SP assistance needed for "Attempt to spoof header"

Mon Feb 20 02:43:01 EST 2017

We have two PeopleSoft sites running on IIS, one for HCM and one for CS. Each site has a distinct FQDN and has been configured as a distinct Shibboleth SP for a little over a year and this has been a very successful integration for us.

Recently a project was initiated to implement a feature of HCM that must be made available through the CS interface. To accomplish this, a Content Reference (CREF) was created in a test environment to pull the HCM content into CS. Unfortunately I don't know much about CREFs at this point, but I think of them something like an iframe (sample below). Unfortunately this configuration has presented some challenges regarding the configuration of our SPs for these environments. When an authenticated user enters a page in CS that contains a CREF referencing HCM, most elements of the protected page appear fine but the IdP logon page appears in the portion of the page that should display the HCM content, and native.log reports "Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected."

The only way I've been able to get the CREF elements to function is by modifying the SP configuration for HCM to set checkSpoofing="false" and the RequestMap to requireSession="false" for the few query string parameters I've identified that trigger the spoof prevention. However, this is not a configuration I feel comfortable moving to production.

I've been unable to find details about the exact behavior of the checkSpoofing feature of the SP and what exactly causes it to trigger, and I'm finding it difficult to troubleshoot the problem. Setting REMOTE_ADDR="X-Forwarded-For" on both SPs and then on each of them independently does not appear to change the behavior of the problem, although I've confirmed the source IP is available to the SP in that configuration. I need advice on how to troubleshoot the problem and determine exactly what causes the spoof protection to fire.

