Shibboleth SP, Drupal and IIS setup question
Nick Meyer
meyerjn at uw.edu
Mon Nov 23 15:13:33 EST 2015
I've posted on the Drupal module's page but not gotten any assistance.
I'm hoping for assistance and wondering if this's an issue with not protecting (as "secure") the correct folder in Shibboleth2.xml, or not mapping user-id and email correctly to Drupal.
Some assistance would be greatly appreciated.
--
I am able login through University screens and, do get redirected back to Drupal. The Drupal shib_auth module never finishes the login though. Can't tell why it's not getting needed information. Does IIS not populate session variables?
The pages are:
1.) Click Shibboleth Signin on Drupal
2.) http://staging.sphsc.washington.edu/Shibboleth.sso/DS?target=http%3A%2F%...<http://staging.sphsc.washington.edu/Shibboleth.sso/DS?target=http%3A%2F%2Fstaging.sphsc.washington.edu%2F%3Fq%3Dshib_login%2Fuser>
3.) Sign in
4.) Reidrects to http://staging.sphsc.washington.edu/Shibboleth.sso/SAML2/POST
5.) Reidrects to Drupal at http://staging.sphsc.washington.edu/shib_login/user
Result: Not logged in. Trying link (1) again redirects straight back to Drupal.
------------------
My IIS web.config:
<rule name="Ignore Shibboleth" stopProcessing="true">
<match url="Shibboleth\.sso" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
<action type="None" />
</rule>
------------------
My Shibboleth2.xml:
<Host name="staging.sphsc.washington.edu" applicationId="sphsc_local_22">
<Path name="secure" authType="shibboleth" requireSession="true" />
<Path name="shib_login/user" authType="shibboleth" requireSession="true" />
</Host>
....
<ApplicationDefaults entityID="http://staging.sphsc.washington.edu/shibboleth"
REMOTE_USER="eppn persistent-id targeted-id">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="false" cookieProps="http">
<SSO isDefault="true" entityID="urn:mace:incommon:washington.edu">
SAML2 SAML1
</SSO>
<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
<SessionInitiator type="Chaining" Location="/DS" isDefault="true" id="sphsc_univwash_33" relayState="cookie" entityID="urn:mace:incommon:washington.edu" forceAuthn="false">
<SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html" />
<SessionInitiator type="Shib1" acsIndex="5" />
</SessionInitiator>
</Sessions>
<ApplicationOverride id="sphsc_local_22" entityID="http://staging.sphsc.washington.edu/shibboleth" />
------------------
The SAML package (4) looks like:
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response Destination="http://staging.sphsc.washington.edu/Shibboleth.sso/SAML2/POST"
ID="_78f94a5842265bbfb8132b22b15d5efe" InResponseTo="_a2269bea57c2bbe63221b1a98de401cf"
IssueInstant="2015-11-18T00:57:49.066Z" Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:incommon:washington.edu</saml2:Issuer>
<saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status>
<saml2:Assertion ID="_71c4cf892cb356aafe90b11345affe09" IssueInstant="2015-11-18T00:57:49.066Z"
Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:incommon:washington.edu</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_71c4cf892cb356aafe90b11345affe09">
<ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces PrefixList="xs" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transform>
</ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>5UuuHpAoGjP04WBzF1qdCPmiKVs=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>...</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>....</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2:Subject>
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="urn:mace:incommon:washington.edu"
SPNameQualifier="http://staging.sphsc.washington.edu/shibboleth">_cea347c6d94069dcf5edd2cdc567e5db</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="10.155.19.54"
InResponseTo="_a2269bea57c2bbe63221b1a98de401cf" NotOnOrAfter="2015-11-18T01:02:49.066Z"
Recipient="http://staging.sphsc.washington.edu/Shibboleth.sso/SAML2/POST"/></saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2015-11-18T00:57:49.066Z" NotOnOrAfter="2015-11-18T01:02:49.066Z">
<saml2:AudienceRestriction>
<saml2:Audience>http://staging.sphsc.washington.edu/shibboleth</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2015-11-18T00:57:48.996Z"
SessionIndex="0073f23ed8e29de0c48911616e8f1dbecc4ed16c5ebeab4d2ea5322767f83fff"><saml2:SubjectLocality Address="10.155.19.54"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="uwEduEmail" Name="urn:oid:1.2.840.113994.200.45"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">me at uw.edu</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">member</saml2:AttributeValue>
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">staff</saml2:AttributeValue>
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">employee</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">me</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
</saml2:Assertion>
</saml2p:Response>
<https://www.drupal.org/node/2621446/edit#edit-field-issue-files-und>
--
NICK MEYER
Software Engineer
Speech & Hearing Sciences
Box 354875 | 4131 15th Ave NE, Seattle, WA 98105-6250
(206)685-0871 direct | (206)685-7400 main
meyerjn at u.washington.edu<mailto:meyerjn at u.washington.edu> | <http://depts.washington.edu/sphsc/> http://depts.washington.edu/sphsc/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151123/9ba3bc84/attachment-0001.html>
More information about the users
mailing list