facing apache httpd server start issue with latest
Rathore, Rajendra
rarathore at ptc.com
Tue Jul 13 12:10:28 UTC 2021
Hi Peter,
I am using Centos 7, I install latest apache with below module
OS - CentOS7
Apache version 2.4.46
OpenLdap: 2.4.58
OpenSSL: 1.1.1k
Shibboleth IDP: 3.2.2
------------------------------
Message: 2
Date: Mon, 12 Jul 2021 14:46:19 +0200
From: Peter Schober <peter.schober at univie.ac.at>
To: users at shibboleth.net
Subject: Re: facing apache httpd server start issue with latest
shibboleth version(3.2.2)
Message-ID: <20210712124619.2fqqxrmoevbm7cxk at aco.net>
Content-Type: text/plain; charset=us-ascii
* Rathore, Rajendra <rarathore at ptc.com> [2021-07-12 07:24]:
> I just saw your mail and you are saying that you applied some patch on
> installed one, can you please share the details, what is path to fix
> that issue OOTB since it won't cause issue in old version.
There's nothing for you to patch. What you can do is provide technical details about your deployment, i.e., exact versions of the OS / distribution and how you're installing what exact packages of the software.
-peter
------------------------------
Message: 3
Date: Mon, 12 Jul 2021 12:58:54 +0000
From: Spencer Thomas <Spencer.Thomas at ithaka.org>
To: Shib Users <users at shibboleth.net>
Subject: Re: Sending the SAMLReply/Assertion
Message-ID:
<CH2PR10MB3944F1CDDC5192ECDCBEEA50EE159 at CH2PR10MB3944.namprd10.prod.outlook.com>
Content-Type: text/plain; charset="windows-1252"
Your SP metadata provides them with the encryption cert to use and the supported algos and the IdP builds from that menu. So, the only thing you'd be really auditing is your own config.
- Steve
I have had plenty of cases where I want to know what my clients are actually doing, so that I can understand the impact of a proposed change. In this case, it?s probably less critical, since one would expect that most IdPs can adapt to changes in the encryption list. But it?s still a real use case.
--
Spencer Thomas
Technical Architect / JSTOR and Artstor
ITHAKA<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ithaka.org%2F&data=04%7C01%7Crarathore%40ptc.com%7C6f0e9d919abb430e73b308d945f5c727%7Cb9921086ff774d0d828acb3381f678e2%7C0%7C0%7C637617746117730387%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=%2FfycNrevM0HoUr4V9TpayckKPAjnoPM6etdoKzKUQas%3D&reserved=0> / 301 E. Liberty St, Suite 250, Ann Arbor, MI 48104
Email: Spencer.Thomas at ithaka.org<mailto:Spencer.Thomas at ithaka.org>
Voicemail: +1-734-887-7004
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fshibboleth.net%2Fpipermail%2Fusers%2Fattachments%2F20210712%2F502201f3%2Fattachment-0001.htm&data=04%7C01%7Crarathore%40ptc.com%7C6f0e9d919abb430e73b308d945f5c727%7Cb9921086ff774d0d828acb3381f678e2%7C0%7C0%7C637617746117730387%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=F8M34FSWCS2yFs3jPyS6oH%2B7nlGwJ9Eyo38Zq0FoJ%2Fk%3D&reserved=0>
------------------------------
Message: 4
Date: Mon, 12 Jul 2021 13:04:06 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: Sending the SAMLReply/Assertion
Message-ID: <7B2470A0-BEF3-4D60-B219-5B6D73554932 at osu.edu>
Content-Type: text/plain; charset="utf-8"
Realistically, I'm not adding more audit logging right now in the SP. Once it's been redone in Java and is just a totally different codebase, it will likely fall out of the existing logging code we have for the IdP.
