IIS 7.5 Server behind an F5 Reverse Proxy

[Meiselman, Ellen]

This weekend I located some issues with the SP metadata (http instead of https on some of the handler entries) but when that was corrected it still did not fix the looping. I've checked screenshots of the IdP's settings page for my SP, and I can't detect any issues with his settings.

So today we went through and examined every bit of the network requests and cookies from a login attempt.

We didn't find any smoking guns until we changed the relayState setting to "cookie" and inspected the value of the cookie. It turns out there is alway a double slash after the "content" part of the path:

     https://proxyserver.com/content//whatever

for example:

     https://proxyserver.com/content//Shibboleth.sso

     https://proxyserver.com/content//mycontent.htm

There are absolutely no trailing slashes after the word "content" in shibboleth2.xml.


I am thinking this has something to do with the reverse proxy mapping settings or with my IIS settings. So I have two questions:

A. Do you think the extra slash in path in the cookie value might cause the looping problem?

B. Where would you start to look for the cause?


Thanks for your help,

Ellen



On Aug 22, 2014, at 7:08 PM, Cantor, Scott wrote:

On 8/22/14, 4:30 PM, "Meiselman, Ellen" <emeiselm at med.umich.edu<mailto:emeiselm at med.umich.edu>> wrote:

I need help with the best practice for debugging the looping behavior.
I'm not sure what to look for in particular.

Step 0: Check all logs and rule out the cookie being sent at the end but
the session being invalidated for some reason. Assuming no sign of that,
the cookie's not sent.

Step 1: Read, and fully grasp, the flows and cookies used [1].

Step 2: Trace all the traffic and find the spot where the cookie is
dropped.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

______________________________
Ellen Meiselman
University of Michigan Health System
MLearning
NCRC
2800 Plymouth Rd.
Building 200, Rm 207
Ann Arbor, MI 48109-2800
E-Mail:  emeiselm at umich.edu<mailto:emeiselm at umich.edu>
Phone (734) 936-2334

**********************************************************
Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140825/e4f9a1fe/attachment.html