Apache set headers for /Shibboleth.sso

[Mundry, Marvin]

> I've never seen that contributed "howto" you mentioned, but it
> explicitly states that the requested protected resource must be using
> the HTTP POST binding for SSO requests to the IDP, and your server
> clearly isn't.
I have configured

<SSO entityID="XYZ" outgoingBindings="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST">
SAML2
</SSO>

but my webservice redirects to the session initiator /Shibboleth.sso/Login if not shib session is present.

if I set up protection in apache (and remove the redirection to /Shibboleth.sso/Login in my webservice)
<Location /webservice>
 AuthType shibboleth
 ShibRequestSetting requireSession 1
 Require shibboleth
 SetEnvIf Origin "^http(s)?://.*\.example\.edu(:\d+)?$" AccessControlAllowOrigin=$0
 Header always set Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
 Header always set Access-Control-Allow-Credentials true env=AccessControlAllowOrigin
</Location>

that displays the HTTP:POST binding page at
https://data.example.edu/webservice
but the Header statements are still not working.

(the headers are inserted if a shib session is present and /webservice is served by my webservice. if no shib session is present a request to /webservice is answered by mod_shib. in this case the headers are not inserted)



--

Best regards,

Marvin Mundry


> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober
> Sent: Mittwoch, 23. Januar 2019 13:37
> To: users at shibboleth.net
> Subject: Re: Apache set headers for /Shibboleth.sso
> 
> * Mundry, Marvin <Marvin.Mundry at uni-hamburg.de> [2019-01-23 13:18]:
> > when my javascript application on
> > https://webapp.example.edu
> > makes an xhr request to
> > https://data.example.edu/webservice
> > it gets redirected to
> >
> https://data.example.edu/Shibboleth.sso/Login?target=https://data.example.
> edu/webservice
> 
> Then you probably shouldn't configure the webserver at
> https://data.example.edu/webservice to do that.
> 
> I've never seen that contributed "howto" you mentioned, but it
> explicitly states that the requested protected resource must be using
> the HTTP POST binding for SSO requests to the IDP, and your server
> clearly isn't.
> 
> -peter
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net