SP RelayState not used with mod_jk even if returned by the IdP

gael.thiabaud at fr.michelin.com gael.thiabaud at fr.michelin.com
Fri Nov 27 04:18:45 EST 2015


Dear Shibboleth team,

I am working on deploying a Shibboleth SP (Centos 5 Apache 2.2) connected 
to a Shibboleth IdP (2.4).

The SP and the IdP are on the same server but use a different url with 
different certificates.

Currently I have the following behavior:

The user requests the targeted resource url,
The SP redirect to the IdP that redirect to CAS for authentication.
The IdP redirect to the SP after a successful login.
If in Apache I use Directory in the virtual host the targeted static 
resource is opened successfully.
If in Apache I use a Location with a mod_jk, the user retrieve a 404 
because  the value of the RelayState is not used and the resource request 
is something like:
 /Shibboleth.sso/SAML2/POST in place of something like 
/web/targetedRessources

Could you help me to understand what I miss in my configuration?

I had checked that the RelayState value is returned by the IdP and it is! 
(in mem and cookie).

>From SP to IdP: 
RelayState=ss%3Amem%3Aacbaad85d99342986e59859d3a69aa4dd5239ce716f27a1b1e2cb335e367815b
>From Idp to SP: POST 
                        RelayState: 
ss:mem:acbaad85d99342986e59859d3a69aa4dd5239ce716f27a1b1e2cb335e367815b
Best regards
PS: Current technical context
·       Red Hat: 5.x
·       Apache/2.2.31 (Unix)
·       OpenSSL/0.9.8e-fips-rhel5
·       mod_jk/1.2.40
·       CAS 3.4.11 over tomcat 7.0.23
·       Shibboleth IdP 2.40 over tomcat 6.0.37
·       Shibboleth SP shibboleth.x86_64 2.5.5-3.1
SP RelayState not used with mod_jk even if returned by the IdP

----------------------------------------------------

Gaël THIABAUD
WIPRO Company
Effectuant des prestations pour le Service Michelin DGSI/BS/GS
[Providing services for Michelin Dept. DGSI/BS/GS]
Cataroux - Bât Z31, 2ème étage
Tel direct : 42 246
Depuis l'extérieur : +33 (0)4 73 30 22 46
--------------------------------------------------------
Classification : D3
Conservation : 90 jours

Ce courriel peut contenir des informations de nature confidentielle et 
destinées uniquement à l'usage du destinataire. Toute divulgation des 
informations contenues dans ce courriel est strictement interdite et peut 
être contraire à la législation applicable. Si vous avez reçu ce courriel 
par erreur, merci de nous le notifier immédiatement et de détruire ce 
courriel. Par avance merci.

This e-mail may contain confidential information and is intended solely 
for the use of the addressee. Any disclosure of this information is 
strictly prohibited and may be unlawful. If you have received this e-mail 
by mistake, please notify us immediately and delete this e-mail. Thank you 
in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151127/8922e94a/attachment.html>


More information about the users mailing list