iOS devices time out when redirected to Shibboleth

[Jon Agland]

Hi Nick,
It might be a little off topic, but hoping I can steer you in the
direction of getting some help...
Assuming shib.name-of-college.ac.uk, is a UK federation member, but
even if it's not, then you are and your SAML SP / entity is registered
with us....   Can you raise a call with the our team at Jisc supporting
the UK federation via service at ukfederation.org.uk please 
(https://www.ukfederation.org.uk/content/Documents/FedSupport#helpdesk)
?
If you are able to ask the customer to test with a test service e.g. 
https://test.ukfederation.org.uk (I'm thinking they'll have the same
problem!), and also tell us on that message (off list) who name-of-
college.ac.uk are please (and if it's not a UK federation member, we
can steer you to the other eduGAIN federation involved for support)
Other thoughts..
- Other SAML is probably via Azure/Entra ID direct, rather than via
their Shibboleth Identity provider.- 403 forbidden is not a shock , the
IdP is for most deployments hosted at /idp- I'd suspect it's the issue
of the IdP being hosted internally or "in a DMZ" combined with DNS,
maybe DNS over https getting in the way, firewalls not translating
traffic which arrives from not the internet etc..
Kind regards,
Jon
On Thu, 2023-10-12 at 12:42 +0100, Nick Myers via users wrote:
> Hello,
> 
> Please reject this message or don't reply if this is not an
> appropriate question to ask here.  I'm trying to help someone that is
> using Shibboleth in front of on Azure AD Enterprise App, and when
> using IOS devices on one Wifi network, Redirect requests the browser
> makes to their Shibboleth host time out.
> 
> I use Okta to provide our SAML Service Provider capabilities, with a
> Cirrus Proxy to provide Federated SAML via the likes of Edugain,
> InCommon, etc.  This is working well for 1500+ customers.
> 
> We have a customer who explains that:
> On iPad and iOS devices,When connected to a specific Wifi network
> (doesn't happen on mobile network, or other Wifi networks)When the
> Redirect request occurs from to their host (
> https://shib.name-of-college.ac.uk)The request always times out
> (Safari and Chrome)
> This does not happen on other networks, or on non-iOS devices on the
> specific Wifi network experiencing the issue.
> 
> The customer's own IT folk are not accepting my conclusion that there
> must be something about the connectivity to the Shib host, network,
> or DNS resolution, affecting those devices, and are telling me that
> "all of our other SAML SSO logins with other vendors work fine, it's
> just your service".
> 
> I wondered whether anyone had experienced this particular issue,
> perhaps this is not an uncommon issue for iOS devices.
> 
> I have asked them to use their iOS devices, and go to 
> https://shib.name-of-college.ac.uk directly, which also times out (it
> should display a 403 Forbidden).  I think this proves that these
> devices are being prevented from connecting, but the customer IT folk
> are insistent this is not the case and assigning responsibility to
> our service.
> 
> Thank you for taking the time to read, and again, my apologies if
> this is off-topic for the group.
> 
> Best
> Nick
> 
> 
> 

Jon Agland
Technical Services Manager - Trust and Identity
T 02038198207
M 07443984222
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG

https://www.jisc.ac.uk/trust-and-identity
https://www.ukfederation.org.uk
 
Jisc is a registered charity (number 1149740) and a company limited by
guarantee which is registered in England under company number.
05747339, VAT number GB 197 0632 86.  Jisc’s registered office is: 4
Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company
limited by guarantee which is registered in England under company
number 02881024, VAT number GB 197 0632 86. The registered office is: 4
Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231012/c7d4d6e0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6452 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20231012/c7d4d6e0/attachment.p7s>