Shibboleth Sp 3.5 behind Azure APP GW
Björn Mattsson
bjorn at sunet.se
Thu Feb 26 08:55:53 UTC 2026
Hi
Have you looked at https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506072/SessionConfiguration#Address-Binding ?
It says "It is deeply ill-advised to simply disable this checking entirely and it deeply unsafe to operate networks that hide a plethora of clients behind a single address.” But since you already hides all calls behind two adresses you might as well disable the check since it doesn’t make you setup much safer as it is now.
// Björn M.
> On 26 Feb 2026, at 09:37, Scott Alexander via users <users at shibboleth.net> wrote:
>
> Hi,
>
> in my logs I see
>
> 11.22.33.44:55915|10.100.32.4 - alexsc01 at example.fi <mailto:alexsc01 at example.fi> [26/Feb/2026:09:47:47 +0200] "GET /bin/hform/index.pl HTTP/1.1" 200 22712 "https://rap.example.fi/"
> 11.22.33.44:55915|10.100.32.4 - alexsc01 at example.fi <mailto:alexsc01 at example.fi> [26/Feb/2026:09:47:47 +0200] "GET /bin/hform/form/keep_alive01.pl HTTP/1.1" 200 2 "https://hform.example.fi/bin/hform/index.pl"
> 11.22.33.44:56087|10.100.32.6 - - [26/Feb/2026:09:50:48 +0200] "GET /bin/hform/form/keep_alive01.pl HTTP/1.1" 302 - "https://hform.example.fi/bin/hform/index.pl"
>
> So aso soon as the Azure APP GW changes the 10.100.32.4 to 10.100.32.6 it's gets a 302 redirect to login or in opposite direction from 10.100.32.6 to 10.100.32.4
>
> Anyone have success using Shibbolet 3.5 SP behind Azure App GW?
>
> My Shibbolet2.xml is
>
> <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
> xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> clockSkew="180">
>
> <ApplicationDefaults entityID="https://example.fi <https://example.fi/>" REMOTE_USER="eppn persistent-id targeted-id" homeURL="https://example.fi <https://example.fi/>/">
>
> <Sessions lifetime="43200" timeout="14400" relayState="ss:mem" checkAddress="false" handlerSSL="false" cookieProps="https" handlerURL="/Shibboleth.sso">
> <SSO discoveryProtocol="SAMLDS" discoveryURL="https://haka.funet.fi/shibboleth/WAYF"> SAML2 </SSO>
>
> <Logout>SAML2 Local</Logout>
> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
> <Handler type="Status" Location="/Status" acl="192.168.0.109 ::1"/>
> <Handler type="Session" Location="/Session" showAttributeValues="false"/>
> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
> </Sessions>
>
> <Errors supportContact="email at address" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
>
> <MetadataProvider type="XML" validate="true" url="https://haka.funet.fi/metadata/haka-metadata-v9.xml" reloadInterval="3600"/>
>
> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
> <AttributeResolver type="Query" subjectMatch="true"/>
> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
>
> <CredentialResolver type="File">
> <Key>
> <Path>/etc/shibboleth/hformsp.example.fi.key</Path>
> </Key>
> <Certificate>
> <Path>/etc/shibboleth/hformsp.example.fi.crt</Path>
> </Certificate>
> </CredentialResolver>
> </ApplicationDefaults>
> <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
> <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
> </SPConfig>
>
>
> on almalinux 9 I have
>
> yum info shibboleth
> Last metadata expiration check: 2:09:16 ago on Thu 26 Feb 2026 08:23:03 AM EET.
> Installed Packages
> Name : shibboleth
> Version : 3.5.2
> Release : 1.el9
>
> And in httpd/conf.d/ssl is this include file
>
> PerlModule Apache::DBI
> PerlWarn Off
>
> #Apache Startup file
> PerlRequire /systems/demeter/config/startup2.pl
>
> RewriteEngine on
> RewriteRule ^/bin/([^/]+)/(.*) /systems/demeter/$2
>
>
> PerlTransHandler +Apache::TransHandler
> PerlOptions +GlobalRequest
>
> PerlModule ModPerl::Registry
>
>
> <Location /Shibboleth.sso>
> Require all granted
> Satisfy any
> </Location>
>
>
> <Location /bin/hform/form/keep_alive01.pl>
> AuthType shibboleth
> ShibRequestSetting requireSession 1
> Require shibboleth
> </Location>
>
>
> <Location /bin/hform/open>
> AuthType Shibboleth
> ShibRequestSetting requireSession false
> Require shibboleth
> </Location>
>
> <Directory /systems/hform/documents/>
> Require all granted
> </Directory>
>
> <Directory /systems/demeter/>
>
> AuthType shibboleth
> ShibRequestSetting requireSession 1
> Require shibboleth
>
> SetHandler perl-script
> PerlResponseHandler ModPerl::Registry
> PerlOptions +ParseHeaders
> Options +ExecCGI +FollowSymLinks +Indexes +MultiViews
>
> </Directory>
>
> # ERROR DOCUMENTS
> ErrorDocument 302 /bin/demeter/error/302.html
> ErrorDocument 401 /bin/demeter/error/401.html
> ErrorDocument 403 /bin/demeter/error/403.html
> ErrorDocument 404 /bin/demeter/error/404.html
> ErrorDocument 500 /bin/demeter/error/500.html
>
> LogFormat "%U|%a|%t |\"%{User-Agent}i\"|%u|%r|%i" demeter
> CustomLog /var/log/httpd/demeter_log demeter
>
> #LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \
> #\"%{Referer}i\" \"%{User-Agent}i\" \
> #\"Cookie: %{Cookie}i\"" shibcookie
>
> LogFormat "%{X-Forwarded-For}i|%a %l %u %t \"%r\" %>s %b \
> \"%{Referer}i\"" shibcookie
>
> CustomLog /var/log/httpd/shibcookie_log shibcookie
>
> <Directory />
> ErrorDocument 404 /bin/hform/error/404.html
> </Directory>
>
> <Directory />
> ErrorDocument 302 /bin/hform/error/302.html
> </Directory>
>
>
>
> Terveisin/Regards
>
> Scott Alexander
> Asiantuntija, järjestelmät Systems Specialist
>
> Humak
> Humanistinen ammattikorkeakoulu
> University of Applied Sciences
> www.humak.fi <http://www.humak.fi/>
>
> Tel. +358 (0)50 411 9556
>
> scott.alexander at humak.fi <mailto:scott.alexander at humak.fi>--
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260226/1677a221/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL: <http://shibboleth.net/pipermail/users/attachments/20260226/1677a221/attachment.sig>
More information about the users
mailing list