SP Request not redirecting to IDP

[Dave Perry]

Here are the lines we use to protect one of our SPs (Moodle) using Apache (from httpd.conf), slightly anonymized:

<VirtualHost  server.ip.address:80>
                ServerName subdomain.yourdomain.com
               DocumentRoot d:/path/to/files
                AcceptPathInfo On

(the next bit says 'if there is a shibboleth session, the entire vhost can access it: )
<Location />
                AuthType shibboleth
                Require shibboleth
</Location>

(the next bit forces a shibboleth session if you go to this page: )
<Location  /auth/shibboleth/index.php>
        AuthType shibboleth
        ShibRequireSession On
        require valid-user
</Location>

</VirtualHost>

HTH
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of junaid.akbar at wipro.com
Sent: 20 August 2014 14:51
To: users at shibboleth.net
Subject: Re: SP Request not redirecting to IDP

Hi,

I am trying to implement following scenario,

1. User will access specific URL e.g. mydomain.domain.com
2. Apache receive this request and based on entityID https://mydomain.domain.com, user should be redirected to IDP URL.
3- Once User authenticated, IDP returned with SAML Token and Apache/Shibboleth should allow user to access actual contents e.g. https://mydomain.domain.com pass SAML authentication because of Akamai authentication token.

I have following questions if someone can help me here,

- I am using a domain name e.g. https://mydomain.domain.com and I used it as entityID, do I need to use following URL as 'https://mydomain.domain.com/shibboleth?

- I am using external IDP and they provided me metadata which I have copied in /etc/shibboleth/. I used following configuration to define this metadata but what URL I should use and entityID under SSO? When I have defined metadata file then do I really need to define entityID under <sso?

- Few documentations saying that use this type of url, https://myidp.domain.com/idp/shibboleth? We have different URL in metadata than why we need to define it here?

- After defining all these property how request will route to idp once use hit https://mydomain.domain.com?


<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">

<ApplicationDefaults entityID="https://mydomain.domain.com"
REMOTE_USER="eppn persistent-id targeted-id">

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true" cookieProps="https">

<SSO entityID="https://mydomain.domain.com">
SAML2 SAML1
</SSO>

<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>

<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="false"/>

<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>

<Errors supportContact="root at localhost"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>


<!-- Example of locally maintained metadata. -->
<MetadataProvider type="XML" file="saml20_BP_metadata_TFIM_UAT_22AUG2013.xml"/>

<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

<!-- Use a SAML query if no attributes are supplied during SSO. -->
<AttributeResolver type="Query" subjectMatch="true"/>

<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>


<ApplicationOverride id="aralappid" entityID="https://mydomain.domain.com">
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationOverride>

</ApplicationDefaults>

<!-- Policies that determine how to process and authenticate runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

<!-- Low-level configuration about protocols and bindings available for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>


- I have multiple virtual hosts defined in vhost.conf and would like to trigger shibboleth for one virtual host? I have defined following in vhost.conf file.

<Location />
AuthType shibboleth
ShibCompatWith24 On
ShibRequestSetting requireSession 1
require shib-session
</Location>

Can some one help me here.



Kind Regards,
Junaid Akbar


On 18/08/2014 14:27, "Cantor, Scott" <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

On 8/18/14, 4:42 AM, "junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>" <junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>>
wrote:

Can some one help me to correctly configure shibboleth so that specific
virtual host can be redirected to out idp. Please share values or
properties trigger this redirection?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments.

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

www.wipro.com<http://www.wipro.com>

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140820/4513480b/attachment-0001.html