-- Scott
------------------------------
Message: 5
Date: Mon, 12 Jul 2021 15:43:03 +0200
From: Peter Schober <peter.schober at univie.ac.at>
To: users at shibboleth.net
Subject: Re: Sending the SAMLReply/Assertion
Message-ID: <20210712134303.53ajx7dmvmh4ujn2 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Jan Vilhuber <JVilhuber at absolute.com> [2021-07-12 04:58]:
> Another idea: Is there an SP API (Soap or otherwise) where I might be
> able to get the saml assertion from the SP given a session Index?
This (and the AssertionExport docs Steve shared) won't help, I think, as the decoded, decrypted assertion(s) you get from the SP contain(s) none of the things you're looking for (certificates or details about the crypto used).
Other than that (i.e., for other purposes) it works fine.
-peter
------------------------------
Message: 6
Date: Mon, 12 Jul 2021 13:54:15 +0000
From: "Mak, Steve" <makst at upenn.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: Sending the SAMLReply/Assertion
Message-ID: <D4A94607-7781-46E3-81E7-F423BD7CA8A8 at upenn.edu>
Content-Type: text/plain; charset="utf-8"
I have one client where we sign the assertion and they store the signed assertion for analysis. I think that's about the only thing you can retain.
?On 7/12/21, 9:43 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:
* Jan Vilhuber <JVilhuber at absolute.com> [2021-07-12 04:58]:
> Another idea: Is there an SP API (Soap or otherwise) where I might
> be able to get the saml assertion from the SP given a session Index?
This (and the AssertionExport docs Steve shared) won't help, I think,
as the decoded, decrypted assertion(s) you get from the SP contain(s)
none of the things you're looking for (certificates or details about
the crypto used).
Other than that (i.e., for other purposes) it works fine.
-peter
--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crarathore%40ptc.com%7C6f0e9d919abb430e73b308d945f5c727%7Cb9921086ff774d0d828acb3381f678e2%7C0%7C0%7C637617746117730387%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=gua3zlfRy%2BBVsDm42fwLRoFbb5ROY%2BPdqFFvEyWpslU%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
------------------------------
Message: 7
Date: Mon, 12 Jul 2021 16:36:05 +0200
From: Peter Schober <peter.schober at univie.ac.at>
To: users at shibboleth.net
Subject: Re: Sending the SAMLReply/Assertion
Message-ID: <20210712143605.l424mezkn6ockhfx at aco.net>
Content-Type: text/plain; charset=us-ascii
* Mak, Steve <makst at upenn.edu> [2021-07-12 15:54]:
> I have one client where we sign the assertion and they store the
> signed assertion for analysis.
>From where? I don't get the signed assertion from the AssertionExport
endpoint but a cleaned-up one:
$ curl -sS '127.0.0.1/Shibboleth.sso/GetAssertion?key=_foo&ID=_bar | tail -1 | xmllint --format - | head -4 <?xml version="1.0"?> <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_bar" IssueInstant="2021-07-12T13:35:16.087Z" Version="2.0">
<saml2:Issuer>https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fidp.example.org%2F&data=04%7C01%7Crarathore%40ptc.com%7C6f0e9d919abb430e73b308d945f5c727%7Cb9921086ff774d0d828acb3381f678e2%7C0%7C0%7C637617746117730387%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=dfeMlZloogvVhapL6wHEA4CHVnWCXUAIXftoHkRi56k%3D&reserved=0</saml2:Issuer>
<saml2:Subject>
Best,
-peter
------------------------------
Message: 8
Date: Mon, 12 Jul 2021 14:43:45 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: Sending the SAMLReply/Assertion
Message-ID: <F4244CB4-609E-4831-9905-2292413A06D4 at osu.edu>
Content-Type: text/plain; charset="utf-8"
On 7/12/21, 10:36 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:
> From where? I don't get the signed assertion from the AssertionExport
> endpoint but a cleaned-up one:
It will contain the signature if it's been signed, most aren't of course, the response is.
