Shibboleth SP RequestMapper attribute "target" not working in clustering configuration
Cipriani, Fabrizio
fabrizio.cipriani at uninettunouniversity.net
Wed Jun 19 14:17:09 UTC 2024
Using SP 3.4 I'm trying to use the "target" attribute to be redirected back
after logging in. This works nicely when on a single machine, but doesn't
work in a cluster. The cluster is behind a load balancer.
The session seems to work, both with and without clustering, since I can
load a protected resource after login and show the same correct session
data and server variables on all the machines. I just can't have the target
attribute working in a cluster.
The session is defined this way:
<DataSealer type="Static" key="<key>" />
<SessionCache type="StorageService" persistedAttributes="uid mail
givenName displayName" />
This is my requestmapper:
<RequestMapper type="Native">
<RequestMap>
<Host name="<sproot>">
<Path name="testsecure" >
<Path name="loginsso.aspx" requireSession="true">
<Query name="languagecode" regex="^it.*"
target="https:// <sproot>/it/loginsso.aspx" />
<Query name="languagecode" regex="^en.*"
target="https://<sproot>/testsecure/en/loginsso.aspx" />
<Query name="languagecode" regex="^fr.*"
target="https://<sproot>/ testsecure/fr/loginsso.aspx" />
<Query name="languagecode" regex="^ar.*"
target="https://<sproot>/testsecure/ar/loginsso.aspx" />
</Path>
</Path>
</Host>
</RequestMap>
</RequestMapper>
My ApplicationDefaults :
<ApplicationDefaults entityID="https://<sproot>/shibboleth"
REMOTE_USER="eppn subject-id pairwise-id persistent-id uid mail
givenName displayName"
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
The logs on the landing server when in clustering:
2024-06-19 15:52:35 DEBUG Shibboleth.Listener [1] [default]: dispatching
message (default/Login::run::SAML2SI)
2024-06-19 15:52:35 DEBUG XMLTooling.StorageService [1] [default]: inserted
record (2846ea8faf1327f78722c431ead8c4536316c3251db68487b8ce0b4c1b0f20e9)
in context (RelayState) with expiration (1718805755)
2024-06-19 15:52:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]
[default]: validating input
2024-06-19 15:52:35 DEBUG OpenSAML.MessageEncoder.SAML2 [1] [default]:
tracking request (_1f1b443a8d5b53c71ceb8f8b126691e7) against RelayState
token
(ss:mem:2846ea8faf1327f78722c431ead8c4536316c3251db68487b8ce0b4c1b0f20e9)
2024-06-19 15:52:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]
[default]: marshalling, deflating, base64-encoding the message
2024-06-19 15:52:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]
[default]: marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://<sproot>/Shibboleth.sso/SAML2/POST"
Destination="https://<idproot>idp/profile/SAML2/Redirect/SSO"
ID="_1f1b443a8d5b53c71ceb8f8b126691e7" IssueInstant="2024-06-19T13:52:35Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://<sproot>/shibboleth</saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest>
2024-06-19 15:52:35 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]
[default]: message encoded, sending redirect to client
2024-06-19 16:07:02 INFO XMLTooling.StorageService : purged 4 expired
record(s) from storage
Logs when it works on a single machine:
2024-06-19 11:37:34 DEBUG XMLTooling.StorageService [2] [default]: deleted
record (34714d31483b081cfedb09d2b8abc7c2260341572cf56c3729ce8834743ef824)
in context (RelayState)
2024-06-19 11:37:34 DEBUG Shibboleth.SSO.SAML2 [2] [default]: ACS returning
via redirect to: https://<sproot>/testsecure/en/loginsso.aspx
2024-06-19 11:37:34 DEBUG Shibboleth.Listener [2] [default]: dispatching
message (find::StorageService::SessionCache)
2024-06-19 11:37:34 DEBUG XMLTooling.StorageService [2] [default]: updated
expiration of valid records in context (_02341065cf0311611fa4e105bcfcff91)
to (1718793454)
2024-06-19 11:37:37 DEBUG Shibboleth.Listener [2] [default]: dispatching
message (default/Logout::run::SAML2LI)
2024-06-19 11:37:37 DEBUG Shibboleth.SessionCache [2] [default]: searching
for session (_02341065cf0311611fa4e105bcfcff91)
2024-06-19 11:37:37 DEBUG Shibboleth.SessionCache [2] [default]:
reconstituting session and checking validity
2024-06-19 11:37:37 DEBUG Shibboleth.SessionCache [2] [default]:
unmarshalled attribute (ID: mail) with 1 value
2024-06-19 11:37:37 DEBUG Shibboleth.SessionCache [2] [default]:
unmarshalled attribute (ID: uid) with 1 value
2024-06-19 11:37:37 DEBUG Shibboleth.SessionCache [2] [default]:
unmarshalled attribute (ID: givenName) with 1 value
2024-06-19 11:37:37 DEBUG Shibboleth.SessionCache [2] [default]:
unmarshalled attribute (ID: sn) with 1 value
2024-06-19 11:37:37 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]
[default]: validating input
2024-06-19 11:37:37 DEBUG OpenSAML.MessageEncoder.SAML2 [2] [default]:
tracking request (_1dbbd5a7c2ca89706685e05da9e5ef0c) against RelayState
token (corr:1718789857_be18)
2024-06-19 11:37:37 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]
[default]: marshalling, deflating, base64-encoding the message
2024-06-19 11:37:37 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]
[default]: signing the message
2024-06-19 11:37:37 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]
[default]: message encoded, sending redirect to client
2024-06-19 11:37:37 INFO Shibboleth.SessionCache [2] [default]: removed
session (_02341065cf0311611fa4e105bcfcff91)
2024-06-19 11:37:37 DEBUG XMLTooling.StorageService [2] [default]: inserted
record (_02341065cf0311611fa4e105bcfcff91) in context (Revoked) with
expiration (1718818654)
2024-06-19 11:44:42 INFO XMLTooling.StorageService : purged 4 expired
record(s) from storage
--
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240619/2ecd7b1f/attachment.htm>
More information about the users
mailing list