Attempt to spoof header (Shib-Cookie-Name) was detected

[reda sabir]

Hello again,

So I have dug a bit by analysing the network echanges (tcpdump & wireshark)
and I've found that my session cookie is sent correctly to the Reverse
Proxy siteA and is proxied correctly to siteA but is deleted this session
by shibboleth in the response. This makes me think that shibboleth have
some protection that decline any cookie that is not sent from the same IP
as set-cookie was sent to. This means that Shibboleth try to protect from
spoofing the cookie containing the session.

So let me detail more my setup to understand what I'm doing:
Let's assume siteA is portal.example.com and siteB is theportal.example.com.
This two fqdn have the same root (example.com) so I configure the domain of
the cookie as example.com so I can have SSO between the two sites. Because
I want only redirection without changing the url, I had simplified the
httpd conf of portail.example.com to have this :

<VirtualHost *:80>
>    ServerName portail.example.com
>    Redirect 307 / https://portail.example.com/
> </VirtualHost>
>  <VirtualHost *:443>
>     ServerName portail.example.com
>     SSLEngine On
>     SSLProxyEngine On
>     SSLProxyVerify none
>     SSLProxyCheckPeerCN off
>     SSLProxyCheckPeerName off
>     SSLCertificateFile /etc/httpd/conf/any.example.com.crt
>     SSLCertificateKeyFile /etc/httpd/conf/any.example.com.key
>    CustomLog "logs/example.com_access.log" combined
>    ErrorLog "logs/example.com_error.log"

   RewriteEngine on
>    RewriteRule "^/?(.*)" "https://theportail.example.com/$1" [P]
>  </VirtualHost>
>

My question is: "Am I wrong about the Shibboleth's protection of spoofing
cookie? And if not, is there any way to disable it?"

Thank you for your help again

2016-10-04 15:33 GMT+02:00 reda sabir <sabiretude at gmail.com>:

> Hello Peter,
>
> all you need to do is map both vhosts to the same content in the webserver
>> (as usual)
>> and add protocol endpoints for both vhosts to the SAML Metadata
>> describing that SP. (Essentially duplicating the ACS URLs for the
>> second vhost). That's all. No rewrites, no ApplicationOverrides.
>>
>
> Of course, what you suggest is the easiest configuration and the more
> logical one. The problem with this is that we can't do that because the App
> that is protected is Liferay and use fqdn to know wich "site" it will
> shows. So in the liferay, we have set-up a site for siteA and it would cost
> us a lot to duplicate it to another one with hostname siteb and maintained
> it. That's why we try to make URL rewriting.
>
>
>> The problem that I got is that Shibboleth thinks that I'm trying to spoof
>> his cookies when I access the URL http://siteA.
>
> This statement wasn't true. What's happening is that Shibboleth set
> headers because of "*ShibUseHeaders On*" and so when the request is
> proxied to http://siteB, shibboleth think that someone has tried to spoof
> headers.  So what I did is deleted this line.
>
> Now I don't have the error "*Attempt to spoof header (Shib-Cookie-Name)
> was detected*" as expected, but I don't have SSO.
>
> 2016-10-04 11:18 GMT+02:00 Peter Schober <peter.schober at univie.ac.at>:
>
>> * Peter Schober <peter.schober at univie.ac.at> [2016-10-04 11:14]:
>> > > >    <Location />
>> > > >        AuthType shibboleth
>> > > >        Require shibboleth
>> > > >        ShibRequestSetting applicationId default
>> >
>> > The default applicationId is "default", so at best that does nothing.
>>
>> Well, unless you have other config you didn't mention that uses
>> ApplicationOverride and sets the applicationId to a non-default value.
>> -peter
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161004/60e504c1/attachment-0001.html>