Shibboleth SP mod_shib module not handling Shibboleth.sso URLs and looping

[Cantor, Scott]

On 10/14/14, 12:42 PM, "Bradley Wagner" <bradley.wagner at hannonhill.com>
wrote:
>
>Understood. I¹ll see if packages exist for Amazon Linux and if not, will
>build them ourselves. Our understanding was that Amazon Linux was a
>variant of RHEL and that RHEL packages would work.

You would be crazy to use them.

>I confirmed that in the case where it¹s not working, no session is being
>created.
>Here¹s the shibd.log with DEBUG logging enabled for:
>OpenSAML.MessageDecoder, Shibboleth.Listener, Shibboleth.RequestMapper,
>and Shibboleth.SessionCache

That indicates it's not running the handler, as you originally suggested.
That makes the redirect you're describing to a resource after the POST
something Apache is doing, not the SP. Also, if it doesn't run the
handler, it should be seeing it as a request to a protected resource, and
that should end up as a redirect back to the IdP.

>The troubling thing about this is that when the POST request is not being
>handled, it¹s still forwarding to our app which is the one generating the
>/login.act redirect. Shouldn¹t it immediately forward to the IdP again at
>that point?

Yes, exactly. And it's not doing that, it's going *directly* to
/login.act, not to / first and then redirecting. You'd see that redirect
in the log. One possibility I guess is a cached redirect, but that's a
really bad thing in and of itself. Either way the whole thing makes no
sense. I have no idea what the POST is doing, but it doesn't appear to be
the SP doing it.

I wouldn't trust that entire system at this point.

-- Scott