Attempt to spoof header (Shib-Cookie-Name) was detected

[reda sabir]

Hello everyone,

Here's my set-up:

   - I have a web site http://siteB running correctly and is protected by
   Shibboleth (SAML)
   - I want to add http://siteA that will have the same content as siteB
   and should have the same protection from Shibboleth.

For doing this, I tried to use rewriting URLs and so I put on my httpd.conf:

>   RewriteEngine on
>   RewriteRule "^/?(.*)" "https://siteB/$1" [P]
>
Also I added the shibboleth part:

>   <Location /group>
>      AuthType shibboleth
>      ShibRequestSetting requireSession 1
>      ShibRequireSession On
>       require shib-session
>    </Location>
>    <Location /Shibboleth.sso>
>      Satisfy Any
>      Allow from all
>    </Location>
>    <Location />
>        AuthType shibboleth
>        Require shibboleth
>        ShibRequestSetting applicationId default
>        ShibUseHeaders On
>        ShibRequestSetting entityID
> https://fidm.gigya.com/saml/v2.0/3__Cx8VL7TahLZ899qp_v61mtJzr5-u_AMPsfwAA4xptlhsCM_uJo1xC_KOi8Jua2k
>        ShibRequestSetting requireSession false
>    </Location>
>
The problem that I got is that Shibboleth thinks that I'm trying to spoof
his cookies when I access the URL http://siteA.

So what I should do for my case?

Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161004/4c774ab6/attachment.html>