
require shib-session
</Location>

Can some one help me here.



Kind Regards,
Junaid Akbar


On 18/08/2014 14:27, "Cantor, Scott" <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

On 8/18/14, 4:42 AM, "junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>" <junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>>
wrote:

Can some one help me to correctly configure shibboleth so that specific
virtual host can be redirected to out idp. Please share values or
properties trigger this redirection?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. 

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

www.wipro.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140820/a16c0510/attachment-0001.html