configuring shibboleth on AWS using ELB

[Scott Koranda]

> I am still struggling with this and trying to get it working.
> Shibboleth works perfectly on my server until I put it behind an AWS
> load balancer.  Posting my configs, and wondering if anyone sees
> anything that could be causing an issue? I appreciate any suggestions.

Hi Deirdre,

If I were to debug your issue, I would start by installing the SAML
Tracer plugin in my web browser. It is available for both Firefox and
for Chrome.

Then I would start with a clean browser (no history, no sessions, no
cookies at all) and go through an entire flow and record it with SAML
Tracer. I would do that first for the deployment without the AWS load
balancer.

You can export the trace from the plugin and save it to a file, and then
later reload it from that file.

Next I would do the same thing (again from a clean browser) but this
time for the deployment with the AWS load balancer. I would again save
the trace to a file.

I would then compare the two traces line by line and look for
differences. I would pay special attention to cookies being set in the
responses and which cookies are then sent back upstream. I would also
compare the SAML assertions to the extent that I could (if the IdP
encrypts the assertion you will not be able to see all of it in SAML
Tracer, but you should be able to examine the envelope).

If when comparing the two traces nothing jumps out at you, you could
post them (they are just JSON files) somewhere where community members
on this list could download them and examine them (pastebin.com, or a
GitHub gist, or whatever would be easy). If you do that, however, be
aware that you need to first scrub your password from the JSON trace--it
is often recorded if your password is sent upstream to the IdP via a
normal POST.

I find this approach helpful, in addition to looking at log files,
since it records all the details of the back and forth between your web
browser and the IdP and SP.

My apologies if I am telling you things you already know or have
tried...

HTH,

Scott K