Attempt to spoof header (Shib-Cookie-Name) was detected

[reda sabir]

Hello Peter,

all you need to do is map both vhosts to the same content in the webserver
> (as usual)
> and add protocol endpoints for both vhosts to the SAML Metadata
> describing that SP. (Essentially duplicating the ACS URLs for the
> second vhost). That's all. No rewrites, no ApplicationOverrides.
>

Of course, what you suggest is the easiest configuration and the more
logical one. The problem with this is that we can't do that because the App
that is protected is Liferay and use fqdn to know wich "site" it will
shows. So in the liferay, we have set-up a site for siteA and it would cost
us a lot to duplicate it to another one with hostname siteb and maintained
it. That's why we try to make URL rewriting.


> The problem that I got is that Shibboleth thinks that I'm trying to spoof
> his cookies when I access the URL http://siteA.

This statement wasn't true. What's happening is that Shibboleth set headers
because of "*ShibUseHeaders On*" and so when the request is proxied to
http://siteB, shibboleth think that someone has tried to spoof headers.  So
what I did is deleted this line.

Now I don't have the error "*Attempt to spoof header (Shib-Cookie-Name) was
detected*" as expected, but I don't have SSO.

2016-10-04 11:18 GMT+02:00 Peter Schober <peter.schober at univie.ac.at>:

> * Peter Schober <peter.schober at univie.ac.at> [2016-10-04 11:14]:
> > > >    <Location />
> > > >        AuthType shibboleth
> > > >        Require shibboleth
> > > >        ShibRequestSetting applicationId default
> >
> > The default applicationId is "default", so at best that does nothing.
>
> Well, unless you have other config you didn't mention that uses
> ApplicationOverride and sets the applicationId to a non-default value.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161004/f02619b9/attachment-0001.html>