Looping issue where no cookies are being sent in the response (Azure ad, shibboleth sp)

[Gregor Bračko]

Hi, I'm running into a loop problem with Shibboleth over SSL. But it

doesn't appear to be any of the usual issues that people run into.

Basically, it looks like the /Shibboleth.sso/SAML2/POST request is not

sending a cookie in the response and therefore not setting a cookie in the

browser and so I get stuck in an authentication loop.
I am using Azure AD with Shibboleth SP.



All requests are going over SSL.



We are also using our own authentication and login (example.com/login),
users with azure account will go to example.com/shib to authenticate, so
maybe this is the problem?

Sadly the web app is running inside our domain so it is not exposed to
public.



Thanks:)

-Gregor



Shibd.log:

2022-07-29 10:44:37 DEBUG Shibboleth.Listener [1]: dispatching message
(default::getHeaders::Application)

2022-07-29 10:44:37 DEBUG Shibboleth.Listener [2]: dispatching message
(default::getHeaders::Application)

2022-07-29 10:44:37 DEBUG Shibboleth.Listener [3]: dispatching message
(default::getHeaders::Application)

2022-07-29 10:44:37 DEBUG Shibboleth.Listener [5]: dispatching message
(default::getHeaders::Application)

2022-07-29 10:44:37 DEBUG Shibboleth.Listener [4]: dispatching message
(default::getHeaders::Application)

2022-07-29 10:44:42 DEBUG Shibboleth.Listener [4] [default]: dispatching
message (default/Login::run::SAML2SI)

2022-07-29 10:44:42 DEBUG XMLTooling.StorageService [4] [default]: inserted
record (8432a103eddf078bb86a437c876f883de8ddfa0b8d52cff4736eecf686888287)
in context (RelayState) with expiration (1659092082)

2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]
[default]: validating input

2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]
[default]: marshalling, deflating, base64-encoding the message

2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]
[default]: marshalled message:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL=https://example.com/Shibboleth.sso/SAML2/POST
Destination=
https://login.microsoftonline.com/0a084bbe-8d88-4a38-a716-f33ffea70258/saml2
ID="_d4649ee0db0ab0852c266aff1b60023f" IssueInstant="2022-07-29T10:44:42Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
https://example.com/shibboleth</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest>

2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]
[default]: message encoded, sending redirect to client

2022-07-29 10:44:42 DEBUG Shibboleth.Listener [4] [default]: dispatching
message (default/Login::run::SAML2SI)

2022-07-29 10:44:42 DEBUG XMLTooling.StorageService [4] [default]: inserted
record (e6339e249e425f618ddf153b37e8f1e9083a84bff246c473622d3235accdcacb)
in context (RelayState) with expiration (1659092082)

2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]
[default]: validating input

2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]
[default]: marshalling, deflating, base64-encoding the message

2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]
[default]: marshalled message:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL=https:// example.com /Shibboleth.sso/SAML2/POST
<https://tmp.imagine.si/Shibboleth.sso/SAML2/POST> Destination=
https://login.microsoftonline.com/0a084bbe-8d88-4a38-a716-f33ffea70258/saml2
ID="_ecd8905ac76e344e04e39907005140af" IssueInstant="2022-07-29T10:44:42Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https:// example.com
/shibboleth</saml:Issuer><samlp:NameIDPolicy
<https://tmp.imagine.si/shibboleth%3c/saml:Issuer%3e%3csamlp:NameIDPolicy>
AllowCreate="1"/></samlp:AuthnRequest>

2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [4]
[default]: message encoded, sending redirect to client



Apache config:

<VirtualHost *:80>

    DocumentRoot "${APACHE_DOCUMENT_ROOT}/ProjektiWeb/imWeb.ERP/public/"

    ServerName example.com

    RewriteEngine On

    ErrorLog ${APACHE_LOG_DIR}/error.log

    CustomLog ${APACHE_LOG_DIR}/access.log combined



    <Location /shib>

      AuthType shibboleth

      ShibRequestSetting requireSession 1

      require valid-user

  </Location>

   <Location /Shibboleth.sso>

      AuthType shibboleth

      ShibRequestSetting requireSession 1

      require valid-user

</Location>

</VirtualHost>



shibboleth2.xml file (parts that i changed):

<ApplicationDefaults entityID=https://example.com/shibboleth

        REMOTE_USER="eppn subject-id pairwise-id persistent-id"


cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">



                <Sessions lifetime="28800" timeout="3600"
relayState="ss:mem"

                 consistentAddress="true" handlerURL="/Shibboleth.sso"

                 checkAddress="false" handlerSSL="true" cookieProps="https">



                <SSO entityID=
https://sts.windows.net/yyyyyy-8d88-4a38-a716-xxxxxxxx/

                 discoveryProtocol="SAMLDS" discoveryURL=
https://ds.example.org/DS/WAYF>

              SAML2

            </SSO>

<MetadataProvider type="XML" validate="false" path="partner-metadata.xml"/>

</ApplicationDefaults>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220729/79011f00/attachment.htm>