No error logged when entity ID mismatched between shibd and mod_shib

[Wessel, Keith]

Hi, all,

Wondering if this is a bug or intentional. If a bug, I'm happy to file an issue.

I've got two containers running together: one runs shibd, one runs Apache and mod_shib. A couple of things, including the SP's entity ID, get substituted in at start-up. This works fine as long as one pays attention to what they're doing and maps the same value into the variable that contains the SP entity ID. I, unfortunately, was the one who wasn't paying attention.

However, the logs for shibd and the native log don't make this rather weird condition apparent. Shibd correctly sends the request to the IdP, things come back, Shibd processes the response and maps attributes, but mod_shib rejects the response. It rejects it without error. Instead, after rejecting it, it treats the user as unauthenticated and, if accessing a resource that requires authentication, it loops back to the IdP three or four times before the IdP says "enough" and throws back a failure response to the SP.

This mismatched shibboleth2.xml, while rare, still seems like an obvious case for an error in the logs. I'm happy to submit an issue, but I thought I'd ask first if there was a reason that an error wasn't logged.

Thanks,
Keith