Shibboleth SP mod_shib module not handling Shibboleth.sso URLs and looping

[Cantor, Scott]

On 10/14/14, 9:57 AM, "Bradley Wagner" <bradley.wagner at hannonhill.com>
wrote:
>
>I was running into an issue where I ultimately determined that the
>Shibboleth URLs: /Shibboleth.sso/* were not being properly handled by
>Apache. Every request, including the POST request from the IdP, were
>being handled as new requests that required authentication instead of a
>request containing auth information that should have been handled

That means the URL base in question was not treated as the effective
handlerURL for the request. The SP will never impose itself in front of
the handlers unless it doesn't know they're handlers.

>The fix, ironically, was to comment out this section of the mod_shib.conf
>file that shipped with Shibboleth even though the comment says the point
>of that block is ensure the handle will be accessible.

It wasn't my idea to include that material. Other people asked me to. It
has never been necessary for me but apparently it can cause issues whether
it's there or not. But I can say that it cannot cause a redirect to the
IdP, because only the SP itself can do that and it won't decide that based
on Satisfy or Allow commands. The reason those were supposedly needed is
to prevent Apache itself from getting in the way in some cases, but that
would cause local blocking of the requests, not redirects or looping.

>but I could never get the handler to be invoked for the Shibboleth.sso
>URLs. The fix ultimately was to comment out the block in mod_shib.conf at
>which point it magically started working. I didn't even need a block to
>explicitly "SetHandler shib" once that initial block was commented out.

SetHandler is only required in Apache 1.3, it's never been needed since.
Apache 2+ has always been broken in that it runs *every* handler
registered until something responds, and it can't be controlled by MIME
type of URL (this is despite what the docs say). So that's nothing unusual.

I have no idea about the rest, it isn't consistent with anything I
understand about Apache.

If I were to try and debug it, I'd probably be focusing on the more usual
cause of handler issues and debug the RequestMapping process in native.log
and see what it thinks the requests to those handlers looks like.

-- Scott