Detected spoofed header: HTTP_SHIB_COOKIE_NAME

[Wessel, Keith]

Hi, all,

I'm helping an application admin get Shibboleth working with a Coldfusion app running behind IIS. The app has most of the site protected by Shibboleth with the exception of a couple of specific paths that are set to not authenticate in the request map.

When he visits the root of the site, he's sent to the IdP to authenticate, then on to the Coldfusion app normally. But when he visits one of the paths that are listed in the request map as not requiring authentication, Shibboleth throws a 500 error. The error is that Shibboleth detected a spoofed header: HTTP_SHIB_COOKIE_NAME. He only gets the error for Coldfusion URLs that aren't protected. Protected pages don't throw the error, and unprotected static files outside of Coldfusion don't throw the error.

I'm at a loss where to start troubleshooting this. Presumably, the header's getting set then seen by the SP, but I don't know what's setting it when or why. The developer console in the browser didn't help as there's only a single request, and that header doesn't show up under any of the HTTP request headers.

Everything works fine when he turned off spoof checking. So, this seems to be the only issue.

Thoughts?

Thanks,
Keith