SP Request not redirecting to IDP

[Dave Perry]

Last version was too big apparently...

From: Dave Perry
Sent: 21 August 2014 09:37
To: 'Shib Users'
Subject: RE: SP Request not redirecting to IDP

Here is our ApplicationDefaults section (which includes pulling in the metadata for our IdP). Hopefully it answers the key one (which I think is how do I always use a specific IdP if trying to shibboleth-login to a site on a vhost?):

    <ApplicationDefaults entityID="https://subdomain.domain.com/shibboleth"
                         REMOTE_USER="eppn persistent-id targeted-id">

        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="false" cookieProps="http">

(our idp lives at domain/idp - yours might not be that way)
            <SSO entityID="https://idp.domain.com/idp/shibboleth">
              SAML2 SAML1
            </SSO>
            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

        <!--
        Allows overriding of error template information/filenames. You can
        also add attributes with values that can be plugged into the templates.
       -->
        <Errors supportContact="email at domain.com<mailto:email at domain.com>"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>

        <!-- Example of remotely supplied batch of signed metadata. -->
(metadata lives in the same folder as shibboleth2.xml)
        <!--Our IdP-->
        <MetadataProvider type="XML" file="idp-metadata.xml"/>


        <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

        <!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>

        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <!-- Simple file-based resolver for using a single keypair. -->
        <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>

    </ApplicationDefaults>

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net] On Behalf Of junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>
Sent: 20 August 2014 15:24
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: Re: SP Request not redirecting to IDP

Do you have answers to my other questions regarding shibboleth2.xml?

Kind Regards,
 Junaid Akbar


From: Dave Perry <Dave.Perry at hull-college.ac.uk<mailto:Dave.Perry at hull-college.ac.uk>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Wednesday, 20 August 2014 15:15
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: SP Request not redirecting to IDP

Here are the lines we use to protect one of our SPs (Moodle) using Apache (from httpd.conf), slightly anonymized:

<VirtualHost  server.ip.address:80>
                ServerName subdomain.yourdomain.com
               DocumentRoot d:/path/to/files
                AcceptPathInfo On

(the next bit says 'if there is a shibboleth session, the entire vhost can access it: )
<Location />
                AuthType shibboleth
                Require shibboleth
</Location>

(the next bit forces a shibboleth session if you go to this page: )
<Location  /auth/shibboleth/index.php>
        AuthType shibboleth
        ShibRequireSession On
        require valid-user
</Location>

</VirtualHost>

HTH
_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *


On 18/08/2014 14:27, "Cantor, Scott" <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

On 8/18/14, 4:42 AM, "junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>" <junaid.akbar at wipro.com<mailto:junaid.akbar at wipro.com>>
wrote:

Can some one help me to correctly configure shibboleth so that specific
virtual host can be redirected to out idp. Please share values or
properties trigger this redirection?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>



**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College owns the email infrastructure, including the contents.

Hull College is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140821/2b226170/attachment-0001.html