shibd service not responding, sometimes ...

[Steven Carmody]

On 9/19/16 10:06 AM, Cantor, Scott wrote:
>> I removed the RequestMap entry. I now have this configured into apache:
>>
>> <Location /academics/college>
>
> I imagine you also have another <Location> block somewhere else that
overlaps with that, and is taking precedence. There's no other explanation.
>

I acted on that advice. Note that apache and shibd are on different 
machines, but use the same shibboleth2.xml file.

We created a new top level folder in apache's Directory path in order to 
get away from unknown or unexpected .htaccess and Location blocks.

The .htaccess file at the apache root contains this:

  AuthType Shibboleth
  ShibRequireSession Off
  require shibboleth

The .htaccess file in the new directory contains:

   ShibCompatWith24 On
   AuthType shibboleth
   ShibRequestSetting requireSession 1
   require user stc at brown.edu
   require Shib-isMemberOf ORG:CIS:People:Staff:UNIX-team
   require user ckeith at brown.edu
   require user pbaptist at brown.edu
   ShibRequestSetting applicationId discovery-brown

the shibboleth2.xml file contains this:

<ApplicationOverride id="discovery-brown" >
	<Sessions handlerURL="/academics/college/Shibboleth.sso" handlerSSL="true"
		cookieProps="; path=/academics/college" >
		<SSO discoveryProtocol="SAMLDS" 
discoveryURL="https://wayf.brown.edu/choose/qa-bs-col">
                         SAML2 SAML1
		</SSO>
	</Sessions>
</ApplicationOverride>

When I enter the url for this new path into my browser, I get this (and 
only this) in shibd.log:

2016-09-23 10:36:29 DEBUG Shibboleth.Listener [15]: dispatching message 
(discovery-brown::getHeaders::Application)

native log contain the info at the bottom of this note.

Apache is matching the path, and finding the .htaccess file, and asking 
shibd about discovery-brown -- and apparently mod_shib is reading a 
response from shibd. But, the shibd log file content is too spartan to 
indicate that shibd acted as expected. I would have expected several 
other lines.

Is there a way to turn up logging even further in order to get some 
clues about why shibd isn't returning the expected info ?

thanks.


2016-09-23 10:29:55 DEBUG Shibboleth.Apache [17356] shib_check_user: 
mapped https://www.cis-qas.brown.edu/stc/ to discovery-brown
2016-09-23 10:29:55 DEBUG Shibboleth.Listener [17356] shib_check_user: 
sending message (discovery-brown::getHeaders::Application)
2016-09-23 10:29:55 DEBUG Shibboleth.Listener [17356] shib_check_user: 
trying to connect to listener
2016-09-23 10:29:55 DEBUG Shibboleth.Listener [17356] shib_check_user: 
socket (14) connected successfully
2016-09-23 10:29:55 DEBUG Shibboleth.Listener [17356] shib_check_user: 
send completed, reading response message
2016-09-23 10:29:55 DEBUG Shibboleth.Apache [17356] shib_auth_checker: 
mapped https://www.cis-qas.brown.edu/stc/ to discovery-brown
2016-09-23 10:29:55 ERROR Shibboleth.Apache [17356] shib_auth_checker: 
htaccess: require user not given a valid session, are you using lazy 
sessions?
2016-09-23 10:29:55 ERROR Shibboleth.Apache [17356] shib_auth_checker: 
htaccess: require Shib-isMemberOf not given a valid session, are you 
using lazy sessions?
2016-09-23 10:29:55 ERROR Shibboleth.Apache [17356] shib_auth_checker: 
htaccess: require user not given a valid session, are you using lazy 
sessions?
2016-09-23 10:29:55 ERROR Shibboleth.Apache [17356] shib_auth_checker: 
htaccess: require user not given a valid session, are you using lazy 
sessions?
2016-09-23 10:29:55 DEBUG Shibboleth.Apache [17356] shib_auth_checker: 
htaccess: no rules were successful, denying access
2016-09-23 10:29:55 WARN Shibboleth.ServiceProvider [17356] 
shib_auth_checker: access control provider denied access