Configure Login handler
Goldberg, Arthur P
arthur.p.goldberg at mssm.edu
Fri May 21 16:10:02 UTC 2021
Thank you Nate, your response is helpful and clarifying. My summary is that I will not use a Login handler unless it becomes clear that I need one.
Regards
Arthur
On 5/20/21, 11:30 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at signet.id> wrote:
USE CAUTION: External Message.
Arthur,
You shouldn't need to create a "Login handler". It's technically a SessionInitiator, and (extremely) old-school configuration and the (not very) new SSO element can handle that for you in virtually every use case. There are some very special cases where you would need to define a SessionInitiator, but they are rare. Note the warning at the top of the page.
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SessionInitiator&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=syvRy22Wrfd8ua96QrukGpb6llW6knXl2IIKTSZlrSs&e=
One reason there is no "Login" handler under the enumeration is because, as it states on that page, it's only a bucket for other SP functionality that doesn't fit one of the major categories.
"The <Handler> element is used to configure generic SP handlers that offer miscellaneous functionality that doesn't fall into the categories covered by other predefined elements.
Typically, if a handler implements a SSO protocol, issues SSO requests, deals with logout, or implements other capabilities baked into the SAML 2.0 specification, it will not use the generic element to configure itself."
But the other, broader reason is that a "Login" handler doesn't really exist as a concept in the SP because the SP doesn't technically log you in. The IdP logs you in, directly or indirectly, and then relays information about that login and you to the SP. The SP may then choose to use that information in many ways, and often to log a user in.
All that said, the SSO element defaults to initiating sessions at /Shibboleth.sso/Login.
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=ubdzZ3WeSFvzzHfHrRUfEdaK8qR21l2oUFLtLucxtqg&e=
Azure is probably asking in a ham-fisted way for a SessionInitiation URL. This was unfortunately never standardized in SAML metadata until it was too late to gain widespread adoption. You probably want to use /Shibboleth.sso/Login with your Azure IdP entityID hardcoded into the SSO element.
I hope this helps,
Nate.
--------
Signet, Inc.
The Art of Access ®
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.signet.id&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=xgQrH8yiCjzE9VAniSdOzD1XmgcFZAHv2s5b2bXK3Cc&e=
-----Original message-----
From: Goldberg, Arthur P
Sent: Thursday, May 20 2021, 8:18 pm
To: Shib Users
Subject: Re: Configure Login handler
I should have asked an explicit question: how should a Login handler be configured in a Sessions element?
Thanks
Arthur
From:
users <users-bounces at shibboleth.net> on behalf of "Goldberg, Arthur P" <arthur.p.goldberg at mssm.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Thursday, May 20, 2021 at 7:25 PM
To: Shib Users <users at shibboleth.net>
Subject: Configure Login handler
Hello Shib users
Earlier I wrote that I’m configuring an SP using Shibboleth and Apache that will access an IdP that uses Azure.
I believe that all the parts of the SP and IdP that I understand are now configured. One remaining part the confuses me is the configuration of the Login Handler in the SP. The Azure
people specify a login URL of the form,
https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=10FihHQV3OpawnoiqQlWpq2DwzblAbvxB61XnDrOO3M&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=ogenhxDeC9vQnH7imIif8Q7ScxuNZTaAW4gSeGShLuw&e=>
uid-here /saml2
which is the same as a logout URL. My shibboleth2.xml file contains this Sessions element, with the same uid-here in multiple places:
<Sessions lifetime="28800" timeout="3600" checkAddress="false"
relayState="ss:mem" handlerSSL="true" cookieProps="https">
<!-- AG: entityID configured; is the trailing "/" right? does it matter? -->
<!--
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=ubdzZ3WeSFvzzHfHrRUfEdaK8qR21l2oUFLtLucxtqg&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=G39clq3g4tStYbWyKvce62mXtY3Piuyh8rGbVkDXeNs&e=> -->
<SSO isDefault="true" entityID="https://urldefense.proofpoint.com/v2/url?u=https-3A__sts.windows.net_&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=idwWhMEzKh6G5ouwLhbFX_Pk7CJ764GPGg4ZzXX3pQU&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__sts.windows.net_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=DLyMNq7lc0wzI-08UJwgDa0zWD6a7VOErJbcop-m7fo&e=>
uid-here /">
SAML2 SAML1
</SSO>
<!-- AG: configured -->
<Logout outgoingBindings="https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=10FihHQV3OpawnoiqQlWpq2DwzblAbvxB61XnDrOO3M&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__login.microsoftonline.com_&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=ogenhxDeC9vQnH7imIif8Q7ScxuNZTaAW4gSeGShLuw&e=>
uid-here /saml2">SAML2</Logout>
<!-- AG: confused -->
<!--
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=ubdzZ3WeSFvzzHfHrRUfEdaK8qR21l2oUFLtLucxtqg&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_SSO&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=G39clq3g4tStYbWyKvce62mXtY3Piuyh8rGbVkDXeNs&e=> refers to a ''"/Login" handler'
but
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_Handler&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=BmUbT0MUhk4fyoCKHSxymBciCTRxw8qF60Brai7An64&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_SP3_Handler&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=kCKiDGBq8gCbOb_Q7ImF2TTLfpF4_K92LF0lmqX-Xe0&e=> does not. How should the
login URL of an Azure SAML2 IdP be configured? -->
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="https://urldefense.proofpoint.com/v2/url?u=http-3A__127.0.0.1&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=ZhKGIxbJl40WX7VXoM6AUHi2r21YL1SpVRQEUtjGtdk&e= <https://urldefense.proofpoint.com/v2/url?u=http-3A__127.0.0.1&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=V733VTQkzIjkYewWfcUAXfTlOTVauVAWUvBMOuJV7Zw&e=>
::1"/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed" dir="/data/shibds/discofeed"/>
</Sessions>
See my comments about the Login Handler. In addition, I tried configuring a <Login> element structured like the Logout element, but shibd failed to start. Also, a search for “Login
handler” in the Service Provider 3 space on
https://urldefense.proofpoint.com/v2/url?u=http-3A__wiki.shibboleth.net&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=8qBSJ0EjwwLHAAZF4NF7kNyyrN8o5siWNmacUamDP-Y&e= <https://urldefense.proofpoint.com/v2/url?u=http-3A__wiki.shibboleth.net&d=DwQGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=71b5ydCkHz3huSywqJw1KOD7OhwW7SG_FbwVFqib9ag&s=Ewed1y_zfgdvPRV_pwpRFOxdLy3YTyrS8U0jfBtU5ug&e=> did not return documentation that enlightened me WRT configuring the Login Handler.
Thanks
Arthur
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=SjjfRn96UI8NgnTUkwVLxw6jAplsHZ4Wevdmeb7ryLo&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwIGaQ&c=shNJtf5dKgNcPZ6Yh64b-A&r=ZCkl1RSA6OLXGMeLhWIeG8wvWwYPCSABQEpGFXsWEJg&m=I6u1udl9kg5Vydf7Gj-4Yk0LR-j0kwg2kHpaM86kQyk&s=SjjfRn96UI8NgnTUkwVLxw6jAplsHZ4Wevdmeb7ryLo&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list