Problem implementing Shibboleth/SAML to authenticate users for Statistical Analysis Systems (SAS)
O'Quinn, Dennis
DENNIS_OQUINN at homedepot.com
Wed Jun 6 10:14:00 EDT 2018
I have a problem that I can't seem to get past. I have included below my configuration, a description of my problem, and the first 7 header entries from a fiddler trace showing the behavior. If anyone could provide direction on how to further diagnose or correct this, it would be greatly appreciated....
If I can provide any other info to aid in solving this problem, please let me know.
Config:
************************************************************************************************************************************************
IdP:
I have a PingIdentity IdP in a corporate network that is behind a firewall/loadbalancer with multiple servers providing the IdP function.
They use NetScaler with the Persistence type set as COOKIEINSERT to insert a cookie in the clients request in order to maintain server/session affinity on their end (I do not know yet how to validate how well this is working however).
The host name for the IdP is https://thdsaml-qa.<corp>.com
************************************************************************************************************************************************
SP:
I have Shibboleth running on a Linux Compute server in Google Cloud Platform (GCP) with an application that runs its own Apache/Tomcat server.
The GCP Compute server's host name (I.e., the SP) is sas-mao-midtier.<gcp-project>.internal.
There is a GCP load balancer at the network boundary between the corporate network and GCP. The LB is configured for HTTPS on the front end (facing the corporate network) and HTTPS on the back end facing the application. It routes traffic only to the application on port 8343.
The GCP LB has a DNS entry defined in the corporate network as sascloud.<corp>.com. This is the name by which sas-mao-midtier is known from the corporate network.
************************************************************************************************************************************************
Application URL for the SAML is defined in the Virtual host configuration in Apache httpd-ssl.conf file as follows:
<Location /SASLogon/login>
AuthType shibboleth
ShibRequestSetting requireSession 1
require valid-user
RewriteEngine On
RewriteCond %{LA-U:REMOTE_USER} (.+)
RewriteRule . - [E=RU:%1]
RequestHeader set X-Remote-User "%{RU}e" env=RU
</Location>
The server name and alias directives in http-ssl.com are defined as follows
<VirtualHost _default_:8343>
.
ServerName sascloud.<corp>.com
ServerAlias sas-mao-midtier.<gcp-project>.internal:8343
************************************************************************************************************************************************
Info from the SP metadata:
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_debcbeb52323232824dc272e407f90bb7fc6ace9" entityID="https://sascloud.<corp>.com/shibboleth">
<md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
</md:Extensions>
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
<md:Extensions>
<init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://sascloud.<corp>.com/Shibboleth.sso/Login"/>
</md:Extensions>
<md:KeyDescriptor>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>sas-mao-midtier</ds:KeyName>
<ds:X509Data>
<ds:X509SubjectName>CN=sas-mao-midtier</ds:X509SubjectName>
<ds:X509Certificate>...</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://sascloud.<corp>.com/Shibboleth.sso/Artifact/SOAP" index="1"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://sascloud.<corp>.com/Shibboleth.sso/SLO/SOAP"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sascloud.<corp>.com/Shibboleth.sso/SLO/Redirect"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sascloud.<corp>.com/Shibboleth.sso/SLO/POST"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://sascloud.<corp>.com/Shibboleth.sso/SLO/Artifact"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sascloud.<corp>.com/Shibboleth.sso/SAML2/POST" index="1"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://sascloud.<corp>.com/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://sascloud.<corp>.com/Shibboleth.sso/SAML2/Artifact" index="3"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://sascloud.<corp>.com/Shibboleth.sso/SAML2/ECP" index="4"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://sascloud.<corp>.com/Shibboleth.sso/SAML/POST" index="5"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://sascloud.<corp>.com/Shibboleth.sso/SAML/Artifact" index="6"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>
************************************************************************************************************************************************
Problem:
First, a test to the IdP returns our SAS splash page with no problems (url: https://thdsaml-qa.<corp>.com/idp/startSSO.ping?PartnerSpId=https://sascloud.<corp>.com/shibboleth)
However, that base page (https://sascloud.<corp>.com is not 'protected' by Shibboleth/SAML, so, we get the same page via https://sascloud.<corp>.com (i.e., no routing through SAML).
Our problem is that when we attempt to invoke the actual application, our login goes into a loop on the SAML2/POST immediately after the successful authentication.
The problem appears to be that the application is not recognizing the assertion and is immediately kicking it back to the IdP for authentication as though it is a fresh session.
