Shibboleth SP mod_shib module not handling Shibboleth.sso URLs and looping

[Bradley Wagner]

Hi,

I spent the better part of a day troubleshooting this, so I figured it
would be worth getting to the bottom of this.

I was running into an issue where I ultimately determined that the
Shibboleth URLs: /Shibboleth.sso/* were not being properly handled by
Apache. Every request, including the POST request from the IdP, were being
handled as new requests that required authentication instead of a request
containing auth information that should have been handled

I confirmed this by looking a shibd.log and noticed that the message
received during the POST back from the IdP was never being unpacked and was
instead just generating a new authentication redirect to the IdP.

The fix, ironically, was to comment out this section of the mod_shib.conf
file that shipped with Shibboleth even though the comment says the point of
that block is ensure the handle will be accessible.

#
# Ensures handler will be accessible.
#
#<Location /Shibboleth.sso>
#  Satisfy Any
#  Allow from all
#</Location>

When it was uncommented, I tried all all kinds of things including adding a
block to my Virtual Host:

<Location /Shibboleth.sso>
  SetHandler shib
</Location>

but I could never get the handler to be invoked for the Shibboleth.sso
URLs. The fix ultimately was to comment out the block in mod_shib.conf at
which point it magically started working. I didn't even need a block to
explicitly "SetHandler shib" once that initial block was commented out.

Any ideas?

Here are some other details of my config:

I'm using mod_shib in Apache 2.2.17 and Shibboleth 2.5.3.

My /etc/httpd/conf.d/mod_shib.conf file:

LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so

#
# Ensures handler will be accessible.
#
#<Location /Shibboleth.sso>
#  Satisfy Any
#  Allow from all
#  SetHandler shib
#</Location>

#
# Used for example style sheet in error templates.
#
<IfModule mod_alias.c>
  <Location /shibboleth-sp>
    Satisfy Any
    Allow from all
  </Location>
  Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css
</IfModule>

I've got the following VirtualHost set-up in my
/etc/httpd/conf.d/proxies.conf file:

<VirtualHost *:443>
  ServerName ourdomain.com
  SSLEngine on
  SSLProtocol all
  SSLCertificateFile /path/to/crt
  SSLCertificateKeyFile /path/to/key
  SSLCertificateChainFile /path/to/chain

  <Location />
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    require valid-user
  </Location>

  ProxyPass / ajp://localhost:8009/
  ProxyPassReverse / ajp://localhost:8009/
</VirtualHost>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141014/f4754535/attachment.html