application override not working on some clients

[Archuleta, Marc]

I've got a server using shibboleth without any problems on the default virtual host and have recently added an ApplicationOverride for a virtual host which uses a different IP address on the same machine. It is configured in Apache as a virtual host with the ServerName defined and UseCanonicalName set to On for the entire server.

I initially learned that some beta users on Macs could not get to the resource as the page would hang after clicking the link to the page. The server is set to force SSL for the resource but just in case I set the link to have https in it. I was not able to reproduce the issue on other Macs and there was no consistency with the client operating system version or browser, only that if it didn't work in one browser it didn't work in any browser on the same machine. I've since found the issue occurs on my android phone and on at least one iPhone, but not all iPhones.

I suspect the issue is related to my configuration of the ApplicationOverride host, but my understanding is that this behavior is symptomatic of a cookie issue. I've copied and pasted my configurations below. I'd love to trace the cookies but I'm not sure how to do that on my android phone. I do have access to one of the people who has a mac on a limited basis, so I'll try to get fiddler on his machine and figure out how I can see what cookies are being set when I can meet with him. In the meantime, I hope someone can suggest some things to check with my configuration to try to resolve the issue.

Thanks for your help,
Marc


Htaccess file contents for the resource:

AuthType Shibboleth
ShibRequestSetting requireSession On
ShibApplicationId virtual
ShibExportAssertion On
Require shibboleth


Apache setup:

<VirtualHost 1.2.3.4:80>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
DocumentRoot /var/www/html/ virtual /
ServerName virtual.psy.ohio-state.edu
ErrorLog /var/log/virtual-host/virtual /error.log
CustomLog /var/log/virtual-host/virtual /access.log common
</VirtualHost>

<VirtualHost 1.2.3.4:443>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F]
DocumentRoot /var/www/html/virtual/
ServerName virtual.psy.ohio-state.edu:443
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/virtual _psy_ohio-state_edu_cert.cer
SSLCertificateKeyFile /etc/pki/tls/private/www_server.key
ErrorLog /var/log/virtual-host/virtual /error.log
CustomLog /var/log/virtual-host virtual /access.log common
<Location /folder/subfolder/secure/>
        ShibRequestSetting applicationId virtual
</Location>

</VirtualHost>



Shibboleth2.xml setup:

<Host name="www.psy.ohio-state.edu" applicationId="default">
                <Path name="secure" authType="shibboleth" requireSession="true" redirectToSSL="443"/>
                <Path name="somepath">
                        <Path name="folder" authType="shibboleth" requireSession="true" redirectToSSL="443"/>
                </Path>
                <Path name="anotherpath">
                   <Path name="folder">
                         <Path name="subfolder" authType="shibboleth" requireSession="true" redirectToSSL="443"/>
                   </Path>
                </Path>
	Etc...
</Host>

<Host name="virtual.psy.ohio-state.edu" applicationId="virtual">
                 <Path name="folder">
                        <Path name="subfolder">
                                <Path name="secure" authType="shibboleth" requireSession="true" redirectToSSL="443" />
                        </Path>
                </Path>
            </Host>


<ApplicationOverride id="virtual" entityID="https://virtual.psy.ohio-state.edu/shibboleth">
                <Sessions lifetime="28800" timeout="3600" checkAddress="false"
                handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="https" />
</ApplicationOverride>