************************************************************************************************************************************************
Header Printout from Fiddler:
First call to IdP for login:
GET https://thdsaml-qa.<corp>.com/idp/PECJM/resumeSAML20/idp/SSO.ping HTTP/1.1
Host: thdsaml-qa.<corp>.com
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://thdsaml-qa.<corp>.com/thdsso/logon.jsp?resumePath=%2Fidp%2FPECJM%2FresumeSAML20%2Fidp%2FSSO.ping
Cookie: _vwo_uuid_v2=D4A207004D164465DF5A2C4F65B13EDEF|9cf24f88a390e29700f1e0e362ecf9c9; visid_incap_996692=kMugpANRRt6l+uCwnMjNXb8xe1oAAAAAQUIPAAAAAACauoqucnVwbPXDKk76479Z; _ga=GA1.2.271266464.1517503567; s_vi=[CS]v1|2D38E4C80507DBF8-4000010460003BF0[CE]; LPVID=RlMThhZjk0MDkwN2U0MGFj; _vis_opt_s=1%7C; _vwo_uuid=D070FCAC86C261ED2B3E2B16A15F3CFEF; _vis_opt_exp_2_combi=1; _abck=B5BE87F7A085FBFE166C0FCEA50AA669B81C7F0D071F0000C856E85AF636B675~0~IEOqYPpHT6/zlgy0PesxnKZy7Zg+7hxTnqw2zFDZNkM=~-1~-1; THD_CACHE_NAV_PERSIST=; ftr_ncd=6; thda.u=f9dbcda9-9991-a0c5-c609-9f5a830c0bd4; p_seg=seg1%3D7183005; RES_TRACKINGID=367400434790740; mbox=PC#f3dc3719fdd54d408b332525bcc2cbee.17_41#1588420810|session#d493ed9556874c66970b67f1f6f38759#1525216224; forterToken=d3077b5064204c0d9a466cd3899ff3a6_1525214363690__UDF4_6; s_pers=%20productnum%3D1%7C1527768083263%3B%20s_nr%3D1525214365203-Repeat%7C1556750365203%3B%20s_dslv%3D1525214365207%7C1619822365207%3B%20s_dslv_s%3DLess%2520than%25201%2520day%7C1525216165207%3B; THD_PERSIST=C4%3D121%2BCumberland%20-%20Atlanta%2C%20GA%2B%3A%3BC4_EXP%3D1556712013%3A%3BC24%3D30339%3A%3BC24_EXP%3D1556712013%3A%3BC34%3D31.1%3A%3BC34_EXP%3D1525300765%3A%3BC39%3D1%3B8%3A00-20%3A00%3B2%3B6%3A00-22%3A00%3B3%3B6%3A00-22%3A00%3B4%3B6%3A00-22%3A00%3B5%3B6%3A00-22%3A00%3B6%3B6%3A00-22%3A00%3B7%3B6%3A00-22%3A00%3A%3BC39_EXP%3D1525179613; ctm={'pgv':93917700242109|'vst':6587122566013417|'vstr':3865677187556332|'intr':1525214365300|'v':1|'lvst':638}; AMCV_F6421253512D2C100A490D45%40AdobeOrg=-894706358%7CMCAID%7C2D38E4C80507DBF8-4000010460003BF0%7CMCIDTS%7C17653%7CMCMID%7C51736870787950132971209766123311017639%7CMCAAMLH-1525780809%7C7%7CMCAAMB-1525819165%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1525221565s%7CNONE%7CMCCIDH%7C353668118%7CvVersion%7C2.3.0; _br_uid_2=uid%3D2211865213621%3Av%3D12.0%3Ats%3D1525176014136%3Ahc%3D4; _4c_=hVNNT9tAEP0r1R44BXtm1%2FsVCVVJgKqVCqLQ9ojs9ZpYOLG16zStUP4743wgCrTkYM%2Fsvpl573nywNZzv2RjlFxyzIThHMSI3fs%2FkY0fmOuG56%2FhsQoNG7N533dxnKbr9TqZtwtf%2Bq7tE9cuUpdOuq6p86Xz8fayqnyIbMRcW3oqQ5tkCae8WjVV3TTXfRv851O6obNuFdw8jwPugtLC9zmFbajv6iXls6Z29zd5479vC1ATRQlCS2GkUmKoCO06%2BkCXs3kgUh%2BUHEYRd8Y1cqUylSUoUVOZVJruWlLHftbLkgopDZ7ohm0HymLdD1z%2BkkfHvQ%2BLoYzCy683326nZ5PZ5cUzT%2BI6j%2B6FK0UaY%2Fp01IW2TBHSL9fHPBEJpBEkCiO4MlZaqT9OrqYneLSoyxNiK5TRoI22ElBwS0rAaqWQC4EIqJWwRzlB%2BakwZ9nMkCv6dHpujjOgH0Km6CWm53A0uTo7wcFp%2BpIso6BpHRlKCX37Efs0ud15%2Bw%2B3tnJ%2F7BDvzWKbEfu92ycBoJW0iORdT8tj1BYMhAh1uV8sJoqsVICFoZGlKn1V2RwLV6BVrpS5pfnbfuSA5ICZtYoaDEq29dmrcfB63G5B%2FlPzFkV3YNiHlX%2FBQgKXA