Looping issue where no cookies are being sent in the response (Azure ad, shibboleth sp)

[Peter Schober]

* Gregor Bračko via users <users at shibboleth.net> [2022-07-29 15:20]:
> All requests are going over SSL.

That doesn't match the configuration you've shared:

> Apache config:
> 
> <VirtualHost *:80>

So there must also be proxying and TLS-offloading in play.
In which case I'd set ServerName with correctly virtualised scheme and
port ("ServerName https://tmp.imagine.si:443" in your case, I think).
Though that doesn't appear to be the root of your problem as the ACS
URL in the Authentication Request generated by the SP seems to be OK.

This OTOH makes no sense -- though the software probably protects you
from shooting yourself in the foot that way by ignoring it, AFAIR:

<Location /Shibboleth.sso>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require valid-user
</Location>

Obviously (?) you can't protect the URL where the Shib SP receives the
SAML response from the IDP (among other things) with Shibboleth,
otherwise you'd never get it.
(Your server protects real location A, sends an authn request to the
IDP, the IDP's response goes to the SP's ACS URL, that's protected
with Shib and so another authn request to the IDP is sent, but the
second response response etc.)

So I'd start by fixing both of these issues just to be sure I'm not
relying on internals of the software to fix my configuration mistakes.

-peter