-- Scott
------------------------------
Message: 9
Date: Tue, 13 Jul 2021 09:05:11 +0000
From: Jan Vilhuber <JVilhuber at absolute.com>
To: Shib Users <users at shibboleth.net>
Subject: Re: Sending the SAMLReply/Assertion
Message-ID:
<MW4PR15MB4618B17E05E08DF464BCD130D3149 at MW4PR15MB4618.namprd15.prod.outlook.com>
Content-Type: text/plain; charset="windows-1252"
Sure, but say I?m planning on migrating all my customers from sha-1 to sha-256, for example, I?d like to know which of them might still be using Sha-1 before I turn that off. If I could get a list (metrics) indicating that IDP-X is using SHA-1, then I would reach out to them and ask ?does your IDP even support sha-256??, for example.
Similarly, in a certificate rollover, I?d want to tell customers ?you?re still using the old metadata and cert. Please update.?
Without knowing who is actually doing what, I can?t really just disable things (potentially breaking a customer?s access).
Or am I thinking about this wrong?
Jan
From: users <users-bounces at shibboleth.net> on behalf of Mak, Steve <makst at upenn.edu>
Date: Monday, 12 July 2021 at 10:11
To: Shib Users <users at shibboleth.net>
Subject: Re: Sending the SAMLReply/Assertion Jan,
Another idea: Is there an SP API (Soap or otherwise) where I might be able to get the saml assertion from the SP given a session Index?
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FSP3%2FAssertionExport&data=04%7C01%7Crarathore%40ptc.com%7C6f0e9d919abb430e73b308d945f5c727%7Cb9921086ff774d0d828acb3381f678e2%7C0%7C0%7C637617746117740344%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=ijgrBANXfxkCD4OpiIQA7l9B6bZyp23%2FQlh6QXiFLr8%3D&reserved=0<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FSP3%2FAssertionExport__%3B!!GEjU_1jlQXGQfQ!zNO34PJuMU3z1J98VK87x159ZxHTZpUd4Kl65pZL6U_glsG1vwgp2GpMXlHOuEyLog%24&data=04%7C01%7Crarathore%40ptc.com%7C6f0e9d919abb430e73b308d945f5c727%7Cb9921086ff774d0d828acb3381f678e2%7C0%7C0%7C637617746117740344%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=36xK1jL3NE7vDxavVoYgOFMM%2B6pGj38Q4Y0UUtNk%2FDI%3D&reserved=0>
What I?m specifically looking for is things like which hashing and encryption algorithms (and hopefully which certificate was used, i.e. things like SP subject-name and serial number) were used (and by whom).
I want to remind you that the encryption that an IdP uses will be something it picks from your service's supported encryption algos which will be listed in your SP metadata? so if you want to strike an algo off your list you would simply update your sp metadata and communicate that change to the IdP. At least that's what it's there for. I'm not sure if you're implying that IdPs simply pick whatever they want and that's not always the case. Your SP metadata provides them with the encryption cert to use and the supported algos and the IdP builds from that menu. So, the only thing you'd be really auditing is your own config.
- Steve
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fshibboleth.net%2Fpipermail%2Fusers%2Fattachments%2F20210713%2Fc8280efc%2Fattachment-0001.htm&data=04%7C01%7Crarathore%40ptc.com%7C6f0e9d919abb430e73b308d945f5c727%7Cb9921086ff774d0d828acb3381f678e2%7C0%7C0%7C637617746117740344%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=zCVYXnFZOgLPLSRRB%2FwUD5QyZz6xyLZoiIJ6t3WW4sk%3D&reserved=0>
------------------------------
Subject: Digest Footer
--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crarathore%40ptc.com%7C6f0e9d919abb430e73b308d945f5c727%7Cb9921086ff774d0d828acb3381f678e2%7C0%7C0%7C637617746117740344%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=qO00Irp90tsu5CES06AcnDmk%2BEXqek76oXBjHPzjDMY%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
------------------------------
End of users Digest, Vol 121, Issue 11
**************************************
More information about the users
mailing list