bindingTemplate.html

[Paul G. Szabady]

Please see interspersed comments, below:

Paul G. Szabady
http://go.unc.edu/i3RTs

On 03/31/2015 02:53 PM, Cantor, Scott wrote:
> On 3/31/15, 2:39 PM, "Paul G. Szabady" <paul_szabady at unc.edu> wrote:
>> I recently changed my shibboeth SP (v2.5.3 on rhel 6) setup from the
>> older explicit sessioninitiator settings, etc to the newer SSO element
>> style.  Everything is working as expected, except for one piece.  I have
>> never seen the redirect page created by the bindingTemplate.html,
> It's not a redirect, it's used when the POST binding is used.

Ah, maybe that was where I was confused.

>> With my new configuration, I see the
>> redirect page for a second or two and then get redirected to the
>> appropriate IdP.
> There is no normal scenario under which the conversion would have any impact on this. If the POST binding is used, it would have been used before, or if not, not. Some other unusual set of options has to be involved, or the metadata for the IdP changed. The default outbound bindings have always favored HTTP-Redirect regardless of the syntax.
>
>> Under normal circumstances, I wouldn't care, but we
>> have a proprietary application that is proxied through this SP.  It has
>> a number of drop down menus that now show "Shibboleth Authentication
>> Request" after about 10 mins of idle time, instead the drop down menu items.
> POST could certainly break any number things, although the use of Javascript mostly renders it invisible to most things.

Apparently, Peoplesoft Portal is one of them.

>> 1) Why would this cause an issue (timeout?) after 10 mins, when my
>> global timeouts are set much higher?
> Session timeouts have nothing remotely to do with whatever you're describing.

Well, all the reports I got were prefaced with "after about 10 mins of 
inactivity", ...  Unfortunately, I was unable to reproduce the errors 
because I don't have permission(s) for the drop down menus that were 
causing the mayhem.

>> 2) How/Where can I change this behavior?  I've been looking through the
>> confluence wiki, but can't seem to find it.
> Fix the IdP's metadata to include a Redirect endpoint, generally.
>
> -- Scott
>

The catalyst for my change (after ~7 years of things working) was due to 
a "feature" of Microsoft Office, which (as I understand it) required a 
change from a redirect to a post.  (See 
https://wiki.shibboleth.net/confluence/display/SHIB2/Tips+on+Integrating+Things)


I have since deleted the "offending" content and after some initial 
testing, things seem to be working as desired.

$ diff bindingTemplate.html bindingTemplate.html.dist
2a3
 >         <title>Shibboleth Authentication Request</title>
5a7,25
 >         <h1>Shibboleth Authentication Request</h1>
 >
 >         <script type="text/javascript">
 >         <!--
 >         document.write("<p>You are automatically being redirected to 
the authentication service. ");
 >         document.write("If the browser appears to be hung up after 
15-20 seconds, try reloading ");
 >         document.write("the page before contacting the technical 
support staff in charge of the ");
 >         document.write("authentication service you are trying to 
access.</p>");
 >         document.write("<h2>Redirecting...</h2>");
 >         // -->
 >         </script>
 >
 >         <noscript>
 >         <p>
 >         <strong>Note:</strong> Since your browser does not support 
JavaScript, you must press the
 >         Continue button once to proceed to the authentication service.
 >         </p>
 >         </noscript>
 >
$

If there's a better or more sane approach to resolving this issue, I'd 
be interested in hearing what it is.

Thank you (Scott) for your reply and your ongoing support and guidance 
on this project!

Paul