Shibboleth SP test KO : Don't reach testshib.org authentification

[Alexandre Lefevre]

Hi all,

I need to install an environment which use shibboleth authentification. To
do this I want to test my Shibboleth SP which testshib.org tools.
Unfortunately, the test don¹t work. When I join the URL myhost.org/secure
i¹m never redirect.
I¹m on CentOS 6.6 server with apache 2.2 and Shibboleth SP 2.5.4.

I copy the shibboleth2.xml generates with tools of testshib.org using the
hostname «  lea-preprod.hautenormandie.fr ».
My apache configuration is the following.
A first virtual host get the http request on host name
lea-preprod.hautenormandie.fr  to https. I don¹t have any shibboleth
specific configuration on it, I¹m sure it works.
The configuration for ssl host must be interesting, it¹s combine the
configuration of my application and part of shibboleth configuration :

<VirtualHost *:443>

        ServerAdmin alexandre.lefevre at pentila.com

        ServerName lea-preprod.hautenormandie.fr



        DocumentRoot /var/www

        ErrorDocument 503 "/erreur_503.html"



        RewriteEngine On

        RewriteCond %{HTTP_HOST} !^lea-preprod\.hautenormandie\. [NC]

        RewriteRule ^(.*)$ https://lea-preprod.hautenormandie.fr/$1
[L,R=301]



        # RewriteRule du serveur CAS pour rediriger vers l'interne!!!!

        RewriteRule ^/cas/(.*)
https://lea-preprod.hautenormandie.fr/c/portal/cas/$1 [P,L]



        Include conf/proxy.conf

        Include conf/mod_auth_cas.conf



        <Location /cas/>

           Allow from all

           Satisfy any

        </Location>



        #SSL Default configuration

        SSLEngine on

        SSLCertificateFile conf/ssl.crt/lea-hautenormandie-fr.crt

        SSLCertificateKeyFile   conf/ssl.key/lea-hautenormandie-fr.pem

        SSLCertificateChainFile
conf/ssl.crt/GlobalSignOrganizationValidationCA-G2.crt



        #RequestHeader SET ENT_PORTEUR CRHN

        RequestHeader SET ENT_PORTEUR DEMO



        JkMount         /jkstatus                       jkstatus



        #JkMountCopy On



        JKMount /cas lb_auth

        JKMount /cas/* lb_auth



        JKMount / nerolb

        JKMount /* nerolb



        JKUnMount /index.html nerolb

        JKUnMount /img/* nerolb



        JkUnMount /Shibboleth.sso nerolb

        JkUnMount /Shibboleth.sso/* nerolb



        JkUnMount /wayf nerolb

        JkUnMount /wayf/* nerolb



        JKUnMount /secure nerolb

        JKUnMount /secure/* nerolb



        JKUnMount /error nerolb

        JKUnMount /error/* nerolb



        JkUnMount /SWITCHaai nerolb

        JkUnMount /SWITCHaai/* nerolb



        ################

        # Conf du WAYF #

        ################



        <Files WAYF>

            ForceType application/x-httpd-php

            #AddHandler fcgid-script .php

            #FCGIWrapper /usr/lib/cgi-bin/php5 .php

            #Options ExecCGI

        </Files>



        Alias /wayf /usr/local/SWITCHwayf

        Alias /SWITCHaai/images /usr/local/SWITCHwayf/images

        # SHIB

<Location /Shibboleth.sso>

                SetHandler shib

        </Location>

        <Location />

          AuthType shibboleth

          Require valid-user

        </Location>



        <LocationMatch "^/(?!zimbraAdmin|piwik|wayf|index.html)">

            AuthType shibboleth

            require shibboleth

            ShibUseHeaders On

            ShibRequestSetting requireSession 0

        </LocationMatch>



        RewriteEngine on

        <Proxy *>

                Order deny,allow

                Allow from all

        </Proxy>



        SSLProxyEngine on

</VirtualHost>



Moreover i have the file a apache22.config from shibboleth which is include
in my httpd.conf: 



LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so



#

# Ensures handler will be accessible.

#

<Location /Shibboleth.sso>

  Satisfy Any

  Allow from all

</Location>



#

# Used for example style sheet in error templates.

#

<IfModule mod_alias.c>

  <Location /shibboleth-sp>

    Satisfy Any

    Allow from all

  </Location>

  Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css

</IfModule>



Some part of my httpd.conf file where i¹m configuring some stuff usefull for
shibboleth sp(e.g. : UseCanonicalName) :



ServerRoot /etc/httpd/

ServerName lea-preprod.hautenormandie.fr



# pour ecouter sur 178.33.128.123 et 192.168.0.10

Listen *:80

Listen *:443



User apache

Group web



ServerTokens Prod

ServerSignature Off

Header set Server "ws"



HostnameLookups Off

UseCanonicalName On



NameVirtualHost *:443

Include conf.d/*.conf #my Vhosts

Include /etc/shibboleth/apache22.config



If you need more stuff to help, claim me them.



Best regards,

Alexandre Lefèvre 




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150703/093ccbed/attachment-0001.html>