6bfY6q8if4FhCKCuKWjvu%2BA7kJ16HT4IxIrS0reAHeHfkR6L4NzM8gAu5eB2ZMM2qWDDqPLovK5kiV6o2SugRtjhNcawToFzzRa2BHYbDaP; GUID="abda4078-3906-d09f-5ff0-11fd3b50d92b"; pfidpaid=ad..SecureIDRSA1; JSESSIONID=1ovni8yzw8e1hbw1qtjktha5g; NSC_mc-wt-rb-443-w1-uietbnm=ffffffffaf1a890c45525d5f4f58455e445a4a421577; PF=FyMOrA5wCE5hJTJaQPzUD6tk4wEGnxghPJJC0QVrgLY0; sessionID=ji13vxb7-i.bzspnkqt73ta7; rssoSessionID=vTehB7chhVqPuMEJjCmqnTOE7ultufddgJ0oiFF/Xe6dAV2VcyI2JH9I/6cqCLms; THDSSO=GVnyCsTJCZaZDBya5CpDrh8RR2S6xGQ8rXOjrxOW9avQ4xB6Q7C9wZimKS77k0uhTKXIS05Snx7rdrmeeOsCNOuNmq8RX5g1yYPTgVpsrCvmWl3Q7RvhBg1Bdiu6BS7uWfbCX4wMSayIWRSg143U4Z6PtC9QuXbJhBRuuAJ0zXsfB1YYilLlju6JObTuefOyovIK4Nuq5rrUDsOtaTEpvrxb4Zj0uemAW0BRppZLIwOu1GQETSsad2jmGrHqdh6JlFejKFdRNQxA42lN7WLSq0K9ctjb52Ij71TkwUNnwh9ZwFkYBEIEJr1tYlntMjB4iHBuhGf06TUpajGh4q0BRl92jxUFLL6ZlJP4FpuNH92B2gHyvjxLIW6cm2AKQexKSr4YJqb14m5sqdpTuGfRj6bsaBP8wAtZkQ0yByrEHMEwfy3ARHLYib2lRbCetJC7X0wGwSJVgzkRz3yZ44YMEZpXGmxyvPw6TME1kUyEatLbtUp6gI2EK004q1v8ovQ5UEzEPhrYmjuZG03Y061K9Y3kQ7PFQy7A9vmCATSf6m5oFbJVSi0m0Ao9NQL2ZXclzMyJFmofghSA6vpKa2mnuQKuMTxzfIm79oIsQbC9GUX35MV0Se17GVXQoL8b3Hqy8P1BsIUUc2pz0xlAZz1r6aeUsTvSOUeVMYO9PVvE8lfj6So7DhyysxWDGQCLDU4xqcIwYQWv4Grm3M66cV4oUsRCLZbMAnJeKUDMkO2F5DgpFKVFXHnyryz7AoKPWybQReAqEjyZkM1HG8vXZWCg6JESndIUoVGU0PWHyyaT1wwCQ9XeU6RVoc6h0lxL
HTTP/1.1 200 OK
Date: Tue, 05 Jun 2018 03:09:54 GMT
Content-Security-Policy: referrer origin
X-Frame-Options: SAMEORIGIN
Cache-Control: no-cache, no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 8917
LOGIN SUCCESSFUL: POST BACK FROM SAML
POST https://sascloud.<corp>.com/Shibboleth.sso/SAML2/POST HTTP/1.1
Host: sascloud.<corp>.com
Connection: keep-alive
Content-Length: 8162
Cache-Control: max-age=0
Origin: https://thdsaml-qa.<corp>.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://thdsaml-qa.<corp>.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: _vwo_uuid_v2=D4A207004D164465DF5A2C4F65B13EDEF|9cf24f88a390e29700f1e0e362ecf9c9; visid_incap_996692=kMugpANRRt6l+uCwnMjNXb8xe1oAAAAAQUIPAAAAAACauoqucnVwbPXDKk76479Z; _ga=GA1.2.271266464.1517503567; s_vi=[CS]v1|2D38E4C80507DBF8-4000010460003BF0[CE]; LPVID=RlMThhZjk0MDkwN2U0MGFj; _vis_opt_s=1%7C; _vwo_uuid=D070FCAC86C261ED2B3E2B16A15F3CFEF; _vis_opt_exp_2_combi=1; _abck=B5BE87F7A085FBFE166C0FCEA50AA669B81C7F0D071F0000C856E85AF636B675~0~IEOqYPpHT6/zlgy0PesxnKZy7Zg+7hxTnqw2zFDZNkM=~-1~-1; THD_CACHE_NAV_PERSIST=; ftr_ncd=6; thda.u=f9dbcda9-9991-a0c5-c609-9f5a830c0bd4; p_seg=seg1%3D7183005; RES_TRACKINGID=367400434790740; mbox=PC#f3dc3719fdd54d408b332525bcc2cbee.17_41#1588420810|session#d493ed9556874c66970b67f1f6f38759#1525216224; forterToken=d3077b5064204c0d9a466cd3899ff3a6_1525214363690__UDF4_6; s_pers=%20productnum%3D1%7C1527768083263%3B%20s_nr%3D1525214365203-Repeat%7C1556750365203%3B%20s_dslv%3D1525214365207%7C1619822365207%3B%20s_dslv_s%3DLess%2520than%25201%2520day%7C1525216165207%3B; THD_PERSIST=C4%3D121%2BCumberland%20-%20Atlanta%2C%20GA%2B%3A%3BC4_EXP%3D1556712013%3A%3BC24%3D30339%3A%3BC24_EXP%3D1556712013%3A%3BC34%3D