shib SP 2.5.3 and apache 2.4 AccesControl require session

[Jehan Procaccia]

Hello,

On my old server with shib SP 2.4.3 and apache 2.2.16-6 I use to protect 
a login location with

<Location /shibwayf>
  AuthType shibboleth
  ShibRequestSetting requireSession 0
  require shibboleth
# require valid-user
</Location>

and it worked fine, REMOTE_USER was populated with eppn attribute

Now on my new server with shibboleth 2.5.3  and apache 2.4.18 , 
REMOTE_USER keeps beeing empty

shibboleth2.xml does contains : <ApplicationDefaults 
entityID="http://cat-med.int.fr/sp"
*REMOTE_USER="eppn* persistent-id targeted-id">

I did adapted (I think, unless miss enterpreted ?)  shib directives in 
apache according to

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig

so now I have

<Location /shibwayf>
  ShibRequireSession On
  AuthType shibboleth
  require shib-session
</Location>

but my perl script that returns shib vars , keeps showing REMOTE_USER 
empty, and no eppn attribute

Although shibd transaction.log file does show

2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]: New session (ID: 
_55603840c23568736392b95fa148915c) with (applicationId: default) for 
principal from (IdP: https://idp3.int.fr/idp/shibboleth) at 
(ClientAddress: 137.149.2.21) with (NameIdentifier: 
AAdzZWNyZXQxLGNVJLa11v9lqrUjFkxbiOPuDtRXTo/f0NuZPQ4hbu/CQUMS3Tw8ASwSiT0sXdM3a6r4wSsJsp4eUpz3UiWclieM/KJt0e1VfsCfJml6IKX0btnOg4THDxVibOn3gHL8kmZiXmWSz+F1Lz6Klf4=) 
using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from 
(AssertionID: _d8df6c0d8f905f32af0fc3e766d9a911)
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]: Cached the 
following attributes with session (ID: 
_55603840c23568736392b95fa148915c) for (applicationId: default) {
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]: entitlement (7 values)
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]:     sn (1 values)
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]:     mail (1 values)
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]: 
unscoped-affiliation (1 values)
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]: displayName (1 values)
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]: primary-orgunit-dn 
(1 values)
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]:     givenName (1 
values)
*2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]:     eppn (1 values)*
2018-01-26 15:34:22 INFO Shibboleth-TRANSACTION [5]: }

here's my CGI perl

/#!/usr/bin/perl//
//
//print "Content-type: text/html\n\n";//
//
/

/print "<pre>\n";//
//
//foreach $key (sort keys(%ENV)) {//
//  print "$key = $ENV{$key}<p>";//
//}//
//print "</pre>\n";/

it returns among others


      QUERY_STRING =

      REMOTE_PORT = 56972

      _REMOTE_USER = _

      REQUEST_METHOD = GET

      REQUEST_SCHEME = https

      REQUEST_URI = /shibwayf/shibtest.pl


      Shib_Application_ID = default

      Shib_Authentication_Instant = 2018-01-26T14:34:46.921Z

      Shib_Authentication_Method =
      urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

      Shib_AuthnContext_Class =
      urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

      Shib_Identity_Provider = https://idpmt.tem-tsp.eu/idp/shibboleth

      Shib_Session_ID = _79a39530eaa16b476da62f1ff005ff39

      Shib_Session_Index = _45fe0a10df95cb4dcafb183719a5ec2e

but no


      REMOTE_USER = procacci at int.fr


      eppn = procacci at int.fr

      unscoped_affiliation = employee

As I used to have in my old server

did I missed something in my apache <location> or shibboleth2.xml config ?

Regards .


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180126/7f782962/attachment.html>