Chaining Session hooks? (resurrected)

[Jan Vilhuber]

> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
> Sent: Tuesday, June 6, 2017 9:33 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: Chaining Session hooks? (resurrected)
> 
> On 6/6/17, 9:34 AM, "users on behalf of Jan Vilhuber" <users-
> bounces at shibboleth.net on behalf of JVilhuber at absolute.com> wrote:
> 
> > I guess I still misunderstood how aggressively sessionhook does loop
> detection.
> 
> All it does is check for a parameter on the URL, and until you send control back
> to the SP's URL, it does nothing. It can't, it isn't involved.
> 
> > I had run a test that showed I COULD actually run hookA and have it
> > redirect to hookB (except I didn't use a 302, but for testing had
> > hookA display variables I could look at and then display a link to
> > hookB to simulate the call to hookB, which worked when clicked on!
> > apparently that wasn't a valid test, though). What I'm seeing now is:
> > SP does a 302 redirect to hookA. hookA does a
> > 302 redirect to hookB. The intention was to have hookB redirect to 'return'.
> 
> That will work fine.
> 
[JV:] I found a bug in my tests, and it appears it DOES work, meaning there's a similar bug in the production sequence/environment.


> > But what I see instead is a 301 redirect, which I'm pretty certain
> > comes from the SP, which redirects back to hookB. This results in a 404 for
> hookB.
> 
> There is no 301 coming from the SP, all its redirects should be 302s. If I had to
> guess, maybe you have the SP configured to treat one or both of the hooks as
> protected resources, which for obvious reasons you can't allow.
> 
[JV:] Wait, the sessionhook is called AFTER the assertion has been processed, at which point the shib-session is authenticated. I DO in fact have the sessionhook locations marked as protected resources, and it WORKS. I can't really see this being a non-protected resources, since session-setup MUST be done after authenticated ONLY. To me being able to access a sessionhook as an UNPROTECTED resource would be a security violation.

Jan