31.1%3A%3BC34_EXP%3D1525300765%3A%3BC39%3D1%3B8%3A00-20%3A00%3B2%3B6%3A00-22%3A00%3B3%3B6%3A00-22%3A00%3B4%3B6%3A00-22%3A00%3B5%3B6%3A00-22%3A00%3B6%3B6%3A00-22%3A00%3B7%3B6%3A00-22%3A00%3A%3BC39_EXP%3D1525179613; ctm={'pgv':93917700242109|'vst':6587122566013417|'vstr':3865677187556332|'intr':1525214365300|'v':1|'lvst':638}; AMCV_F6421253512D2C100A490D45%40AdobeOrg=-894706358%7CMCAID%7C2D38E4C80507DBF8-4000010460003BF0%7CMCIDTS%7C17653%7CMCMID%7C51736870787950132971209766123311017639%7CMCAAMLH-1525780809%7C7%7CMCAAMB-1525819165%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1525221565s%7CNONE%7CMCCIDH%7C353668118%7CvVersion%7C2.3.0; _br_uid_2=uid%3D2211865213621%3Av%3D12.0%3Ats%3D1525176014136%3Ahc%3D4; _4c_=hVNNT9tAEP0r1R44BXtm1%2FsVCVVJgKqVCqLQ9ojs9ZpYOLG16zStUP4743wgCrTkYM%2Fsvpl573nywNZzv2RjlFxyzIThHMSI3fs%2FkY0fmOuG56%2FhsQoNG7N533dxnKbr9TqZtwtf%2Bq7tE9cuUpdOuq6p86Xz8fayqnyIbMRcW3oqQ5tkCae8WjVV3TTXfRv851O6obNuFdw8jwPugtLC9zmFbajv6iXls6Z29zd5479vC1ATRQlCS2GkUmKoCO06%2BkCXs3kgUh%2BUHEYRd8Y1cqUylSUoUVOZVJruWlLHftbLkgopDZ7ohm0HymLdD1z%2BkkfHvQ%2BLoYzCy683326nZ5PZ5cUzT%2BI6j%2B6FK0UaY%2Fp01IW2TBHSL9fHPBEJpBEkCiO4MlZaqT9OrqYneLSoyxNiK5TRoI22ElBwS0rAaqWQC4EIqJWwRzlB%2BakwZ9nMkCv6dHpujjOgH0Km6CWm53A0uTo7wcFp%2BpIso6BpHRlKCX37Efs0ud15%2Bw%2B3tnJ%2F7BDvzWKbEfu92ycBoJW0iORdT8tj1BYMhAh1uV8sJoqsVICFoZGlKn1V2RwLV6BVrpS5pfnbfuSA5ICZtYoaDEq29dmrcfB63G5B%2FlPzFkV3YNiHlX%2FBQgKXA6bfY6q8if4FhCKCuKWjvu%2BA7kJ16HT4IxIrS0reAHeHfkR6L4NzM8gAu5eB2ZMM2qWDDqPLovK5kiV6o2SugRtjhNcawToFzzRa2BHYbDaP; GUID="abda4078-3906-d09f-5ff0-11fd3b50d92b"; sessionID=ji13vxb7-i.bzspnkqt73ta7; rssoSessionID=vTehB7chhVqPuMEJjCmqnTOE7ultufddgJ0oiFF/Xe6dAV2VcyI2JH9I/6cqCLms; THDSSO=GVnyCsTJCZaZDBya5CpDrh8RR2S6xGQ8rXOjrxOW9avQ4xB6Q7C9wZimKS77k0uhTKXIS05Snx7rdrmeeOsCNOuNmq8RX5g1yYPTgVpsrCvmWl3Q7RvhBg1Bdiu6BS7uWfbCX4wMSayIWRSg143U4Z6PtC9QuXbJhBRuuAJ0zXsfB1YYilLlju6JObTuefOyovIK4Nuq5rrUDsOtaTEpvrxb4Zj0uemAW0BRppZLIwOu1GQETSsad2jmGrHqdh6JlFejKFdRNQxA42lN7WLSq0K9ctjb52Ij71TkwUNnwh9ZwFkYBEIEJr1tYlntMjB4iHBuhGf06TUpajGh4q0BRl92jxUFLL6ZlJP4FpuNH92B2gHyvjxLIW6cm2AKQexKSr4YJqb14m5sqdpTuGfRj6bsaBP8wAtZkQ0yByrEHMEwfy3ARHLYib2lRbCetJC7X0wGwSJVgzkRz3yZ44YMEZpXGmxyvPw6TME1kUyEatLbtUp6gI2EK004q1v8ovQ5UEzEPhrYmjuZG03Y061K9Y3kQ7PFQy7A9vmCATSf6m5oFbJVSi0m0Ao9NQL2ZXclzMyJFmofghSA6vpKa2mnuQKuMTxzfIm79oIsQbC9GUX35MV0Se17GVXQoL8b3Hqy8P1BsIUUc2pz0xlAZz1r6aeUsTvSOUeVMYO9PVvE8lfj6So7DhyysxWDGQCLDU4xqcIwYQWv4Grm3M66cV4oUsRCLZbMAnJeKUDMkO2F5DgpFKVFXHnyryz7AoKPWybQReAqEjyZkM1HG8vXZWCg6JESndIUoVGU0PWHyyaT1wwCQ9XeU6RVoc6h0lxL
HTTP/1.1 302 Found
Date: Tue, 05 Jun 2018 03:09:55 GMT
Server: Apache PivotalWebServer
Set-Cookie: _shibsession_64656661756c7468747470733a2f2f736173636c6f75642e686f6d656465706f742e636f6d2f73686962626f6c657468=_700fc6053a361cc5cb24c8aa6727e665; path=/; HttpOnly
Expires: Wed, 01 Jan 1997 12:00:00 GMT
Cache-Control: private,no-store,no-cache,max-age=0
Location: https://sascloud.<corp>.com/SASLogon/login?service=https%3A%2F%2Fsascloud.<corp>.com%2FSASStudio%2Fj_spring_cas_security_check
Content-Length: 316
