Attempt to spoof header (Shib-Cookie-Name) was detected

[Peter Schober]

* reda sabir <sabiretude at gmail.com> [2016-10-04 11:00]:
>    - I have a web site http://siteB running correctly and is protected by
>    Shibboleth (SAML)
>    - I want to add http://siteA that will have the same content as siteB
>    and should have the same protection from Shibboleth.

That could mean anything, but I'll assume a single machine with two
vhosts and a single, shared Shib SP installation.

In the simplest case, where no IDP that accesses these vhosts needs to
have differening policy for siteA and siteB, i.e., they can share a
single entityID and appear as /one/ logical SAML SP, all you need to
do is map both vhosts to the same content in the webserver (as usual)
and add protocol endpoints for both vhosts to the SAML Metadata
describing that SP. (Essentially duplicating the ACS URLs for the
second vhost). That's all. No rewrites, no ApplicationOverrides.

> For doing this, I tried to use rewriting URLs and so I put on my httpd.conf:
> 
> >   RewriteEngine on
> >   RewriteRule "^/?(.*)" "https://siteB/$1" [P]

Why would you want to proxy from vhost to another, instead of just
peoperly configuring two seperate vhosts to point to the same content?

> >    <Location /Shibboleth.sso>
> >      Satisfy Any
> >      Allow from all
> >    </Location>

Should be unnecessary.

> >    <Location />
> >        AuthType shibboleth
> >        Require shibboleth
> >        ShibRequestSetting applicationId default

The default applicationId is "default", so at best that does nothing.

> >        ShibUseHeaders On

Why do you think you need to use HTTP Request Headers instead of
server environment variables?

> >        ShibRequestSetting entityID
> > https://fidm.gigya.com/saml/v2.0/3__Cx8VL7TahLZ899qp_v61mtJzr5-u_AMPsfwAA4xptlhsCM_uJo1xC_KOi8Jua2k
> >        ShibRequestSetting requireSession false

Not sure those two together make any sense: Not requiring a session
and not requiring any authorization (lazy sessions) means the
webserver will never trigger SSO with the IDP configured in the line
"ShibRequestSetting entityID ...".

> The problem that I got is that Shibboleth thinks that I'm trying to
> spoof his cookies when I access the URL http://siteA.
> 
> So what I should do for my case?

Stop proxying when you can't deal with the problems of proxying.
-peter