Shibboleth SP, Drupal and IIS setup question

Mon Nov 23 15:24:20 EST 2015

Nick,

It could hypothetically be a bunch of things.  My first hunch would be 
that the Drupal module has a built-in strong session check that can tie 
the Drupal session to the Shibboleth SP session, and since you're only 
protecting the login endpoint, that check would fail.

You can verify that the SP is getting all the desired attributes and 
mapping them by accessing /Shibboleth.sso/Session.  If they're there, 
then that narrows it down to getting them to Drupal, and you could 
create a phpinfo(); page in Drupal's directories to see what's getting 
set there to further narrow it down.

Ultimately, you'll probably need to trace the login process in a browser 
to see why the session cookie's not getting set properly.  A tool like 
SAML Tracer for Firefox will help.

Take care,
Nate.

On 11/23/2015 01:13 PM, Nick Meyer wrote:
>
> I've posted on the Drupal module's page but not gotten any assistance.
>
>
> I'm hoping for assistance and wondering if this's an issue with not 
> protecting (as "secure") the correct folder in Shibboleth2.xml, or not 
> mapping user-id and email correctly to Drupal.
>
>
> Some assistance would be greatly appreciated.
>
> --
>
>
> I am able login through University screens and, do get redirected back 
> to Drupal.  The Drupal shib_auth module never finishes the login 
> though.  Can't tell why it's not getting needed information.   Does 
> IIS not populate session variables?
>
> The pages are:
>
> 1.) Click Shibboleth Signin on Drupal
> 2.) 
> http://staging.sphsc.washington.edu/Shibboleth.sso/DS?target=http%3A%2F%... 
> <http://staging.sphsc.washington.edu/Shibboleth.sso/DS?target=http%3A%2F%2Fstaging.sphsc.washington.edu%2F%3Fq%3Dshib_login%2Fuser>
> 3.) Sign in
> 4.) Reidrects to 
> http://staging.sphsc.washington.edu/Shibboleth.sso/SAML2/POST
> 5.) Reidrects to Drupal at 
> http://staging.sphsc.washington.edu/shib_login/user
>
> Result: Not logged in. Trying link (1) again redirects straight back 
> to Drupal.
>
> ------------------
> My IIS web.config:
>
> |<rule name="Ignore Shibboleth" stopProcessing="true">         <match 
> url="Shibboleth\.sso" />         <conditions 
> logicalGrouping="MatchAll" trackAllCaptures="false" />         <action 
> type="None" /> </rule>|
>
>
> ------------------
> My Shibboleth2.xml:
>
> |<Host name="staging.sphsc.washington.edu" 
> applicationId="sphsc_local_22"> <Path name="secure" 
> authType="shibboleth" requireSession="true" /> <Path 
> name="shib_login/user" authType="shibboleth" requireSession="true" /> 
> </Host> .... <ApplicationDefaults 
> entityID="http://staging.sphsc.washington.edu/shibboleth" 
> REMOTE_USER="eppn persistent-id targeted-id"> <Sessions 
> lifetime="28800" timeout="3600" relayState="ss:mem" 
> checkAddress="false" handlerSSL="false" cookieProps="http"> <SSO 
> isDefault="true" entityID="urn:mace:incommon:washington.edu"> SAML2 
> SAML1 </SSO> <Logout>SAML2 Local</Logout> <Handler 
> type="MetadataGenerator" Location="/Metadata" signing="false"/> 
> <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/> 
> <Handler type="Session" Location="/Session" 
> showAttributeValues="false"/> <Handler type="DiscoveryFeed" 
> Location="/DiscoFeed"/> <SessionInitiator type="Chaining" 
> Location="/DS" isDefault="true" id="sphsc_univwash_33" 
> relayState="cookie" entityID="urn:mace:incommon:washington.edu" 
> forceAuthn="false"> <SessionInitiator type="SAML2" acsIndex="1" 
> template="bindingTemplate.html" /> <SessionInitiator type="Shib1" 
> acsIndex="5" /> </SessionInitiator> </Sessions> <ApplicationOverride 
> id="sphsc_local_22" 
> entityID="http://staging.sphsc.washington.edu/shibboleth" />|
>
>
> ------------------
> The SAML package (4) looks like:
>
> |<?xml version="1.0" encoding="UTF-8"?> <saml2p:Response 
> Destination="http://staging.sphsc.washington.edu/Shibboleth.sso/SAML2/POST" 
>    ID="_78f94a5842265bbfb8132b22b15d5efe" 
> InResponseTo="_a2269bea57c2bbe63221b1a98de401cf"    
> IssueInstant="2015-11-18T00:57:49.066Z" Version="2.0"    
> xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">    <saml2:Issuer 
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"       
> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:incommon:washington.edu</saml2:Issuer> 
>    <saml2p:Status><saml2p:StatusCode 
> Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status> 
>    <saml2:Assertion ID="_71c4cf892cb356aafe90b11345affe09" 
> IssueInstant="2015-11-18T00:57:49.066Z"       Version="2.0" 
> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"       
> xmlns:xs="http://www.w3.org/2001/XMLSchema">       <saml2:Issuer 
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:incommon:washington.edu</saml2:Issuer> 
>       <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
>          <ds:SignedInfo><ds:CanonicalizationMethod 
> Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod 
> Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>             
> <ds:Reference URI="#_71c4cf892cb356aafe90b11345affe09">                
> <ds:Transforms><ds:Transform 
> Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> 
>                   <ds:Transform 
> Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces 
> PrefixList="xs" 
> xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transform> 
>                </ds:Transforms><ds:DigestMethod 
> Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>                
> <ds:DigestValue>5UuuHpAoGjP04WBzF1qdCPmiKVs=</ds:DigestValue> 
>             </ds:Reference>          </ds:SignedInfo>          
> <ds:SignatureValue>...</ds:SignatureValue>          <ds:KeyInfo> 
>             <ds:X509Data>                
> <ds:X509Certificate>....</ds:X509Certificate>             
> </ds:X509Data>          </ds:KeyInfo>       </ds:Signature>       
> <saml2:Subject>          <saml2:NameID 
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" 
>             NameQualifier="urn:mace:incommon:washington.edu" 
>             
> SPNameQualifier="http://staging.sphsc.washington.edu/shibboleth">_cea347c6d94069dcf5edd2cdc567e5db</saml2:NameID> 
>          <saml2:SubjectConfirmation 
> Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData 
> Address="10.155.19.54"             
> InResponseTo="_a2269bea57c2bbe63221b1a98de401cf" 
> NotOnOrAfter="2015-11-18T01:02:49.066Z"             
> Recipient="http://staging.sphsc.washington.edu/Shibboleth.sso/SAML2/POST"/></saml2:SubjectConfirmation> 
>       </saml2:Subject>       <saml2:Conditions 
> NotBefore="2015-11-18T00:57:49.066Z" 
> NotOnOrAfter="2015-11-18T01:02:49.066Z">          
> <saml2:AudienceRestriction>             
> <saml2:Audience>http://staging.sphsc.washington.edu/shibboleth</saml2:Audience> 
>          </saml2:AudienceRestriction>       </saml2:Conditions>       
> <saml2:AuthnStatement AuthnInstant="2015-11-18T00:57:48.996Z"          
> SessionIndex="0073f23ed8e29de0c48911616e8f1dbecc4ed16c5ebeab4d2ea5322767f83fff"><saml2:SubjectLocality 
> Address="10.155.19.54"/>          <saml2:AuthnContext>             
> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef> 
>          </saml2:AuthnContext>       </saml2:AuthnStatement>       
> <saml2:AttributeStatement>          <saml2:Attribute 
> FriendlyName="uwEduEmail" Name="urn:oid:1.2.840.113994.200.45" 
>             
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> 
>             <saml2:AttributeValue 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
> xsi:type="xs:string">me at uw.edu</saml2:AttributeValue>          
> </saml2:Attribute>          <saml2:Attribute 
> FriendlyName="eduPersonAffiliation" 
> Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"             
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> 
>             <saml2:AttributeValue 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
> xsi:type="xs:string">member</saml2:AttributeValue>             
> <saml2:AttributeValue 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
> xsi:type="xs:string">staff</saml2:AttributeValue>             
> <saml2:AttributeValue 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
> xsi:type="xs:string">employee</saml2:AttributeValue>          
> </saml2:Attribute>          <saml2:Attribute FriendlyName="uid" 
> Name="urn:oid:0.9.2342.19200300.100.1.1"             
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> 
>             <saml2:AttributeValue 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
> xsi:type="xs:string">me</saml2:AttributeValue>          
> </saml2:Attribute>       </saml2:AttributeStatement>    
> </saml2:Assertion> </saml2p:Response>|
> ||
>
>
>
>
>
>
>
>
> -- 
> NICK MEYER
> Software Engineer
> Speech & Hearing Sciences
>
> Box 354875  | 4131 15th Ave NE, Seattle, WA 98105-6250
> (206)685-0871 direct  |  (206)685-7400 main
> meyerjn at u.washington.edu <mailto:meyerjn at u.washington.edu>  | 
> http://depts.washington.edu/sphsc/
>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151123/76b73f2b/attachment-0001.html>