application override not working on some clients

[Archuleta, Marc]

When I removed "ShibRequestSetting applicationId default" from  the location element it broke. I was not able to get to the login screen on the www vhost. I've moved this declaration into this:
<Location />
                ShibRequestSetting applicationId default
</Location>

I've also removed this declaration for the other host and created:

<Location />
                ShibRequestSetting applicationId <vhostappid>
</Location>

In the transaction.log I don't see any sessions created since this morning. Since I can't even get to the login screen on my phone I don't see anything appearing in the logs. I think the phone just hangs.
However, when I try to access the resource from my computer I do get to the login screen and I see this in shib.log:

2014-06-06 14:19:32 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]: marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://<vhost>.psy.ohio-state.edu/Shibboleth.sso/SAML2/POST" Destination="https://webauth.service.ohio-state.edu/idp/profile/SAML2/Redirect/SSO" ID="_f0441ea9ac83b047e7835c655c58fe27" IssueInstant="2014-06-06T18:19:32Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https:// <vhost>.psy.ohio-state.edu/shibboleth</saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest>
2014-06-06 14:19:32 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]: message encoded, sending redirect to client

The default also shows /Shibboleth.sso/SAML2/POST in the logs when being redirected to the login screen.

The behavior on my phone and on the student Mac laptop that I observed seems to be more like hanging rather than looping. 
Can you recommend a good tool to profile what's happening on my android phone? If not, what would you recommend I try on the student laptop?

Thanks,
Marc


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, June 06, 2014 12:19 PM
To: Shib Users
Subject: RE: application override not working on some clients

> Thanks Scott, this is very helpful. Our Shibboleth2.xml had been on an 
> IIS machine before my time and so I think that's why we had path 
> statements in the RequestMap element. I've now commented out the 
> RequestMap section, removed the .htaccess file and have created 
> <Location> blocks in the apache config as such:
> <Location /path/to/secure/resource>
>         ShibRequestSetting applicationId default

Don't do that. Firstly, default is always the default, so you never need to specify it. But in addition, you cannot just override paths like that, because that will break it. If that's a true override, and you're overriding the whole vhost, then you MUST apply that setting to the whole vhost, otherwise the requests to /Shibboleth.sso will not override, and you'll loop.

But everybody will loop, not just somebody's phone.

> <Location /path/to/secure/resource>
>         ShibRequestSetting applicationId <vhostappid>

Right, so that will break it. The settng there has to be applied to Location /

> Everything is working as it had before but I still find it the second 
> <vhostappid> item hanging on my android phone so I presume that will 
> be the case for the others that encountered this problem.

As defined there, it should loop for everybody. The POST back to /Shibboleth.sso/SAML2/POST will bind to the default application, and then the request to the original resource will not have a session valid for that applicationId, and it will loop back to the IdP, and then rinse and repeat.

That said, make sure it's a loop by checking the logs and who should see many sessions created in the transaction.log for your address in a short timespan.

If it's not a loop, then you need to figure out what URL it's actually requesting, because that URL must be hung or not connecting.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net