Attempt to spoof header (Shib-Cookie-Name) was detected

[reda sabir]

I have found the answer of my question:
Yes, Shibboleth prevent from stealing cookie's session by keeping a table
of Session Cookie and the correspondent address IP. And to disable this
protection, you need to change the <Session> element in your
shibboleth2.xml and add the attribute consistentAddress="false". Here's
what says the doc:

> When true, the SP will remember the IP address used when creating a
> session and ensure that all subsequent access associated with this session
> come from the same address. This can help protect against cookie theft and
> is less likely than the checkAddress setting to block legitimate access.


Of course, disabling protection from cookie theft is very bad idea and
should be avoided.An other solution would be to have a list of exceptions
like 127.0.0.1. So is there any way to do that, or is it not developed yet?

2016-10-04 16:42 GMT+02:00 reda sabir <sabiretude at gmail.com>:

> Hello again,
>
> So I have dug a bit by analysing the network echanges (tcpdump &
> wireshark) and I've found that my session cookie is sent correctly to the
> Reverse Proxy siteA and is proxied correctly to siteA but is deleted this
> session by shibboleth in the response. This makes me think that shibboleth
> have some protection that decline any cookie that is not sent from the same
> IP as set-cookie was sent to. This means that Shibboleth try to protect
> from spoofing the cookie containing the session.
>
> So let me detail more my setup to understand what I'm doing:
> Let's assume siteA is portal.example.com and siteB is
> theportal.example.com. This two fqdn have the same root (example.com) so
> I configure the domain of the cookie as example.com so I can have SSO
> between the two sites. Because I want only redirection without changing the
> url, I had simplified the httpd conf of portail.example.com to have this :
>
> <VirtualHost *:80>
>>    ServerName portail.example.com
>>    Redirect 307 / https://portail.example.com/
>> </VirtualHost>
>>  <VirtualHost *:443>
>>     ServerName portail.example.com
>>     SSLEngine On
>>     SSLProxyEngine On
>>     SSLProxyVerify none
>>     SSLProxyCheckPeerCN off
>>     SSLProxyCheckPeerName off
>>     SSLCertificateFile /etc/httpd/conf/any.example.com.crt
>>     SSLCertificateKeyFile /etc/httpd/conf/any.example.com.key
>>    CustomLog "logs/example.com_access.log" combined
>>    ErrorLog "logs/example.com_error.log"
>
>    RewriteEngine on
>>    RewriteRule "^/?(.*)" "https://theportail.example.com/$1" [P]
>>  </VirtualHost>
>>
>
> My question is: "Am I wrong about the Shibboleth's protection of spoofing
> cookie? And if not, is there any way to disable it?"
>
> Thank you for your help again
>
> 2016-10-04 15:33 GMT+02:00 reda sabir <sabiretude at gmail.com>:
>
>> Hello Peter,
>>
>> all you need to do is map both vhosts to the same content in the
>>> webserver (as usual)
>>> and add protocol endpoints for both vhosts to the SAML Metadata
>>> describing that SP. (Essentially duplicating the ACS URLs for the
>>> second vhost). That's all. No rewrites, no ApplicationOverrides.
>>>
>>
>> Of course, what you suggest is the easiest configuration and the more
>> logical one. The problem with this is that we can't do that because the App
>> that is protected is Liferay and use fqdn to know wich "site" it will
>> shows. So in the liferay, we have set-up a site for siteA and it would cost
>> us a lot to duplicate it to another one with hostname siteb and maintained
>> it. That's why we try to make URL rewriting.
>>
>>
>>> The problem that I got is that Shibboleth thinks that I'm trying to
>>> spoof his cookies when I access the URL http://siteA.
>>
>> This statement wasn't true. What's happening is that Shibboleth set
>> headers because of "*ShibUseHeaders On*" and so when the request is
>> proxied to http://siteB, shibboleth think that someone has tried to
>> spoof headers.  So what I did is deleted this line.
>>
>> Now I don't have the error "*Attempt to spoof header (Shib-Cookie-Name)
>> was detected*" as expected, but I don't have SSO.
>>
>> 2016-10-04 11:18 GMT+02:00 Peter Schober <peter.schober at univie.ac.at>:
>>
>>> * Peter Schober <peter.schober at univie.ac.at> [2016-10-04 11:14]:
>>> > > >    <Location />
>>> > > >        AuthType shibboleth
>>> > > >        Require shibboleth
>>> > > >        ShibRequestSetting applicationId default
>>> >
>>> > The default applicationId is "default", so at best that does nothing.
>>>
>>> Well, unless you have other config you didn't mention that uses
>>> ApplicationOverride and sets the applicationId to a non-default value.
>>> -peter
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161004/9f7e8954/attachment.html>