shibd, ApplicationOverride not being acted on ... ?

[Steven Carmody]

HI,

My shibd.log file shows shibd receiving a request for applicationId 
risd. However, its constructing a response for applicationId default. 
There's nothing in the shibd.log indicating an ERROR or WARN; it just 
switches to using default. I'm stumped. Can anyone see anything wrong 
with the ApplicationOverride element down below ?

An interesting clue is that on my test machine the first two log lines 
look like this:

2018-04-13 14:18:31 DEBUG Shibboleth.Listener [93]: dispatching message 
(risd::getHeaders::Application)
2018-04-13 14:18:31 DEBUG Shibboleth.Listener [93]: dispatching message 
(risd/Login::run::SAML2SI)

note that it has risd on both the getHeaders line and the /Login line.

Here's the shibd.log lines from the PROD server (note that line 2 is now 
default/Login)

2018-04-13 14:06:15 DEBUG Shibboleth.Listener [1]: dispatching message 
(risd::getHeaders::Application)

2018-04-13 14:06:15 DEBUG Shibboleth.Listener [1]: dispatching message 
(default/Login::run::SAML2SI)

2018-04-13 14:06:15 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: 
validating input

2018-04-13 14:06:15 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: 
marshalling, deflating, base64-encoding the message

2018-04-13 14:06:15 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: 
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://www.cis-qas.brown.edu/risd/Shibboleth.sso/SAML2/POST" 
Destination="https://sso.brown.edu/idp/profile/SAML2/Redirect/SSO" 
ID="_4e56c228b9fb66a9f078d6e3bb675faa" 
IssueInstant="2018-04-13T18:06:15Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Version="2.0"><saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://www.cis-qas.brown.edu/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy 
AllowCreate="1"/></samlp:AuthnRequest>

2018-04-13 14:06:15 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: 
message encoded, sending redirect to client

-----------------------------------------------

Here's the ApplicationOverride element for applicationId risd:

<ApplicationOverride id="risd" >
    <Sessions lifetime="28800" timeout="3600" checkAddress="false"
    handlerURL="/cis/sta/dev/burke/RISD/Shibboleth.sso" handlerSSL="true"
    idpHistory="false" idpHistoryDays="7"
    cookieProps="; path=/cis/sta/dev/burke/RISD">

       <SessionInitiator type="Chaining" Location="/Login"
       isDefault="true" relayState="cookie"
       entityID="https://eis-sso-test.risd.edu:9443/samlsso">
          <SessionInitiator type="SAML2" defaultACSIndex="1"
          template="bindingTemplate.html" />
          </SessionInitiator>

    </Sessions>
</ApplicationOverride>

this file is on Brown's main PROD web server. And yes, you're looking at 
SessionInitiator elements, NOT SSO elements. Let me apologize profusely 
on behalf of the local unix team, which manages this server.

all thoughts and suggestions welcome !