Apache not picking up Shibboleth session variables

[Kelsey, Bart]

Quick recap, since it's been a while since I posted on this thread:  shibd is authenticating correctly and getting the session data (and the transaction log shows that a session is being created with that data), but the attributes aren't being passed along to apache.

Here's the contents of native.log for a single login attempt:

2016-03-23 16:21:26 DEBUG Shibboleth.Apache [22768] shib_check_user: mapped http://hslstaff-sta.osumc.edu/Shibboleth.sso/Login?target=http%3A%2F%2Fhslstaff-sta.osumc.edu%2F%3Fq%3Dshib_login%2Fnode to default
2016-03-23 16:21:26 DEBUG Shibboleth.SessionInitiator.SAML2 [22768] shib_check_user: attempting to initiate session using SAML 2.0 with provider (urn:mace:incommon:osu.edu)
2016-03-23 16:21:26 DEBUG Shibboleth.Listener [22768] shib_check_user: sending message (default/Login::run::SAML2SI)
2016-03-23 16:21:26 DEBUG Shibboleth.Listener [22768] shib_check_user: send completed, reading response message
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22763] shib_check_user: mapped http://hslstaff-sta.osumc.edu/Shibboleth.sso/SAML2/POST to default
2016-03-23 16:21:27 DEBUG Shibboleth.Listener [22763] shib_check_user: sending message (default/SAML2/POST)
2016-03-23 16:21:27 DEBUG Shibboleth.Listener [22763] shib_check_user: send completed, reading response message
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_check_user: mapped http://hslstaff-sta.osumc.edu/?q=shib_login/node to default
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_auth_checker: mapped http://hslstaff-sta.osumc.edu/?q=shib_login/node to default
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_auth_checker: htaccess: a rule was successful, granting access
2016-03-23 16:21:27 DEBUG Shibboleth.ServiceProvider [22769] shib_auth_checker: access control provider granted access
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_check_user: shib_check_user running more than once
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_check_user: mapped http://hslstaff-sta.osumc.edu/index.php?q=shib_login/node to default
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_auth_checker: mapped http://hslstaff-sta.osumc.edu/index.php?q=shib_login/node to default
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_auth_checker: htaccess: a rule was successful, granting access
2016-03-23 16:21:27 DEBUG Shibboleth.ServiceProvider [22769] shib_auth_checker: access control provider granted access

Nothing jumps out at me as being wrong with it, but it could be that I don't know what to look for.  FYI, I'm using Drupal's auth_shib module, and in order to log in, the user clicks on a shibboleth login link.  What *should* be happening is that Drupal would check the username against its internal user database and allow them to log in if there's a match, but the apache $_SERVER variables are completely blank, so Drupal never receives the information.

Note also that I've turned on SAML debugging in shibd.log and confirmed the data is all being sent over correctly, so the problem is definitely local.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, February 16, 2016 3:13 PM
To: Shib Users
Subject: RE: Apache not picking up Shibboleth session variables

> /Shibboleth.sso/Session is returning: "A valid session was not found."

Then you need to check into native.log and figure out what it's saying about the subsequent requests that should be carrying the cookies and have a valid session. Even the request to /Shibboleth.sso/Session itself.
 
>   <Location />
>     AuthType Shibboleth
>     ShibRequireSession Off
>     ShibUseHeaders On
>     require shibboleth
>   </Location>

That should export the data to headers but in general will prevent anything from actually initially getting the user logged in at all. That just isn't the whole picture. If it were, you'd never be forced to login and you would get, in fact, no data as a result.

And when vhosting is involved, lots of things are very easy to get wrong at the Apache level that cause unusual behavior.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net