Re: [HUOMIO! VIESTI TOD. NÄK. HUIJAUS] Re: Why correct SessionInitiator isn't called

[Scott Alexander]

HI,

yes I noticed the wrong URLs

ended up with

<SessionInitiator target="/bin/idm/open/register01.pl?en" Location="/Login_en"

and

<SessionInitiator target="/bin/idm/open/register01.pl?fi" Location="/Login_fi"

thanks for the help.

Terveisin/Regards

Scott Alexander
Asiantuntija, järjestelmät Systems Specialist

Humak
Humanistinen ammattikorkeakoulu
University of Applied Sciences
www.humak.fi<http://www.humak.fi/>

Tel. +358 (0)50 411 9556

scott.alexander at humak.fi<mailto:scott.alexander at humak.fi>
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober via users <users at shibboleth.net>
Sent: 21 May 2024 15:04
To: users at shibboleth.net <users at shibboleth.net>
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: [HUOMIO! VIESTI TOD. NÄK. HUIJAUS] Re: Why correct SessionInitiator isn't called

Scott Alexander via users <users at shibboleth.net> [2024-05-21 08:41 CEST]:
> The location is different for each SessionInitiator
> but even though I use location in the browser
> (/bin/idm/open/register01_fi.pl) for the fi extension it always uses
> the first.

> <SessionInitiator Location="/bin/idm/open/register01.pl" type="SAML2" entityID="https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftesti.apro.tunnistus.fi%2Fidp1&data=05%7C02%7C%7C8e6acc4db38b4372d69608dc798e3cda%7Ca30a558eb6084b2c8f39a7fa426fa49d%7C0%7C0%7C638518899040784375%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=hnC%2FpytAO88%2F6YAKkWjTmhjM5hUUsrQ7d%2FGIKOTjKfg%3D&reserved=0<https://testi.apro.tunnistus.fi/idp1>">
[...]
> <SessionInitiator Location="/bin/idm/open/register01_fi.pl" type="SAML2" entityID="https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftesti.apro.tunnistus.fi%2Fidp1&data=05%7C02%7C%7C8e6acc4db38b4372d69608dc798e3cda%7Ca30a558eb6084b2c8f39a7fa426fa49d%7C0%7C0%7C638518899040797134%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=d8ZZf46JTsBTf51T1Gk%2F8CmfqiW0rtYb4BPvpfDavZc%3D&reserved=0<https://testi.apro.tunnistus.fi/idp1>">

Are you sure the Shibboleth SP is even involved here and not something
else?
I'm asking because the 'Location' XML attribute is documented to be
relative to the handlerURL (defaulting to '/Shibboleth.sso')
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FSP3%2Fpages%2F2065334685%2FSessionInitiator&data=05%7C02%7C%7C8e6acc4db38b4372d69608dc798e3cda%7Ca30a558eb6084b2c8f39a7fa426fa49d%7C0%7C0%7C638518899040805551%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=5UfKSUW0ig5%2BH0z2a%2BIOEDo3NYpR9OGyEpjpoLMho%2F4%3D&reserved=0<https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334685/SessionInitiator>
and so the above would only do anything if accessed at
  /Shibboleth.sso/bin/idm/open/register01.pl
While at
  /bin/idm/open/register01.pl
you'd not be talking to the Shibboleth SP itself at all.

(Also note that if you're going to create custom endpoints below
/Shibboleth.sso/ anyway you might as well keep them simpler than
'/bin/idm/open/register01.pl' which has the potential of confusing
yourself that the Shib SP somehow runs your Perl script or whatever.)

Also note that unless you need the authn request to be signed it might
be easier to have your own code create the complete authentication
request, with extensions and all, from your own code. At least it
looks to me like you're able to run your own code on that server
anyway (.pl suggesting a Perl script to me).
That may be easier and more flexible than trying to make the SP do it
for you.

HTH,
-peter
--
For Consortium Member technical support, see https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7C%7C8e6acc4db38b4372d69608dc798e3cda%7Ca30a558eb6084b2c8f39a7fa426fa49d%7C0%7C0%7C638518899040811639%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Klad6%2FXBAkpv1nWAHMPcK9J21MYF9ul9WoCGiI6uDkg%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240521/d6234f81/attachment.htm>