SessionInitiator handler at duplicate Location (/Login) will not be processed for application (default) - default IDP function not working since SP upgrade from v2 to v3

[Joel Saunders]

Also, just checked and PROD is v 3.0.3 where test is v3.0.2    ....    newer version came in with yum as it did it a few months later.

I'm wondering if this is a check in the new version.

So what is the fix:

In the Shibboleth2.xml file, I have the following snippet of settings:  (hostnames changed.)
----------------------------------------------------------------------------------------------------
<SSO discoveryURL="https://hostname/discovery">
              SAML2 SAML1
            </SSO>

            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>

      <!-- Default example directs to a specific IdP's SSO service (favoring SAML 2 over Shib 1). -->
            <!-- change entityID to your identity provider entity ID -->
            <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"
                    relayState="cookie" entityID="https://idphostname/idp/shibboleth">
                <SessionInitiator type="SAML2" defaultACSIndex="1" acsByIndex="false" template="bindingTem
plate.html"/>
                <SessionInitiator type="Shib1" defaultACSIndex="5"/>
            </SessionInitiator>

----------------------------------------------------------------------------------------------------------
Should I remove the SessionInitiator section and change the  SSO section to use the entitiyID option with my IDP vs. the discoveryURL since I still need the one IDP to default to?


Please advise...

Joel

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Tuesday, March 12, 2019 11:03 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: SessionInitiator handler at duplicate Location (/Login) will not be processed for application (default) - default IDP function not working since SP upgrade from v2 to v3

On 3/12/19, 10:59 AM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at signet.id> wrote:

> My first hunch would be that you still have an old set of 
> <SessionInitiator> elements located at the /Login location and a 
> normal new <SSO> element and the two are conflicting with each other.  You likely don't need the old <SessionInitiator> elements and can safely delete them.

That's correct, and this isn't new. The old SP had silent behavior that ignored the duplication, and the new SP warns about it. If it worked before, that's purely accidental as it was always a broken configuration.

-- Scott


--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=bFSfV3JDZVFjkVdrOg1Bnsgwku-x_EGNRi2KNxwvClI&r=WG-pl0WpwyPk-r6oNnUhsoAUBdVNpC8ryokTG8RkffA&m=K7YMOkHuYfe7-ARL0rnLvFc8o2nk1GeMiDcOXr4NJOQ&s=nd9CdOYXyCpkWb9QdP7pR2SBj4_fvU_Tw5L9GN4485Y&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net