Wordpress & Shibboleth Headers

[Mr. Christopher Bland]

Hi Scott,

When I first started I had a few different issues. I was looping accessing /secure because I was protecting non-ssl content and my Shib config was ssl, cookieprops was the problem.  Fixed.  I ultimately made the site all ssl since I had already created a cert.  Next I was looping again authenticating to Wordpress I hacked the plugin to add logging.  I could see all of the $_SERVER environment variables except the Shib ones.  The Wordpress Shibboleth plugin says just add


AuthType shibboleth
Require shibboleth

for lazy session.  I ended up adding a second instance so I added the

ShibRequestSetting applicationId wordpress

It seemed that without both

ShibRequireSession Off
ShibUseHeaders On

I was still looping. Redundant, maybe which is why I prefaced with "Not saying this is right but it worked for me"

-Chris

On May 11, 2016, at 11:37 AM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

Thanks again, with your suggestions I figured it out.  For all who may read this
in the future my problem was with lazy sessions.  The docs for the plugin are
a little bit dated.  Not saying this is right but it worked for me

AuthType shibboleth
ShibRequestSetting applicationId wordpress
ShibRequireSession Off

That one would be essentially redundant, it defaults off (and the updated syntax is ShibRequestSetting requireSession).

What exactly did you have to change though?

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160511/be6316be/attachment.html>