Content-Type: text/html; charset=iso-8859-1
Via: 1.1 google
Alt-Svc: clear
SHIBBOLETH ROUTING TO APPLICATION AFTER SUCCESSFUL LOGIN
GET https://sascloud.<corp>.com/SASLogon/login?service=https%3A%2F%2Fsascloud.<corp>.com%2FSASStudio%2Fj_spring_cas_security_check HTTP/1.1
Host: sascloud.<corp>.com
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://thdsaml-qa.<corp>.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: _vwo_uuid_v2=D4A207004D164465DF5A2C4F65B13EDEF|9cf24f88a390e29700f1e0e362ecf9c9; visid_incap_996692=kMugpANRRt6l+uCwnMjNXb8xe1oAAAAAQUIPAAAAAACauoqucnVwbPXDKk76479Z; _ga=GA1.2.271266464.1517503567; s_vi=[CS]v1|2D38E4C80507DBF8-4000010460003BF0[CE]; LPVID=RlMThhZjk0MDkwN2U0MGFj; _vis_opt_s=1%7C; _vwo_uuid=D070FCAC86C261ED2B3E2B16A15F3CFEF; _vis_opt_exp_2_combi=1; _abck=B5BE87F7A085FBFE166C0FCEA50AA669B81C7F0D071F0000C856E85AF636B675~0~IEOqYPpHT6/zlgy0PesxnKZy7Zg+7hxTnqw2zFDZNkM=~-1~-1; THD_CACHE_NAV_PERSIST=; ftr_ncd=6; thda.u=f9dbcda9-9991-a0c5-c609-9f5a830c0bd4; p_seg=seg1%3D7183005; RES_TRACKINGID=367400434790740; mbox=PC#f3dc3719fdd54d408b332525bcc2cbee.17_41#1588420810|session#d493ed9556874c66970b67f1f6f38759#1525216224; forterToken=d3077b5064204c0d9a466cd3899ff3a6_1525214363690__UDF4_6; s_pers=%20productnum%3D1%7C1527768083263%3B%20s_nr%3D1525214365203-Repeat%7C1556750365203%3B%20s_dslv%3D1525214365207%7C1619822365207%3B%20s_dslv_s%3DLess%2520than%25201%2520day%7C1525216165207%3B; THD_PERSIST=C4%3D121%2BCumberland%20-%20Atlanta%2C%20GA%2B%3A%3BC4_EXP%3D1556712013%3A%3BC24%3D30339%3A%3BC24_EXP%3D1556712013%3A%3BC34%3D31.1%3A%3BC34_EXP%3D1525300765%3A%3BC39%3D1%3B8%3A00-20%3A00%3B2%3B6%3A00-22%3A00%3B3%3B6%3A00-22%3A00%3B4%3B6%3A00-22%3A00%3B5%3B6%3A00-22%3A00%3B6%3B6%3A00-22%3A00%3B7%3B6%3A00-22%3A00%3A%3BC39_EXP%3D1525179613; ctm={'pgv':93917700242109|'vst':6587122566013417|'vstr':3865677187556332|'intr':1525214365300|'v':1|'lvst':638}; AMCV_F6421253512D2C100A490D45%40AdobeOrg=-894706358%7CMCAID%7C2D38E4C80507DBF8-4000010460003BF0%7CMCIDTS%7C17653%7CMCMID%7C51736870787950132971209766123311017639%7CMCAAMLH-1525780809%7C7%7CMCAAMB-1525819165%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1525221565s%7CNONE%7CMCCIDH%7C353668118%7CvVersion%7C2.3.0; _br_uid_2=uid%3D2211865213621%3Av%3D12.0%3Ats%3D1525176014136%3Ahc%3D4; _4c_=hVNNT9tAEP0r1R44BXtm1%2FsVCVVJgKqVCqLQ9ojs9ZpYOLG16zStUP4743wgCrTkYM%2Fsvpl573nywNZzv2RjlFxyzIThHMSI3fs%2FkY0fmOuG56%2FhsQoNG7N533dxnKbr9TqZtwtf%2Bq7tE9cuUpdOuq6p86Xz8fayqnyIbMRcW3oqQ5tkCae8WjVV3TTXfRv851O6obNuFdw8jwPugtLC9zmFbajv6iXls6Z29zd5479vC1ATRQlCS2GkUmKoCO06%2BkCXs3kgUh%2BUHEYRd8Y1cqUylSUoUVOZVJruWlLHftbLkgopDZ7ohm0HymLdD1z%2BkkfHvQ%2BLoYzCy683326nZ5PZ5cUzT%2BI6j%2B6FK0UaY%2Fp01IW2TBHSL9fHPBEJpBEkCiO4MlZaqT9OrqYneLSoyxNiK5TRoI22ElBwS0rAaqWQC4EIqJWwRzlB%2BakwZ9nMkCv6dHpujjOgH0Km6CWm53A0uTo7wcFp%2BpIso6BpHRlKCX37Efs0ud15%2Bw%2B3tnJ%2F7BDvzWKbEfu92ycBoJW0iORdT8tj1BYMhAh1uV8sJoqsVICFoZGlKn1V2RwLV6BVrpS5pfnbfuSA5ICZtYoaDEq29dmrcfB63G5B%2FlPzFkV3YNiHlX%2FBQgKXA6bfY6q8if4FhCKCuKWjvu%2BA7kJ16HT4IxIrS0reAHeHfkR6L4NzM8gAu5eB2ZMM2qWDDqPLovK5kiV6o2SugRtjhNcawToFzzRa2BHYbDaP; GUID="abda4078-3906-d09f-5ff0-11fd3b50d92b"; sessionID=ji13vxb7-i.bzspnkqt73ta7; rssoSessionID=vTehB7chhVqPuMEJjCmqnTOE7ultufddgJ0oiFF/Xe6dAV2VcyI2JH9I/6cqCLms; THDSSO=GVnyCsTJCZaZDBya5CpDrh8RR2S6xGQ8rXOjrxOW9avQ4xB6Q7C9wZimKS77k0uhTKXIS05Snx7rdrmeeOsCNOuNmq8RX5g1yYPTgVpsrCvmWl3Q7RvhBg1Bdiu6BS7uWfbCX4wMSayIWRSg143U4Z6PtC9QuXbJhBRuuAJ0zXsfB1YYilLlju6JObTuefOyovIK4Nuq5rrUDsOtaTEpvrxb4Zj0uemAW0BRppZLIwOu1GQETSsad2jmGrHqdh6JlFejKFdRNQxA42lN7WLSq0K9ctjb52Ij71TkwUNnwh9ZwFkYBEIEJr1tYlntMjB4iHBuhGf06TUpajGh4q0BRl92jxUFLL6ZlJP4FpuNH92B2gHyvjxLIW6cm2AKQexKSr4YJqb14m5sqdpTuGfRj6bsaBP8wAtZkQ0yByrEHMEwfy3ARHLYib2lRbCetJC7X0wGwSJVgzkRz3yZ44YMEZpXGmxyvPw6TME1kUyEatLbtUp6gI2EK004q1v8ovQ5UEzEPhrYmjuZG03Y061K9Y3kQ7PFQy7A9vmCATSf6m5oFbJVSi0m0Ao9NQL2ZXclzMyJFmofghSA6vpKa2mnuQKuMTxzfIm79oIsQbC9GUX35MV0Se17GVXQoL8b3Hqy8P1BsIUUc2pz0xlAZz1r6aeUsTvSOUeVMYO9PVvE8lfj6So7DhyysxWDGQCLDU4xqcIwYQWv4Grm3M66cV4oUsRCLZbMAnJeKUDMkO2F5DgpFKVFXHnyryz7AoKPWybQReAqEjyZkM1HG8vXZWCg6JESndIUoVGU0PWHyyaT1wwCQ9XeU6RVoc6h0lxL; _shibsession_64656661756c7468747470733a2f2f736173636c6f75642e686f6d656465706f742e636f6d2f73686962626f6c657468=_700fc6053a361cc5cb24c8aa6727e665
HTTP/1.1 302 Found
Date: Tue, 05 Jun 2018 03:09:55 GMT
Server: Apache PivotalWebServer
Set-Cookie: _shibsession_64656661756c7468747470733a2f2f736173636c6f75642e686f6d656465706f742e636f6d2f73686962626f6c657468=; path=/; HttpOnly; expires=Mon, 01 Jan 2001 00:00:00 GMT
Expires: Wed, 01 Jan 1997 12:00:00 GMT
Cache-Control: private,no-store,no-cache,max-age=0
Location: https://thdsaml-qa.<corp>.com/idp/SSO.saml2?SAMLRequest=hZJbb4IwGIb%2FCuk9FFEUGiFhejETN8lgu9jNUmgdTUqL%2FcoO%2F34iO7hduOvv7fMe0iXQVnYk622j7vih52Cdt1YqIKdDgnqjiKYggCjaciC2JkV2syWB55POaKtrLZGTAXBjhVYrraBvuSm4eRE1v7%2FbJqixtgOCMVCope6Z1%2BiWM95p69W6xUUjqkpLbhsPQOOBHuB8V5TIWR%2FjCEUH8A%2FGNmzI5h7oH5BgHS6KnTdcA%2BRs1gl6omw%2BjRd7OvP3kyj2acVDNg8mizjaR%2FGMDTKAnm8UWKpsggJ%2FErn%2B3PXD0p8SPyZh%2BIic%2FLPolVBMqOfLq1SjCMh1WebuWOSBGziVOApQuhwSkpOxOVv7MpZ%2BTYzSfwaF70GX%2BMxptO3I7RG9WedaivrdyaTUryvDqeUJmiCcjk9%2B%2F4j0Aw%3D%3D&RelayState=ss%3Amem%3A505b0278e4f5e1149d1ea5ba4fa6aaf97d5e58798d9ffdf802470e80911daf4b
Content-Length: 798
Content-Type: text/html; charset=iso-8859-1
Via: 1.1 google
Alt-Svc: clear
KICKED BACK TO SAML/IdP AND BEGIN LOOPING:
GET https://thdsaml-qa.<corp>.com/idp/SSO.saml2?SAMLRequest=hZJbb4IwGIb%2FCuk9FFEUGiFhejETN8lgu9jNUmgdTUqL%2FcoO%2F34iO7hduOvv7fMe0iXQVnYk622j7vih52Cdt1YqIKdDgnqjiKYggCjaciC2JkV2syWB55POaKtrLZGTAXBjhVYrraBvuSm4eRE1v7%2FbJqixtgOCMVCope6Z1%2BiWM95p69W6xUUjqkpLbhsPQOOBHuB8V5TIWR%2FjCEUH8A%2FGNmzI5h7oH5BgHS6KnTdcA%2BRs1gl6omw%2BjRd7OvP3kyj2acVDNg8mizjaR%2FGMDTKAnm8UWKpsggJ%2FErn%2B3PXD0p8SPyZh%2BIic%2FLPolVBMqOfLq1SjCMh1WebuWOSBGziVOApQuhwSkpOxOVv7MpZ%2BTYzSfwaF70GX%2BMxptO3I7RG9WedaivrdyaTUryvDqeUJmiCcjk9%2B%2F4j0Aw%3D%3D&RelayState=ss%3Amem%3A505b0278e4f5e1149d1ea5ba4fa6aaf97d5e58798d9ffdf802470e80911daf4b HTTP/1.1
Host: thdsaml-qa.<corp>.com
