ACS URL or maybe post-auth target redirect?

Wed Jul 6 19:51:06 UTC 2022

A related question / issue would be help in letting me configure / specify the ACS URL that SP / shibd puts in the AuthRequest that it initially sends to the IdP

From: Woolf, Carl <Carl_Woolf at hms.harvard.edu>
Date: Wednesday, July 6, 2022 at 3:47 PM
To: users at shibboleth.net <users at shibboleth.net>
Subject: ACS URL or maybe post-auth target redirect?

(Still thankful for help I got in this forum back in March, with setting up my EDS!)

As my Plan A, I am trying to get my IdP, after authentication, to call my own …/rest/consume, instead of the Shibboleth.sso/SAML2/POST that it is going to now.

As a Plan B, less desirable, I would try to adjust the target URL that it returns to after authentication and SAML2/POST to be my static value.

I tried (1)-(4) below, hoping for success in either Plan A or B. (1) and (2) seem to have no effect. (3) and (4) fail, and the error messages lead me to think that they may not be (directly) addressing either of my goals. FWIW, the errors also indicate that Shibboleth pays attention only to my host-and-port, not the whole path in the URL.

For experimental clarity in the error messages, I used different ports for each of the 4 cases. And of course my ‘final’ version would probably not be saying 127.0.0.1

Any guidance / help to get either my ACS URL (AssertionConsumerServiceURL) to go to my /consume, or to get the post-authentication target page to go there?

Thanks, - Carl

-----------------------------------------------------------------------------------------------------------------

(0) Using SHIBD 3:

[root at shrine-sso-node01 conf.d]# shibd -v

shibboleth 3.3.0

(1) Try to Intercept saml2/post in sp.conf

<LocationMatch "/Shibboleth.sso/SAML2/POST">

    RewriteRule .* http://127.0.0.1:8081/shrine-api/sso/rest/consume [R]

</LocationMatch>

See: https://shibboleth.atlassian.net/wiki/spaces/IDP30/pages/2496561158/Troubleshooting#Troubleshooting-Theloginservicewasunabletoidentifyacompatiblewaytorespondtotherequestedapplication...

The value of the URL in a Shibboleth SP is determined by the computed request URL that led to the issuance of the request and is primarily a function of web server configuration (on Apache)

(my emphasis added)

Apparently a no-op. No effect (Sending that location  via ProxyPass* to …./consume also has no effect)

(2) Set override-target in sp.conf

ShibRequestSetting target http://127.0.0.1:8082/shrine-api/sso/rest/consume

See: https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335062/Apache#Properly-Routing-Handler-URLs

AuthConfig Options / ShibRequestSetting setting value

which uses

https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334723/ContentSettings

See: target

Allows the resources to return to after SSO to be "locked" to a specific value, even when running as a result of active protection of other resources. In other words, this value overrides the actual resource location when SSO redirection is automatic, including initial access and after a timeout.

Apparently a no-op — no error (see (3) and (4) below) and no effect

(3) Try to intercept in RequestMap in shibboleth2.xml

<RequestMapper type="Native">

    <RequestMap target="http://127.0.0.1:8083/shrine-api/sso/rest/consume">

    </RequestMap>

</RequestMapper>

See: https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334885/RequestMap

target

Allows the resources to return to after SSO to be "locked" to a specific value, even when running as a result of active protection of other resources. In other words, this value overrides the actual resource location when SSO redirection is automatic, including initial access and after a timeout.

Oops, results in Error details: MSIS3200: No AssertionConsumerService is configured on the relying party trust…that is a prefix match of the AssertionConsumerService URL 'https://127.0.0.1:8083/Shibboleth.sso/SAML2/POST'

(4) Try to intercept in <SSO> in shibboleth2.xml

<SSO entityID="http://sso.med.harvard.edu/adfs/services/trust"

     target="http://127.0.0.1:8084/shrine-api/sso/rest/consume">

    SAML2

</SSO>

See: https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334348/SSO

target

Allows the resources to return to after SSO to be "locked" to a specific value, even when running as a result of active protection of other resources. In other words, this value overrides the actual resource location when SSO redirection is automatic, including initial access and after a timeout.

Oops, results in Error details: MSIS3200: No AssertionConsumerService is configured on the relying party trust 'https://shrine-sso-node01.catalyst.harvard.edu' that is a prefix match of the AssertionConsumerService URL 'https://127.0.0.1:8084/Shibboleth.sso/SAML2/POST'

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220706/d68aee40/attachment.htm>