Shibboleth SP mod_shib module not handling Shibboleth.sso URLs and looping

Tue Oct 14 12:42:50 EDT 2014

> Not the version you’re using but the advice probably still applies:

http://shibboleth.net/pipermail/users/2014-April/015191.html

Thanks. We’re using the RHEL6 packages but it’s possible that we’re running into something similar.

> You cannot use packages on the wrong OS, period.

Understood. I’ll see if packages exist for Amazon Linux and if not, will build them ourselves. Our understanding was that Amazon Linux was a variant of RHEL and that RHEL packages would work.

If you think rebuilding Shibboleth before trying to troubleshoot this further is the way to go, we can certainly do that.

> I would assume that in both cases it should log the creation of the session

I confirmed that in the case where it’s not working, no session is being created.

Here’s the shibd.log with DEBUG logging enabled for: OpenSAML.MessageDecoder, Shibboleth.Listener, Shibboleth.RequestMapper, and Shibboleth.SessionCache

2014-10-14 11:18:17 DEBUG Shibboleth.Listener [1]: dispatching message (default/Login::run::SAML2SI)

2014-10-14 11:18:19 DEBUG Shibboleth.Listener [1]: dispatching message (default/Login::run::SAML2SI)

and here’s the Apache request log:

66.194.102.6 - - [14/Oct/2014:11:18:17 -0500] "GET / HTTP/1.1" 302 927 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"

66.194.102.6 - - [14/Oct/2014:11:18:19 -0500] "POST /Shibboleth.sso/SAML2/POST HTTP/1.1" 302 - "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"

66.194.102.6 - - [14/Oct/2014:11:18:19 -0500] "GET /login.act HTTP/1.1" 302 925 "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36”

When it works, I see the following...

shibd.log:

2014-10-14 11:26:03 DEBUG Shibboleth.Listener [2]: dispatching message (default/Login::run::SAML2SI)

2014-10-14 11:26:05 DEBUG Shibboleth.Listener [1]: dispatching message (default/SAML2/POST)

2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.4

2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:0.9.2342.19200300.100.1.3

2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.42

2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.3

2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.16.840.1.113730.3.1.241

2014-10-14 11:26:05 DEBUG Shibboleth.SessionCache [1]: creating new session

2014-10-14 11:26:05 DEBUG Shibboleth.SessionCache [1]: storing new session...

2014-10-14 11:26:05 INFO Shibboleth.SessionCache [1]: new session created: ID (_<REDACTED>) IdP (https://<REDACTED>/idp/shibboleth) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (66.194.102.6)

Apache request log:

66.194.102.6 - - [14/Oct/2014:11:26:03 -0500] "GET / HTTP/1.1" 302 929 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"

66.194.102.6 - - [14/Oct/2014:11:26:05 -0500] "POST /Shibboleth.sso/SAML2/POST HTTP/1.1" 302 326 "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"

66.194.102.6 - <REDACTED>@<REDACTED> [14/Oct/2014:11:26:05 -0500] "GET / HTTP/1.1" 302 - "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"

66.194.102.6 - <REDACTED> <REDACTED> [14/Oct/2014:11:26:05 -0500] "GET /login.act HTTP/1.1" 302 - "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36”

The troubling thing about this is that when the POST request is not being handled, it’s still forwarding to our app which is the one generating the /login.act redirect. Shouldn’t it immediately forward to the IdP again at that point?

Do I need to tweak my require here to be something other than valid-user?

  <Location />

    AuthType shibboleth

    ShibRequestSetting requireSession 1

    require valid-user

  </Location>

So the two issues that remain when that <Location> block is left uncommented:

The POST /Shibboleth.sso/SAML2/POST requests don’t appear to be handled at least according to the Shib logs.

Even though the POST requests aren’t being handled, it appears to be passing traffic through to our app which is returning a redirect to /login.act. That request that generates another auth request with the IdP.

Thanks!

On Tue, Oct 14, 2014 at 11:38 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 10/14/14, 11:25 AM, "Bradley Wagner" <bradley.wagner at hannonhill.com>
> wrote:
>>When I comment out the <Location> block, the POST request responds with
>>the same 302 redirect but also a _shibsession_<hash> cookie so that
>>subsequent GET /a-url-in-my-app is allowed because it passes the session
>>cookie.
>>
>>Does this still point to the POST request not being properly handled or
>>possibly something else? I would think that if it were not handled by
>>Shibboleth it wouldn¹t try to forward me to my app because I wouldn¹t be
>>authenticated.
> I would assume that in both cases it should log the creation of the
> session, in which case the problem is that Apache is doing something wrong
> and overwiting the response headers it's trying to set.
>>Thanks again for the help on this. It feels like something subtler than a
>>library mismatch but perhaps not.
> You cannot use packages on the wrong OS, period.
> -- Scott
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141014/de3eed79/attachment.html 