Apache not picking up Shibboleth session variables

[Kelsey, Bart]

/Shibboleth.sso/Session is returning: "A valid session was not found."

Here's the apache config for the relevant vhost:

<VirtualHost *:80>
  ServerName hslstaff-sta.osumc.edu
  ErrorLog /var/log/httpd/hslstaff-new_error_log
  CustomLog /var/log/httpd/access_log combined

  DocumentRoot "/var/www/sites/hslstaff-new"
  <Directory "/var/www/sites/hslstaff-new">
    AllowOverride All
    Order allow,deny
    Allow from All
  </Directory>

  <Location />
    AuthType Shibboleth
    ShibRequireSession Off
    ShibUseHeaders On
    require shibboleth
  </Location>

  <Location /Shibboleth.sso>
    SetHandler shib-handler
  </Location>
</VirtualHost>

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, February 16, 2016 2:16 PM
To: Shib Users
Subject: RE: Apache not picking up Shibboleth session variables

> ...which would appear to indicate that a session is being created and 
> the values I need are being saved.

It does, yes. You should also see them at /Shibboleth.sso/Session (and you should check that to make sure that the session's not being created but then invalidated somehow).

> Anyone know what to do about this issue?  If there are any logs and/or 
> configuration files that would be useful for this, please let me know 
> and I'll put them on pastebin.

If it's Apache alone, then the only real possibility is that the use of the SP is being invoked in some manual way (by redirecting to /Shibboleth.sso/Login) but the actual resource isn't protected at all. It depends how this is all being used. The resource(s) being protected have to have at least an AuthType of shibboleth and a require rule (if need be a dummy rule of "require shibboleth") for the SP to be doing anything.

Whether they're in headers or environment variables is configuration dependent.

If this isn't just Apache in the flow of things, then the problem is just as likely to be related to however things are connected up behind the scenes and isn't really anything we can diagnose. The module runs in Apache and it will publish the data to the Apache request, but getting it after that is application dependent.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net