Shibboleth SP logout issue

[Cantor, Scott]

> I updated it to...
>     <Location /Shibboleth.sso>
> 
>         SetHandler shib
>         Satisfy Any
>         Allow from all
>     </Location>
> 
> And now the request actually gets sent to the IDP, and the IDP responds.  I
> still get an error, but its further.

I don't understand that at all, and this isn't the first claim made about that, it's the reason I updated the config templates.

It makes no sense. Even if the Apache server was preventing the requests, you can't possibly get it to go all the way through processing the request (which the logs show it did) and then have it fail.

I have also never reproduced this, so I'm pretty sure it's some kind of Apache setting I'm not using in my tests. I know 2.4 is very locked down out of the box now, so probably I need a fresh VM to test it. But I can't see how that wouldn't just throw back a 403 immediately if it's denying access.

The Set-Handler part is in fact meaningless, that's historical. Maybe it's even causing the problem.

-- Scott