SP ReverseProxy no attributes
Nathan Hughes
nathan.hughes at badgepass.com
Wed Feb 22 12:56:52 EST 2017
> Ok, then what specifically is not getting through? The SAML portions don't involve the resources, just the SP/proxy. Once that session is established, then requests for "resources" that actually live behind the proxy should pass through the SP with a session, and the attributes will then be attached to the request within Apache.
> To get anything to the back-end, you must use Apache commands like SetHeader to create data flowing to the back-end based on, e.g. system/environment variable data set on the front-end. That's generally how you have to set things up with the SP in front.
So I need to use Apache commands to set the attributes, received by the IdP, to the request header that is proxied to my resource after authentication.
What do you mean by your example: 'system/environment variable data set on the front-end'
Nathan Hughes
----------------------------------------------------------------------
Today's Topics:
1. RE: SP ReverseProxy no attributes (Nathan Hughes)
2. RE: SP ReverseProxy no attributes (Cantor, Scott)
3. RE: v3.2 - unsupportable identifier -Name ID (Ramaiah, Vanna G.)
----------------------------------------------------------------------
Message: 1
Date: Tue, 21 Feb 2017 22:08:27 +0000
From: Nathan Hughes <nathan.hughes at badgepass.com>
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: RE: SP ReverseProxy no attributes
Message-ID:
<SN1PR0501MB2015314CD1F3FFDE46968229F7510 at SN1PR0501MB2015.namprd05.prod.outlook.com>
Content-Type: text/plain; charset="us-ascii"
The SP is on a proxy in front of the resources.
The way it is setup now:
1. Windows PC with SP and Apache
2. IBM iSeries with Apache and protected resource
3. IdP
User tries to hit 2, gets proxied to 1. Authenticates with 3, and gets proxied back to 2.
Is there an issue with the user hitting 2, and not 1 as the first step?
Nathan Hughes
Software Developer
601.499.2131 Office
280 Trace Colony Park
Ridgeland, MS 39157
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of users-request at shibboleth.net
Sent: Tuesday, February 21, 2017 3:56 PM
To: users at shibboleth.net
Subject: users Digest, Vol 68, Issue 117
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific than "Re: Contents of users digest..."
Today's Topics:
1. Re: IdP 3.1.1 Unable to resolve outbound message endpoint (privas)
2. RE: IdP 3.1.1 Unable to resolve outbound message endpoint
(Cantor, Scott)
3. SP ReverseProxy no attributes (Nathan Hughes)
4. RE: SP ReverseProxy no attributes (Cantor, Scott)
----------------------------------------------------------------------
Message: 1
Date: Tue, 21 Feb 2017 11:02:46 -0700 (MST)
From: privas <pedro.rivas664 at csuci.edu>
To: users at shibboleth.net
Subject: Re: IdP 3.1.1 Unable to resolve outbound message endpoint
Message-ID: <1487700166426-7631546.post at n2.nabble.com>
Content-Type: text/plain; charset=us-ascii
Turning on OpenSAML helped. I ended up seeing this error:
Endpoint Resolver
org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Neither candidate endpoint location '<link>' nor response location 'null' matched '<link>'.
I replaced the <link>
I'm not sure what that means but I'm going to run through the tutorial on service providers this Friday.
Thank you all!
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/IdP-3-1-1-Unable-to-resolve-outbound-message-endpoint-tp7613400p7631546.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
------------------------------
Message: 2
Date: Tue, 21 Feb 2017 18:11:11 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: IdP 3.1.1 Unable to resolve outbound message endpoint
Message-ID:
<9846A6064BD102419D06814DD0D78DE11BFC8087 at CIO-TNC-D2MBX02.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> Turning on OpenSAML helped. I ended up seeing this error:
I'm fairly certain the error is logged adequately on the default levels, but then again I'm referring to an actually current and supported version, which 3.1.1 is most certainly not.
-- Scott
------------------------------
Message: 3
Date: Tue, 21 Feb 2017 21:18:20 +0000
From: Nathan Hughes <nathan.hughes at badgepass.com>
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: SP ReverseProxy no attributes
Message-ID:
<SN1PR0501MB20155BD4CF711294789FE76FF7510 at SN1PR0501MB2015.namprd05.prod.outlook.com>
Content-Type: text/plain; charset="us-ascii"
Since we have an abnormal situation, I've setup a shibboleth SP on a Windows box with Apache. I had to do this since our hosting server is an IBM iSeries with Apache. The root problem is that I receive no POST data passed on to my resource. Here are the steps in my test environment:
Step 1: User visits protected resource
Step 2: Using a reverse proxy, user is proxied to my Windows machine's apache server.
Step 3: The protected resource attempt is intercepted and sent to testshib IdP Step 4: The user authenticates, and the IdP responds with a SAML assertion POST to my SP Step 5: Using reverse proxy again, the SP then proxies the user to the protected resource with a 'getpostdata' method waiting for the POST data, but there is nothing sent to the resource.