==========
native.log
==========
2017-02-20 00:37:52 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/psc/hcmdev/EMPLOYEE/PONY/c/ROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL?NAVSTACK=Clear&a=a&PORTALPARAM_PTCNAV=HC_EP_CURRENT_MY_PRF_EE_GBL&EOPP.SCNode=HRMS&EOPP.SCPortal=EMPLOYEE&EOPP.SCName=CO_EMPLOYEE_SELF_SERVICE&EOPP.SCLabel=My%20Performance%20Documents&EOPP.SCFName=HC_EP_MY_PRF_DOCS_EE_GBL&EOPP.SCSecondary=true&EOPP.SCPTfname=HC_EP_MY_PRF_DOCS_EE_GBL&FolderPath=PORTAL_ROOT_OBJECT.CO_EMPLOYEE_SELF_SERVICE.HC_EP_EE_SELF_SERVICE_GBL.HC_EP_MY_PRF_DOCS_EE_GBL.HC_EP_CURRENT_MY_PRF_EE_GBL&IsFolder=false&PortalActualURL=https%3a%2f%2fhcmtestsite.university.edu%2fpsc%2fhcmdev%2fEMPLOYEE%2fPONY%2fc%2fROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL%3fNAVSTACK%3dClear%26a%3da&PortalContentURL=https%3a%2f%2fhcmtestsite.university.edu%2fpsc%2fhcmdev%2fEMPLOYEE%2fPONY%2fc%2fROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL%3fNAVSTACK%3dClear%26a%3da&PortalContentProvider=PONY&PortalCRefLabel=Current%20Documents&PortalRegistryName=EMPLOYEE&PortalServletURI=https%3a%2f%2fcstestsite.university.edu%2fpsp%2fcsdev%2f&PortalURI=https%3a%2f%2fcstestsite.university.edu%2fpsc%2fcsdev%2f&PortalHostNode=HRMS&NoCrumbs=yes&PortalKeyStruct=yes to default
2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: sending message (default::getHeaders::Application)
2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: trying to connect to listener
2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: socket (832) connected successfully
2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: send completed, reading response message
2017-02-20 00:37:52 DEBUG Shibboleth.SessionInitiator.SAML2 [2692] isapi_shib: attempting to initiate session using SAML 2.0 with provider (https://idp.university.net/idp/shibboleth)
2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: sending message (default/Login::run::SAML2SI)
2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: send completed, reading response message
2017-02-20 00:37:52 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/Shibboleth.sso/SAML2/POST to default
2017-02-20 00:37:52 DEBUG Shibboleth.ISAPI [2692] isapi_shib_extension: mapped https://hcmtestsite.university.edu/Shibboleth.sso/SAML2/POST to default
2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib_extension: sending message (default/SAML2/POST)
2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib_extension: send completed, reading response message
2017-02-20 00:37:53 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/psc/hcmdev/EMPLOYEE/PONY/c/ROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL?NAVSTACK=Clear&a=a&PORTALPARAM_PTCNAV=HC_EP_CURRENT_MY_PRF_EE_GBL&EOPP.SCNode=HRMS&EOPP.SCPortal=EMPLOYEE&EOPP.SCName=CO_EMPLOYEE_SELF_SERVICE&EOPP.SCLabel=My%20Performance%20Documents&EOPP.SCFName=HC_EP_MY_PRF_DOCS_EE_GBL&EOPP.SCSecondary=true&EOPP.SCPTfname=HC_EP_MY_PRF_DOCS_EE_GBL&FolderPath=PORTAL_ROOT_OBJECT.CO_EMPLOYEE_SELF_SERVICE.HC_EP_EE_SELF_SERVICE_GBL.HC_EP_MY_PRF_DOCS_EE_GBL.HC_EP_CURRENT_MY_PRF_EE_GBL&IsFolder=false&PortalActualURL=https%3a%2f%2fhcmtestsite.university.edu%2fpsc%2fhcmdev%2fEMPLOYEE%2fPONY%2fc%2fROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL%3fNAVSTACK%3dClear%26a%3da&PortalContentURL=https%3a%2f%2fhcmtestsite.university.edu%2fpsc%2fhcmdev%2fEMPLOYEE%2fPONY%2fc%2fROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL%3fNAVSTACK%3dClear%26a%3da&PortalContentProvider=PONY&PortalCRefLabel=Current%20Documents&PortalRegistryName=EMPLOYEE&PortalServletURI=https%3a%2f%2fcstestsite.university.edu%2fpsp%2fcsdev%2f&PortalURI=https%3a%2f%2fcstestsite.university.edu%2fpsc%2fcsdev%2f&PortalHostNode=HRMS&NoCrumbs=yes&PortalKeyStruct=yes to default
2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: searching local cache for session (_4ce68e6035c2dfa9a023adef97b14b2e)
2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: session not found locally, remoting the search
2017-02-20 00:37:53 DEBUG Shibboleth.Listener [2692] isapi_shib: sending message (find::StorageService::SessionCache)
2017-02-20 00:37:53 DEBUG Shibboleth.Listener [2692] isapi_shib: send completed, reading response message
2017-02-20 00:37:53 DEBUG Shibboleth.ServiceProvider [2692] isapi_shib: doAuthentication succeeded
2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: searching local cache for session (_4ce68e6035c2dfa9a023adef97b14b2e)
2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: session found locally, validating it for use
2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: unmarshalled attribute (ID: cn) with 1 value
2017-02-20 00:38:22 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/psp/hcmdev/?cmd=start to default
2017-02-20 00:38:22 ERROR Shibboleth.ISAPI [2692] isapi_shib: Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.
2017-02-20 00:38:23 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/psc/hcmdev_1/EMPLOYEE/PONY/c/EP_WC_LAUNCH.EP_WC_STEP_PAGELET.GBL?target=HC_EP_STEP_PAGELET_GBL&unPgltRequest=true&PTAL_ID=EMPLOYEE.HC_EP_WC_LAUNCH_GBL&PAGELET_OBJNAME=HC_EP_STEP_PAGELET_GBL&pageletname=HC_EP_STEP_PAGELET_GBL&&pgltnode=HRMS&PTAL_TAB=1&pageletname=HC_EP_STEP_PAGELET_GBL&PTAL_ID=EMPLOYEE.HC_EP_WC_LAUNCH_GBL&PTAL_TAB=1&PAGELET_OBJNAME=HC_EP_STEP_PAGELET_GBL&pgltnode=HRMS&unPgltRequest=true&PortalRegistryName=EMPLOYEE&PortalServletURI=https%3a%2f%2fcstestsite.university.edu%2fpsp%2fcsdev%2f&PortalURI=https%3a%2f%2fcstestsite.university.edu%2fpsc%2fcsdev%2f&PortalHostNode=HRMS&PortalIsPagelet=true&NoCrumbs=yes&PortalCrefName=HC_EP_STEP_PAGELET_GBL to default
2017-02-20 00:38:23 ERROR Shibboleth.ISAPI [2692] isapi_shib: Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170220/c5cd42d8/attachment.html>