shibd service not responding, sometimes ...

[Steven Carmody]

On 9/16/16 3:05 PM, Cantor, Scott wrote:
>
>> Yes, I know, the default and the Override both contain the same SSO
>> info.
>
> Then why have the override?

When this is resolved, the default will go directly to the Brown IDP; 
the override will go to a DS.

However, triggering the override produced just a single line in the 
shibd.log file; to troubleshoot I changed the default to also go to the 
DS, to verify that the "redirect to the DS" process was working OK.

>> If my browser goes to a url that maps to the override, I see this
>> shortened entry in the shibd log, I'mnot redirected anywhere, and
>> access control fails (no IDP supplied attributes).
>
> That would imply to me there's no rule anywhere requiring a session
> for that request. That doesn't suggest anything is behaving wrong,
> just that it's not configured in a way that fits the intended
> behavior.
>
> If this is Apache, there should be no need to use the RequestMap
> anywhere, and eliminating that would likely prevent various sorts of
> risky overlaps and conflicts that might end up screwing up the
> effective rules it's using.
>

I removed the RequestMap entry. I now have this configured into apache:

<Location /academics/college>
   ShibCompatWith24 On
   AuthType shibboleth
   ShibRequestSetting requireSession 1
   require Shib-isMemberOf ORG:CIS:People:Staff:UNIX-team
   require user ckeith at brown.edu
   require user pbaptist at brown.edu
   require stc at brown.edu
   ShibRequestSetting applicationId discovery-brown
</Location>

When I go to that url in my Browser, shibd.log contains this one line:

2016-09-19 09:45:40 DEBUG Shibboleth.Listener [1]: dispatching message 
(discovery-brown::getHeaders::Application)

and native-warn-log contains these lines:

2016-09-19 09:45:40 ERROR Shibboleth.Apache [28977] shib_auth_checker: 
htaccess: require Shib-isMemberOf not given a valid session, are you 
using lazy sessions?

2016-09-19 09:45:40 ERROR Shibboleth.Apache [28977] shib_auth_checker: 
htaccess: require Shib-isMemberOf not given a valid session, are you 
using lazy sessions?

2016-09-19 09:45:40 ERROR Shibboleth.Apache [28977] shib_auth_checker: 
htaccess: require user not given a valid session, are you using lazy 
sessions?

2016-09-19 09:45:40 ERROR Shibboleth.Apache [28977] shib_auth_checker: 
htaccess: require user not given a valid session, are you using lazy 
sessions?

2016-09-19 09:45:40 WARN Shibboleth.ServiceProvider [28977] 
shib_auth_checker: access control provider denied access

and here's the ApplicationOverride element:

	<ApplicationOverride id="discovery-brown" >
               <Sessions handlerURL="/academics/college/Shibboleth.sso" 
handlerSSL="true"
                         cookieProps="; path=/academics/college" >
             		<SSO discoveryProtocol="SAMLDS" 
discoveryURL="https://wayf.brown.edu/choose/qa-bs-col">
                         SAML2 SAML1
                     </SSO>
               </Sessions>
         </ApplicationOverride>

Its clear that mod_shib is proceeding without any session,a nd without 
any info about the user. I don't understand, tho, why I'm not being 
redirected to the DS, as configured in the ApplicationOverride element. 
The shibd.log line does show that mod_shib is matching the url, and 
triggering the override. But, for unknown reasons, shibd isn't doing its 
normal processing.

I just noticed -- the metadata for this service does NOT contain any 
endpoint urls that use the path referenced in the ApplicationOverride -- 
but, I don't think that would cause things to fail at this point ? It 
would probably fail when the DS redirects back to apache.

Thanks for any suggestions !