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://thdsaml-qa.<corp>.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: _vwo_uuid_v2=D4A207004D164465DF5A2C4F65B13EDEF|9cf24f88a390e29700f1e0e362ecf9c9; visid_incap_996692=kMugpANRRt6l+uCwnMjNXb8xe1oAAAAAQUIPAAAAAACauoqucnVwbPXDKk76479Z; _ga=GA1.2.271266464.1517503567; s_vi=[CS]v1|2D38E4C80507DBF8-4000010460003BF0[CE]; LPVID=RlMThhZjk0MDkwN2U0MGFj; _vis_opt_s=1%7C; _vwo_uuid=D070FCAC86C261ED2B3E2B16A15F3CFEF; _vis_opt_exp_2_combi=1; _abck=B5BE87F7A085FBFE166C0FCEA50AA669B81C7F0D071F0000C856E85AF636B675~0~IEOqYPpHT6/zlgy0PesxnKZy7Zg+7hxTnqw2zFDZNkM=~-1~-1; THD_CACHE_NAV_PERSIST=; ftr_ncd=6; thda.u=f9dbcda9-9991-a0c5-c609-9f5a830c0bd4; p_seg=seg1%3D7183005; RES_TRACKINGID=367400434790740; mbox=PC#f3dc3719fdd54d408b332525bcc2cbee.17_41#1588420810|session#d493ed9556874c66970b67f1f6f38759#1525216224; forterToken=d3077b5064204c0d9a466cd3899ff3a6_1525214363690__UDF4_6; s_pers=%20productnum%3D1%7C1527768083263%3B%20s_nr%3D1525214365203-Repeat%7C1556750365203%3B%20s_dslv%3D1525214365207%7C1619822365207%3B%20s_dslv_s%3DLess%2520than%25201%2520day%7C1525216165207%3B; THD_PERSIST=C4%3D121%2BCumberland%20-%20Atlanta%2C%20GA%2B%3A%3BC4_EXP%3D1556712013%3A%3BC24%3D30339%3A%3BC24_EXP%3D1556712013%3A%3BC34%3D31.1%3A%3BC34_EXP%3D1525300765%3A%3BC39%3D1%3B8%3A00-20%3A00%3B2%3B6%3A00-22%3A00%3B3%3B6%3A00-22%3A00%3B4%3B6%3A00-22%3A00%3B5%3B6%3A00-22%3A00%3B6%3B6%3A00-22%3A00%3B7%3B6%3A00-22%3A00%3A%3BC39_EXP%3D1525179613; ctm={'pgv':93917700242109|'vst':6587122566013417|'vstr':3865677187556332|'intr':1525214365300|'v':1|'lvst':638}; AMCV_F6421253512D2C100A490D45%40AdobeOrg=-894706358%7CMCAID%7C2D38E4C80507DBF8-4000010460003BF0%7CMCIDTS%7C17653%7CMCMID%7C51736870787950132971209766123311017639%7CMCAAMLH-1525780809%7C7%7CMCAAMB-1525819165%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1525221565s%7CNONE%7CMCCIDH%7C353668118%7CvVersion%7C2.3.0; _br_uid_2=uid%3D2211865213621%3Av%3D12.0%3Ats%3D1525176014136%3Ahc%3D4; _4c_=hVNNT9tAEP0r1R44BXtm1%2FsVCVVJgKqVCqLQ9ojs9ZpYOLG16zStUP4743wgCrTkYM%2Fsvpl573nywNZzv2RjlFxyzIThHMSI3fs%2FkY0fmOuG56%2FhsQoNG7N533dxnKbr9TqZtwtf%2Bq7tE9cuUpdOuq6p86Xz8fayqnyIbMRcW3oqQ5tkCae8WjVV3TTXfRv851O6obNuFdw8jwPugtLC9zmFbajv6iXls6Z29zd5479vC1ATRQlCS2GkUmKoCO06%2BkCXs3kgUh%2BUHEYRd8Y1cqUylSUoUVOZVJruWlLHftbLkgopDZ7ohm0HymLdD1z%2BkkfHvQ%2BLoYzCy683326nZ5PZ5cUzT%2BI6j%2B6FK0UaY%2Fp01IW2TBHSL9fHPBEJpBEkCiO4MlZaqT9OrqYneLSoyxNiK5TRoI22ElBwS0rAaqWQC4EIqJWwRzlB%2BakwZ9nMkCv6dHpujjOgH0Km6CWm53A0uTo7wcFp%2BpIso6BpHRlKCX37Efs0ud15%2Bw%2B3tnJ%2F7BDvzWKbEfu92ycBoJW0iORdT8tj1BYMhAh1uV8sJoqsVICFoZGlKn1V2RwLV6BVrpS5pfnbfuSA5ICZtYoaDEq29dmrcfB63G5B%2FlPzFkV3YNiHlX%2FBQgKXA6bfY6q8if4FhCKCuKWjvu%2BA7kJ16HT4IxIrS0reAHeHfkR6L4NzM8gAu5eB2ZMM2qWDDqPLovK5kiV6o2SugRtjhNcawToFzzRa2BHYbDaP; GUID="abda4078-3906-d09f-5ff0-11fd3b50d92b"; pfidpaid=ad..SecureIDRSA1; JSESSIONID=1ovni8yzw8e1hbw1qtjktha5g; NSC_mc-wt-rb-443-w1-uietbnm=ffffffffaf1a890c45525d5f4f58455e445a4a421577; PF=FyMOrA5wCE5hJTJaQPzUD6tk4wEGnxghPJJC0QVrgLY0; sessionID=ji13vxb7-i.bzspnkqt73