SP Request not redirecting to IDP

Wed Aug 20 10:23:56 EDT 2014

Do you have answers to my other questions regarding shibboleth2.xml?

Kind Regards,
 Junaid Akbar

From: Dave Perry <Dave.Perry at hull-college.ac.uk<mailto:Dave.Perry at hull-college.ac.uk>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Wednesday, 20 August 2014 15:15
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: SP Request not redirecting to IDP

Here are the lines we use to protect one of our SPs (Moodle) using Apache (from httpd.conf), slightly anonymized:

<VirtualHost  server.ip.address:80>
                ServerName subdomain.yourdomain.com
               DocumentRoot d:/path/to/files
                AcceptPathInfo On

(the next bit says ‘if there is a shibboleth session, the entire vhost can access it: )
<Location />
                AuthType shibboleth
                Require shibboleth
</Location>

(the next bit forces a shibboleth session if you go to this page: )
<Location  /auth/shibboleth/index.php>
        AuthType shibboleth
        ShibRequireSession On
        require valid-user
</Location>

</VirtualHost>

HTH
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net] On Behalf Of junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>
Sent: 20 August 2014 14:51
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: Re: SP Request not redirecting to IDP

Hi,

I am trying to implement following scenario,

1. User will access specific URL e.g. mydomain.domain.com
2. Apache receive this request and based on entityID https://mydomain.domain.com, user should be redirected to IDP URL.
3- Once User authenticated, IDP returned with SAML Token and Apache/Shibboleth should allow user to access actual contents e.g. https://mydomain.domain.com pass SAML authentication because of Akamai authentication token.

I have following questions if someone can help me here,

- I am using a domain name e.g. https://mydomain.domain.com and I used it as entityID, do I need to use following URL as 'https://mydomain.domain.com/shibboleth?

- I am using external IDP and they provided me metadata which I have copied in /etc/shibboleth/. I used following configuration to define this metadata but what URL I should use and entityID under SSO? When I have defined metadata file then do I really need to define entityID under <sso?

- Few documentations saying that use this type of url, https://myidp.domain.com/idp/shibboleth? We have different URL in metadata than why we need to define it here?

- After defining all these property how request will route to idp once use hit https://mydomain.domain.com?

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">

<ApplicationDefaults entityID="https://mydomain.domain.com"
REMOTE_USER="eppn persistent-id targeted-id">

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true" cookieProps="https">

<SSO entityID="https://mydomain.domain.com">
SAML2 SAML1
</SSO>

<Logout>SAML2 Local</Logout>

<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

<Handler type="Session" Location="/Session" showAttributeValues="false"/>

<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>

<Errors supportContact="root at localhost"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>

<MetadataProvider type="XML" file="saml20_BP_metadata_TFIM_UAT_22AUG2013.xml"/>

<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

<AttributeResolver type="Query" subjectMatch="true"/>

<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

<ApplicationOverride id="aralappid" entityID="https://mydomain.domain.com">
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationOverride>

</ApplicationDefaults>

<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>

- I have multiple virtual hosts defined in vhost.conf and would like to trigger shibboleth for one virtual host? I have defined following in vhost.conf file.

<Location />
AuthType shibboleth
ShibCompatWith24 On
ShibRequestSetting requireSession 1
require shib-session
</Location>

Can some one help me here.

Kind Regards,
Junaid Akbar

On 18/08/2014 14:27, "Cantor, Scott" <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

On 8/18/14, 4:42 AM, "junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>" <junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>>
wrote:

Can some one help me to correctly configure shibboleth so that specific
virtual host can be redirected to out idp. Please share values or
properties trigger this redirection?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments.

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

www.wipro.com<http://www.wipro.com>

________________________________
This message is sent in confidence for the addressee only.  It may contain confidential or sensitive information.  The contents are not to be disclosed to anyone other than the addressee.  Unauthorised recipients are requested to preserve this confidentiality and to advise us of any errors in transmission.  Any views expressed in this message are solely the views of the individual and do not represent the views of the College.  Nothing in this message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
________________________________

The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. 

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

www.wipro.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140820/e1e04761/attachment-0001.html 