[EXTERNAL] Re: Missing Shibboleth attributes in $_Server

[MARTINEZ, ARIEL]

Here is the info requested:

* OS and version
CentOS 7.8.2003 64 bit

* web server and version
Apache 2.4.6

* Shib SP vesion, and how exactly you installed the SP:

Shibboleth SP 3.1.0 x86_x64 installed via yum using the following repo: 

[security_shibboleth]
name=Shibboleth (CentOS_7)
type=rpm-md
baseurl=http://download.opensuse.org/repositories/security:/shibboleth/CentOS_7/
gpgcheck=1
gpgkey=http://download.opensuse.org/repositories/security:/shibboleth/CentOS_7/repodata/repomd.xml.key
enabled=1


* What you did to configure it in your server, including relevant
  config snippets

Apart from modifying the shibboleth2.xml and attribute_map.xml files as needed to integrate with my ADFS idp, no major changes have been made. I also ran a script  to allow apache to communicate with Shibboleth through SELINUX, though for testing I have disabled SELINUX.

For testing, the only config file that has the Shibboleth authentication block is shib.conf with the following:

<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require shib-session
</Location>


* How exactly you tested that no attributes are available
  (You reference "$_Server" in the subject of this email, which
  doesn't mean anything to me. In case you're meant the PHP
  super-global variable that's called "$_SERVER".)

Correct I meant the php global variable $_SERVER. I have a php file in the /secure directory of my web server with the following code to print out the variables but there are none from Shibboleth even though a valid session is present:

<?php
    print "<pre>\n";
    print_r ($_SERVER);
    print "</pre>\n";
?>

Browsing to Shibboleth.sso/Session generates the following (removed values from Client Address, Identity Provider and the Attributes):

Miscellaneous
Session Expiration (barring inactivity): 479 minute(s)
Client Address: 
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Identity Provider: 
Authentication Time: 2020-09-20T16:01:53.574Z
Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)

Attributes
SHIB_EPPN: 
displayName: 
mail: 

  * E.g.: what happens if you first establish a session by going to
    /Shibboleth.sso/Login and then right after that access /secure ?
    (or both in one go via /Shibboleth.sso/Login?target=/secure )

In both cases I get the error "Unauthorized This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required."



Thanks.

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober
Sent: Sunday, September 20, 2020 9:03 AM
To: users at shibboleth.net
Subject: [EXTERNAL] Re: Missing Shibboleth attributes in $_Server

WARNING: This email originated outside the Hostos campus. Do not click links or open attachments unless you recognize the sender and know the content is safe. Never provide login credentials, financial or sensitive details in response to an email or by clicking on a link. Report suspicious emails to: reportspam at hostos.cuny.edu


* MARTINEZ, ARIEL <AMARTINEZ at hostos.cuny.edu> [2020-09-19 05:28]:
> I went down to basics just cutting out the application for now and 
> trying to get the  /secure directory to work. But I get an 
> Unauthorized message and it does not redirect to my idp.

That suggests a web server misconfiguration as a working/correct configuration snippet should have been installed by default, cf.:
https://git.shibboleth.net/view/?p=cpp-sp.git;a=blob;f=configs/apache24.config.in;hb=HEAD
or for the old Apache httpd 2.2:
https://git.shibboleth.net/view/?p=cpp-sp.git;a=blob;f=configs/apache22.config.in;hb=HEAD

So you should start providing specific details about your deployment:

* OS and version
* web server and version
* Shib SP vesion, and how exactly you installed the SP:
  * via YUM and using what repo exactly
  * from downloaded RPMs
  * from re-built SRPMs and for what web server version
  * compiled from source
* What you did to configure it in your server, including relevant
  config snippets
* How exactly you tested that no attributes are available
  (You reference "$_Server" in the subject of this email, which
  doesn't mean anything to me. In case you're meant the PHP
  super-global variable that's called "$_SERVER".)
  * E.g.: what happens if you first establish a session by going to
    /Shibboleth.sso/Login and then right after that access /secure ?
    (or both in one go via /Shibboleth.sso/Login?target=/secure )

> Manually browsing to Shibboleth.sso\Login works to authenticate but no shibboleth variables.

This (accessing /Shibboleth.sso/Login) just initiates a session. *Where* the variables would be visible (at what REQUEST_URI) depends on your server configuration:

Unless you added a request parameter (e.g. target=URL) to /Shibboleth.sso/Login when initiating a session or alternatively hard-coded a 'homeURL' value in your shibboleth2.xml configuration you will end up at your web server's root (/) URL after returning from the IDP with a SAML Assertion.
Since the root URL of your server is not by default protected by the Shibboleth SP (see above config snippets) you'd NOT see any attributes there.
I.e., without additional configuration you will NOT see any attributes by simply accessing /Shibboleth.sso/Login and following all the redirects to a non-protected web server resource.

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net