ta7; rssoSessionID=vTehB7chhVqPuMEJjCmqnTOE7ultufddgJ0oiFF/Xe6dAV2VcyI2JH9I/6cqCLms; THDSSO=GVnyCsTJCZaZDBya5CpDrh8RR2S6xGQ8rXOjrxOW9avQ4xB6Q7C9wZimKS77k0uhTKXIS05Snx7rdrmeeOsCNOuNmq8RX5g1yYPTgVpsrCvmWl3Q7RvhBg1Bdiu6BS7uWfbCX4wMSayIWRSg143U4Z6PtC9QuXbJhBRuuAJ0zXsfB1YYilLlju6JObTuefOyovIK4Nuq5rrUDsOtaTEpvrxb4Zj0uemAW0BRppZLIwOu1GQETSsad2jmGrHqdh6JlFejKFdRNQxA42lN7WLSq0K9ctjb52Ij71TkwUNnwh9ZwFkYBEIEJr1tYlntMjB4iHBuhGf06TUpajGh4q0BRl92jxUFLL6ZlJP4FpuNH92B2gHyvjxLIW6cm2AKQexKSr4YJqb14m5sqdpTuGfRj6bsaBP8wAtZkQ0yByrEHMEwfy3ARHLYib2lRbCetJC7X0wGwSJVgzkRz3yZ44YMEZpXGmxyvPw6TME1kUyEatLbtUp6gI2EK004q1v8ovQ5UEzEPhrYmjuZG03Y061K9Y3kQ7PFQy7A9vmCATSf6m5oFbJVSi0m0Ao9NQL2ZXclzMyJFmofghSA6vpKa2mnuQKuMTxzfIm79oIsQbC9GUX35MV0Se17GVXQoL8b3Hqy8P1BsIUUc2pz0xlAZz1r6aeUsTvSOUeVMYO9PVvE8lfj6So7DhyysxWDGQCLDU4xqcIwYQWv4Grm3M66cV4oUsRCLZbMAnJeKUDMkO2F5DgpFKVFXHnyryz7AoKPWybQReAqEjyZkM1HG8vXZWCg6JESndIUoVGU0PWHyyaT1wwCQ9XeU6RVoc6h0lxL
HTTP/1.1 200 OK
Date: Tue, 05 Jun 2018 03:09:55 GMT
Content-Security-Policy: referrer origin
X-Frame-Options: SAMEORIGIN
Cache-Control: no-cache, no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 8917
------------------------------------------------------------------
POST https://sascloud.<corp>.com/Shibboleth.sso/SAML2/POST HTTP/1.1
------------------------------------------------------------------
GET https://sascloud.<corp>.com/SASLogon/login?service=https%3A%2F%2Fsascloud.<corp>.com%2FSASStudio%2Fj_spring_cas_security_check HTTP/1.1
------------------------------------------------------------------
GET https://thdsaml-qa.<corp>.com/idp/SSO.saml2?SAMLRequest=hZJbb4IwGIb%2FCum9tKDgaISE6cVM3CTCdrGbpUAdTUqL%2FcoO%2F34iO7hduOvv7fMe0gWwVnY07W2jdvzQc7DOWysV0NMhRr1RVDMQQBVrOVBb0Ty93VDfJbQz2upKS%2BSkANxYodVSK%2BhbbnJuXkTF73ebGDXWdkAxBgaV1H3tNrrlNe%2B0dSvd4rwRZaklt40LoPFA93G2zQvkrI5xhGID%2BAdjm3rINjmwPyBRdzjPt%2B5w9ZGzXsXoqQ73%2FpTN2YxFPJyVwZTM9hGJSOhxj8yDQQbQ87UCy5SNkU%2B8qwkJJyQoyJSSiAbBI3Kyz6LXQtVCPV9epRxFQG%2BKIpuMRR64gVOJowAliyEhPRmbs7UvY9nXxCj5Z1D4HnSBz5xG247eHdHrVaalqN6dVEr9ujScWR4jD%2BFkfPL7RyQf&RelayState=ss%3Amem%3A0a6817ae278ed4294a07e068e351ba220e9567d6a675b7ca20e17af6db1a9509 HTTP/1.1
.
.
.
________________________________
The information in this Internet Email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this Email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients any opinions or advice contained in this Email are subject to the terms and conditions expressed in any applicable governing The Home Depot terms of business or client engagement letter. The Home Depot disclaims all responsibility and liability for the accuracy and content of this attachment and for any damages or losses arising from any inaccuracies, errors, viruses, e.g., worms, trojan horses, etc., or other items of a destructive nature, which may be contained in this attachment and shall not be liable for direct, indirect, consequential or special damages in connection with this e-mail message or its attachment.
More information about the users
mailing list