Shibboleth Sp 3.5 behind Azure APP GW

[Scott Alexander]

Hi,

in my logs I see

11.22.33.44:55915|10.100.32.4 - alexsc01 at example.fi [26/Feb/2026:09:47:47 +0200] "GET /bin/hform/index.pl HTTP/1.1" 200 22712 "https://rap.example.fi/"
11.22.33.44:55915|10.100.32.4 - alexsc01 at example.fi [26/Feb/2026:09:47:47 +0200] "GET /bin/hform/form/keep_alive01.pl HTTP/1.1" 200 2 "https://hform.example.fi/bin/hform/index.pl"
11.22.33.44:56087|10.100.32.6 - - [26/Feb/2026:09:50:48 +0200] "GET /bin/hform/form/keep_alive01.pl HTTP/1.1" 302 - "https://hform.example.fi/bin/hform/index.pl"

So aso soon as the Azure APP GW changes the 10.100.32.4  to 10.100.32.6 it's gets a 302 redirect to login or in opposite direction from 10.100.32.6 to 10.100.32.4

Anyone have success using Shibbolet 3.5 SP behind Azure App GW?

My Shibbolet2.xml is

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">

    <ApplicationDefaults entityID="https://example.fi" REMOTE_USER="eppn persistent-id targeted-id" homeURL="https://example.fi/">

        <Sessions lifetime="43200" timeout="14400"  relayState="ss:mem" checkAddress="false" handlerSSL="false" cookieProps="https" handlerURL="/Shibboleth.sso">
            <SSO discoveryProtocol="SAMLDS" discoveryURL="https://haka.funet.fi/shibboleth/WAYF"> SAML2 </SSO>

            <Logout>SAML2 Local</Logout>
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
            <Handler type="Status" Location="/Status" acl="192.168.0.109 ::1"/>
            <Handler type="Session" Location="/Session" showAttributeValues="false"/>
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

    <Errors supportContact="email at address" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
            
      <MetadataProvider type="XML" validate="true" url="https://haka.funet.fi/metadata/haka-metadata-v9.xml" reloadInterval="3600"/>
      
    <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
    <AttributeResolver type="Query" subjectMatch="true"/>
    <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

      <CredentialResolver type="File">
          <Key>
              <Path>/etc/shibboleth/hformsp.example.fi.key</Path>
          </Key>
          <Certificate>
              <Path>/etc/shibboleth/hformsp.example.fi.crt</Path>
          </Certificate>
       </CredentialResolver>
    </ApplicationDefaults>
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>


on almalinux 9 I have

yum info shibboleth
Last metadata expiration check: 2:09:16 ago on Thu 26 Feb 2026 08:23:03 AM EET.
Installed Packages
Name         : shibboleth
Version      : 3.5.2
Release      : 1.el9

And in httpd/conf.d/ssl is this include file

PerlModule Apache::DBI
PerlWarn Off

#Apache Startup file
PerlRequire /systems/demeter/config/startup2.pl

RewriteEngine on
RewriteRule ^/bin/([^/]+)/(.*) /systems/demeter/$2


PerlTransHandler +Apache::TransHandler
PerlOptions +GlobalRequest

PerlModule ModPerl::Registry


<Location /Shibboleth.sso>
    Require all granted
    Satisfy any
</Location>


<Location /bin/hform/form/keep_alive01.pl>
    AuthType shibboleth
    ShibRequestSetting requireSession 1
    Require shibboleth
</Location>


<Location /bin/hform/open>
    AuthType Shibboleth
    ShibRequestSetting requireSession false
    Require shibboleth
</Location>

<Directory /systems/hform/documents/>
      Require all granted
</Directory>

<Directory /systems/demeter/>

      AuthType shibboleth
      ShibRequestSetting requireSession 1       
      Require shibboleth
      
      SetHandler perl-script
      PerlResponseHandler ModPerl::Registry
      PerlOptions +ParseHeaders
      Options +ExecCGI +FollowSymLinks +Indexes +MultiViews
            
</Directory>

# ERROR DOCUMENTS
ErrorDocument 302 /bin/demeter/error/302.html
ErrorDocument 401 /bin/demeter/error/401.html
ErrorDocument 403 /bin/demeter/error/403.html
ErrorDocument 404 /bin/demeter/error/404.html
ErrorDocument 500 /bin/demeter/error/500.html

LogFormat "%U|%a|%t |\"%{User-Agent}i\"|%u|%r|%i" demeter
CustomLog /var/log/httpd/demeter_log demeter

#LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \
#\"%{Referer}i\" \"%{User-Agent}i\" \
#\"Cookie: %{Cookie}i\"" shibcookie

LogFormat "%{X-Forwarded-For}i|%a %l %u %t \"%r\" %>s %b \
\"%{Referer}i\"" shibcookie

CustomLog /var/log/httpd/shibcookie_log shibcookie

<Directory />
ErrorDocument 404 /bin/hform/error/404.html
</Directory>

<Directory />
ErrorDocument 302 /bin/hform/error/302.html
</Directory>



Terveisin/Regards

Scott Alexander
Asiantuntija, järjestelmät Systems Specialist

Humak
Humanistinen ammattikorkeakoulu
University of Applied Sciences
www.humak.fi<http://www.humak.fi/>

Tel. +358 (0)50 411 9556

scott.alexander at humak.fi<mailto:scott.alexander at humak.fi>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260226/22c28454/attachment.htm>