I've read a bit about the relayState, and trying to store the data in 'ss:mem' and 'cookie', but neither forward the data.
Also, I may be wrong, but Apache's ProxyPass and ProxyPassReverse should forward that data without having to use mod_headers.
What am I missing?
Thanks,
Nathan Hughes
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170221/33f2b491/attachment-0001.html>
------------------------------
Message: 4
Date: Tue, 21 Feb 2017 21:55:36 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: SP ReverseProxy no attributes
Message-ID:
<9846A6064BD102419D06814DD0D78DE11BFC832D at CIO-TNC-D2MBX02.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> Since we have an abnormal situation, I've setup a shibboleth SP on a
> Windows box with Apache. I had to do this since our hosting server is
> an IBM iSeries with Apache. The root problem is that I receive no
> POST data passed on to my resource.
You're going to have to explain what you're trying to do in more precise terms, but the short of it is that the SP can protect resources on its own server or that that server is itself proxying traffic back to. The SP is either with the resources or is on a proxy in front of those resources. I can't tell if that's what you're doing or not.
-- Scott
------------------------------
Subject: Digest Footer
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
------------------------------
End of users Digest, Vol 68, Issue 117
**************************************
------------------------------
Message: 2
Date: Tue, 21 Feb 2017 22:42:02 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: SP ReverseProxy no attributes
Message-ID:
<9846A6064BD102419D06814DD0D78DE11BFC83A6 at CIO-TNC-D2MBX02.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> The SP is on a proxy in front of the resources.
Ok, then what specifically is not getting through? The SAML portions don't involve the resources, just the SP/proxy. Once that session is established, then requests for "resources" that actually live behind the proxy should pass through the SP with a session, and the attributes will then be attached to the request within Apache.
To get anything to the back-end, you must use Apache commands like SetHeader to create data flowing to the back-end based on, e.g. system/environment variable data set on the front-end. That's generally how you have to set things up with the SP in front.
> User tries to hit 2, gets proxied to 1. Authenticates with 3, and
> gets proxied back to 2.
No, 2 has to be completely invisible to the client, and can never, ever be accessed directly. It's a detail between 1 and 2 to serve the resources virtually hosted by 1 but actually living on 2. All the URLs must refer to 1.
> Is there an issue with the user hitting 2, and not 1 as the first step?
Totally, that's out of the question. No access to 2 under any circumstances except via 1 or under very controlled circumstances for internal testing.
-- Scott
------------------------------
Message: 3
Date: Tue, 21 Feb 2017 23:20:50 +0000
From: "Ramaiah, Vanna G." <ramaiah at musc.edu>
To: "'Shib Users'" <users at shibboleth.net>
Subject: RE: v3.2 - unsupportable identifier -Name ID
Message-ID:
<AE3FEB1BD25D22479E9F293EBBF869B9015C4EF888 at exg-mb10a.clinlan.local>
Content-Type: text/plain; charset="us-ascii"
I read the document but I am still missing something and getting invalid NameIdentified error. Below is my configuration.What am I missing?
1. In attribute-resolver,
<resolver:AttributeDefinition id="EmailNameIdspecified" xsi:type="ad:Simple" sourceAttributeID="mail"> <resolver:Dependency ref="myAD" />
<resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" />
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
</resolver:AttributeDefinition>
2. In attribute-filter,
<afp:AttributeFilterPolicy id="releaseToXYZ">
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="XYZ"/>
<afp:AttributeRule attributeID="EmailNameIdspecified"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
</afp:AttributeFilterPolicy>
3.In metadata of xyz,
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
4. In saml-nameid.xml, I have
<util:list id="shibboleth.SAML2NameIDGenerators">
<ref bean="shibboleth.SAML2TransientGenerator" />
<ref bean="shibboleth.SAML2PersistentGenerator" />
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
p:attributeSourceIds="#{ {'mail'} }" /> </util:list> 5. All lines are commented out in saml-nameid.properties
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, February 21, 2017 11:25 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: v3.2 - unsupportable identifier -Name ID
> 2017-02-21 11:08:32,722 - WARN
> [org.opensaml.saml.common.profile.logic.MetadataNameIdentifierFormatSt
> rategy:75] - Ignoring NameIDFormat metadata that includes the 'unspecified'
> format
Please just read the documentation on NameID format selection. I'm not going to repeat it here.
> Other SP , after logging in, if I click a link, it's supposed to
> display all attributes passed by Idp. It's not showing up. Both the
> SP's both work fine in V2.4
Then you didn't accurately reproduce your relying party overrides in the new system (or your old system was not configured properly and was only working by accident) and you are not selecting the NameID Format to use via an override with a nameIDFormatPrecedence setting.
Or you can stop using unspecified. Pass a proper Format with the same value in it, and put that Format into the SP's metadata in a NameIDFormat element.
-- Scott
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
------------------------------
Subject: Digest Footer
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
------------------------------
End of users Digest, Vol 68, Issue 118
**************************************
More information about the users
mailing list