Apache not picking up Shibboleth session variables

[Etan Weintraub]

Have you validated the content of your attribute-map.xml?

-Etan E. Weintraub
Information Security Architect
IT at Johns Hopkins
Johns Hopkins at Mt. Washington
5801 Smith Ave.
Davis Building Suite 3110B
Baltimore, MD 21209
Phone: 667-208-6309
E-mail: eweintra at jhmi.edu

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Kelsey, Bart
Sent: Wednesday, March 23, 2016 4:27 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Apache not picking up Shibboleth session variables

Quick recap, since it's been a while since I posted on this thread:  shibd
is authenticating correctly and getting the session data (and the
transaction log shows that a session is being created with that data), but
the attributes aren't being passed along to apache.

Here's the contents of native.log for a single login attempt:

2016-03-23 16:21:26 DEBUG Shibboleth.Apache [22768] shib_check_user: mapped
http://hslstaff-sta.osumc.edu/Shibboleth.sso/Login?target=http%3A%2F%2Fhslst
aff-sta.osumc.edu%2F%3Fq%3Dshib_login%2Fnode to default
2016-03-23 16:21:26 DEBUG Shibboleth.SessionInitiator.SAML2 [22768]
shib_check_user: attempting to initiate session using SAML 2.0 with provider
(urn:mace:incommon:osu.edu)
2016-03-23 16:21:26 DEBUG Shibboleth.Listener [22768] shib_check_user:
sending message (default/Login::run::SAML2SI)
2016-03-23 16:21:26 DEBUG Shibboleth.Listener [22768] shib_check_user: send
completed, reading response message
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22763] shib_check_user: mapped
http://hslstaff-sta.osumc.edu/Shibboleth.sso/SAML2/POST to default
2016-03-23 16:21:27 DEBUG Shibboleth.Listener [22763] shib_check_user:
sending message (default/SAML2/POST)
2016-03-23 16:21:27 DEBUG Shibboleth.Listener [22763] shib_check_user: send
completed, reading response message
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_check_user: mapped
http://hslstaff-sta.osumc.edu/?q=shib_login/node to default
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_auth_checker:
mapped http://hslstaff-sta.osumc.edu/?q=shib_login/node to default
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_auth_checker:
htaccess: a rule was successful, granting access
2016-03-23 16:21:27 DEBUG Shibboleth.ServiceProvider [22769]
shib_auth_checker: access control provider granted access
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_check_user:
shib_check_user running more than once
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_check_user: mapped
http://hslstaff-sta.osumc.edu/index.php?q=shib_login/node to default
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_auth_checker:
mapped http://hslstaff-sta.osumc.edu/index.php?q=shib_login/node to default
2016-03-23 16:21:27 DEBUG Shibboleth.Apache [22769] shib_auth_checker:
htaccess: a rule was successful, granting access
2016-03-23 16:21:27 DEBUG Shibboleth.ServiceProvider [22769]
shib_auth_checker: access control provider granted access

Nothing jumps out at me as being wrong with it, but it could be that I don't
know what to look for.  FYI, I'm using Drupal's auth_shib module, and in
order to log in, the user clicks on a shibboleth login link.  What *should*
be happening is that Drupal would check the username against its internal
user database and allow them to log in if there's a match, but the apache
$_SERVER variables are completely blank, so Drupal never receives the
information.

Note also that I've turned on SAML debugging in shibd.log and confirmed the
data is all being sent over correctly, so the problem is definitely local.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, February 16, 2016 3:13 PM
To: Shib Users
Subject: RE: Apache not picking up Shibboleth session variables

> /Shibboleth.sso/Session is returning: "A valid session was not found."

Then you need to check into native.log and figure out what it's saying about
the subsequent requests that should be carrying the cookies and have a valid
session. Even the request to /Shibboleth.sso/Session itself.
 
>   <Location />
>     AuthType Shibboleth
>     ShibRequireSession Off
>     ShibUseHeaders On
>     require shibboleth
>   </Location>

That should export the data to headers but in general will prevent anything
from actually initially getting the user logged in at all. That just isn't
the whole picture. If it were, you'd never be forced to login and you would
get, in fact, no data as a result.

And when vhosting is involved, lots of things are very easy to get wrong at
the Apache level that cause unusual behavior.

-- Scott

-- 
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-- 
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4825 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20160323/ccca1fbe/attachment-0001.p7s>