Running mod_shib on a non-standard port (i.e. 9999 rather than 443)

[Philip Durbin]

On Tue, Apr 28, 2015 at 2:10 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 4/28/15, 1:50 PM, "Philip Durbin" <philip_durbin at harvard.edu> wrote:
>
>>Here are my questions:
>>
>>1. Why is TestShib trying to use
>>https://shibtest.dataverse.org/Shibboleth.sso/SAML2/POST rather than
>>https://shibtest.dataverse.org:9999/Shibboleth.sso/SAML2/POST when the
>>port (9999) is in my metadata?
>
> Your metadata is what it checks against, the URL is in the AuthnRequest.

I assume you mean to put a "not" in there... "Your metadata is *not*
what it checks against".

Thanks very much for this lead. Using SAML Tracer* I can see what you
mean... the URL (with no port 9999) is in the AuthnRequest like you
said (screenshot at http://i.imgur.com/q1a96c3.png ):

<samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://shibtest.dataverse.org/Shibboleth.sso/SAML2/POST"
Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
ID="_8cb7622124119ad4c33b2202fc38cf6c"
IssueInstant="2015-04-28T18:17:45Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"
>

In the screenshot you can also see the following GET's.

This first one does show port 9999. I'm constructing this URL with a
slightly modified version of "this.defaultReturn" in our EDS config at
https://github.com/IQSS/dataverse/blob/master/src/main/webapp/resources/js/shib/idpselect_config.js

GET https://shibtest.dataverse.org:9999/Shibboleth.sso/Login?SAMLDS=1&target=https://shibtest.dataverse.org/shib.xhtml&entityID=https%3A%2F%2Fidp.testshib.org%2Fidp%2Fshibboleth
HTTP/1.1
Host: shibtest.dataverse.org:9999

Then another GET that's harder to read:

GET https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO?SAMLRequest=hZJRT4MwFIX%2FCun7KFTUpRkkuD24ZDoy0AdfTAd3owm02Fum%2FnvLmDpfZvp2e%2B53ek46Q9E2HU97W6sNvPWA1vtoG4X8eBGT3iiuBUrkSrSA3JY8Tx9WnPkB74y2utQN8VJEMFZqNdcK%2BxZMDuYgS3jarGJSW9shpxRrubXOwK%2BEFQcwCL42e5q78VY3YGsfUdOBzmi2zgviLZxaKjGAfzGy6vwBM%2BCOADeg7ik72cBpewOVNFBamudr4i0XMXkNd6JiEAQAjMFtELHoBtwJhIAIArZzMsQelgqtUDYmLAivJ0E0YdMinPKriDP2QrzslPhOqkqq%2FeV6tqMI%2BX1RZJMx0bOLfUzjBCSZDSXzo7E5q%2F0yVnx3TZJ%2FmsWfZmf0zGm07fijQy8XmW5k%2BemlTaPf5waEhZiEhCbjyt%2BvkXwB&

>>2. Does anyone in the world run mod_shib on a non-standard port like this?
>
> Yes. Your web server believes it's running on port 443 based on the request asking for that URL. Shibboleth has literally no role here, not for an Apache deploy. The URL is built from standard Apache API calls for the scheme, name, and port.

Ok, so I must not have configured Apache properly to listen on 9999
rather than 443.

This is the change I made (and then restarted Apache):

[root at dvn-vm3 ~]# diff /etc/httpd/conf.d/ssl.conf.orig
/etc/httpd/conf.d/ssl.conf
18c18,19
< Listen 443
---
> #Listen 443
> Listen 9999
74c75,76
< <VirtualHost _default_:443>
---
> #<VirtualHost _default_:443>
> <VirtualHost _default_:9999>
78c80,81
< ServerName shibtest.dataverse.org:443
---
> #ServerName shibtest.dataverse.org:443
> ServerName shibtest.dataverse.org:9999
[root at dvn-vm3 ~]#

Should I also make a change to /etc/httpd/conf.d/shib.conf ? (I'm
running this RPM, by the way: shibboleth-2.5.4-3.1.x86_64)

I'm obviously missing something. Any help is much appreciated!

Phil

* https://addons.mozilla.org/en-us/firefox/addon/saml-tracer/

-- 
Philip Durbin
Software Developer for http://dataverse.org
http://www.iq.harvard.edu/people/philip-durbin