Configure Login handler

[Goldberg, Arthur P]

I should have asked an explicit question: how should a Login handler be configured in a Sessions element?

Thanks
Arthur

From: users <users-bounces at shibboleth.net> on behalf of "Goldberg, Arthur P" <arthur.p.goldberg at mssm.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, May 20, 2021 at 7:25 PM
To: Shib Users <users at shibboleth.net>
Subject: Configure Login handler

Hello Shib users

Earlier I wrote that I’m configuring an SP using Shibboleth and Apache that will access an IdP that uses Azure.

I believe that all the parts of the SP and IdP that I understand are now configured. One remaining part the confuses me is the configuration of the Login Handler in the SP. The Azure people specify a login URL of the form,

https://login.microsoftonline.com/<https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=ogenhxDeC9vQnH7imIif8Q7ScxuNZTaAW4gSeGShLuw&e=> uid-here /saml2

which is the same as a logout URL. My shibboleth2.xml file contains this Sessions element, with the same uid-here in multiple places:

        <Sessions lifetime="28800" timeout="3600" checkAddress="false"
                relayState="ss:mem" handlerSSL="true" cookieProps="https">

            <!-- AG: entityID configured; is the trailing "/" right? does it matter? -->
            <!-- https://wiki.shibboleth.net/confluence/display/SP3/SSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=G39clq3g4tStYbWyKvce62mXtY3Piuyh8rGbVkDXeNs&e=> -->
            <SSO isDefault="true" entityID="https://sts.windows.net/<https://urldefense.proofpoint.com/v2/url?u=https-3A__sts.windows.net_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=DLyMNq7lc0wzI-08UJwgDa0zWD6a7VOErJbcop-m7fo&e=> uid-here /">
                SAML2 SAML1
            </SSO>

            <!-- AG: configured -->
            <Logout outgoingBindings="https://login.microsoftonline.com/<https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=ogenhxDeC9vQnH7imIif8Q7ScxuNZTaAW4gSeGShLuw&e=> uid-here /saml2">SAML2</Logout>

            <!-- AG: confused -->
            <!-- https://wiki.shibboleth.net/confluence/display/SP3/SSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=G39clq3g4tStYbWyKvce62mXtY3Piuyh8rGbVkDXeNs&e=> refers to a ''"/Login" handler'
            but https://wiki.shibboleth.net/confluence/display/SP3/Handler<https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_Handler&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=kCKiDGBq8gCbOb_Q7ImF2TTLfpF4_K92LF0lmqX-Xe0&e=> does not. How should the
            login URL of an Azure SAML2 IdP be configured? -->

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1<https://urldefense.proofpoint.com/v2/url?u=http-3A__127.0.0.1&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=V733VTQkzIjkYewWfcUAXfTlOTVauVAWUvBMOuJV7Zw&e=> ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed" dir="/data/shibds/discofeed"/>
        </Sessions>

See my comments about the Login Handler. In addition, I tried configuring a <Login> element structured like the Logout element, but shibd failed to start. Also, a search for “Login handler” in the Service Provider 3 space on wiki.shibboleth.net<https://urldefense.proofpoint.com/v2/url?u=http-3A__wiki.shibboleth.net&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=Ewed1y_zfgdvPRV_pwpRFOxdLy3YTyrS8U0jfBtU5ug&e=> did not return documentation that enlightened me WRT configuring the Login Handler.

Thanks
Arthur
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210521/2a8baaa1/attachment.htm>