Shibboleth Sp 3.5 behind Azure APP GW
Björn Mattsson
bjorn at sunet.se
Thu Feb 26 08:59:28 UTC 2026
Hi
Sorry wrong link in last mail https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2110390365/AddressChecking .
// Björn M.
> On 26 Feb 2026, at 09:37, Scott Alexander via users <users at shibboleth.net> wrote:
>
> Hi,
>
> in my logs I see
>
> 11.22.33.44:55915|10.100.32.4 - alexsc01 at example.fi <mailto:alexsc01 at example.fi> [26/Feb/2026:09:47:47 +0200] "GET /bin/hform/index.pl HTTP/1.1" 200 22712 "https://rap.example.fi/"
> 11.22.33.44:55915|10.100.32.4 - alexsc01 at example.fi <mailto:alexsc01 at example.fi> [26/Feb/2026:09:47:47 +0200] "GET /bin/hform/form/keep_alive01.pl HTTP/1.1" 200 2 "https://hform.example.fi/bin/hform/index.pl"
> 11.22.33.44:56087|10.100.32.6 - - [26/Feb/2026:09:50:48 +0200] "GET /bin/hform/form/keep_alive01.pl HTTP/1.1" 302 - "https://hform.example.fi/bin/hform/index.pl"
>
> So aso soon as the Azure APP GW changes the 10.100.32.4 to 10.100.32.6 it's gets a 302 redirect to login or in opposite direction from 10.100.32.6 to 10.100.32.4
>
> Anyone have success using Shibbolet 3.5 SP behind Azure App GW?
>
> My Shibbolet2.xml is
>
> <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
> xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> clockSkew="180">
>
> <ApplicationDefaults entityID="https://example.fi <https://example.fi/>" REMOTE_USER="eppn persistent-id targeted-id" homeURL="https://example.fi <https://example.fi/>/">
>
> <Sessions lifetime="43200" timeout="14400" relayState="ss:mem" checkAddress="false" handlerSSL="false" cookieProps="https" handlerURL="/Shibboleth.sso">
> <SSO discoveryProtocol="SAMLDS" discoveryURL="https://haka.funet.fi/shibboleth/WAYF"> SAML2 </SSO>
>
> <Logout>SAML2 Local</Logout>
> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
> <Handler type="Status" Location="/Status" acl="192.168.0.109 ::1"/>
> <Handler type="Session" Location="/Session" showAttributeValues="false"/>
> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
> </Sessions>
>
> <Errors supportContact="email at address" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
>
> <MetadataProvider type="XML" validate="true" url="https://haka.funet.fi/metadata/haka-metadata-v9.xml" reloadInterval="3600"/>
>
> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
> <AttributeResolver type="Query" subjectMatch="true"/>
> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
>
> <CredentialResolver type="File">
> <Key>
> <Path>/etc/shibboleth/hformsp.example.fi.key</Path>
> </Key>
> <Certificate>
> <Path>/etc/shibboleth/hformsp.example.fi.crt</Path>
> </Certificate>
> </CredentialResolver>
> </ApplicationDefaults>
> <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
> <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
> </SPConfig>
>
>
> on almalinux 9 I have
>
> yum info shibboleth
> Last metadata expiration check: 2:09:16 ago on Thu 26 Feb 2026 08:23:03 AM EET.
> Installed Packages
> Name : shibboleth
> Version : 3.5.2
> Release : 1.el9
>
> And in httpd/conf.d/ssl is this include file
>
> PerlModule Apache::DBI
> PerlWarn Off
>
> #Apache Startup file
> PerlRequire /systems/demeter/config/startup2.pl
>
> RewriteEngine on
> RewriteRule ^/bin/([^/]+)/(.*) /systems/demeter/$2
>
>
> PerlTransHandler +Apache::TransHandler
> PerlOptions +GlobalRequest
>
> PerlModule ModPerl::Registry
>
>
> <Location /Shibboleth.sso>
> Require all granted
> Satisfy any
> </Location>
>
>
> <Location /bin/hform/form/keep_alive01.pl>
> AuthType shibboleth
> ShibRequestSetting requireSession 1
> Require shibboleth
> </Location>
>
>
> <Location /bin/hform/open>
> AuthType Shibboleth
> ShibRequestSetting requireSession false
> Require shibboleth
> </Location>
>
> <Directory /systems/hform/documents/>
> Require all granted
> </Directory>
>
> <Directory /systems/demeter/>
>
> AuthType shibboleth
> ShibRequestSetting requireSession 1
> Require shibboleth
>
> SetHandler perl-script
> PerlResponseHandler ModPerl::Registry
> PerlOptions +ParseHeaders
> Options +ExecCGI +FollowSymLinks +Indexes +MultiViews
>
> </Directory>
>
> # ERROR DOCUMENTS
> ErrorDocument 302 /bin/demeter/error/302.html
> ErrorDocument 401 /bin/demeter/error/401.html
> ErrorDocument 403 /bin/demeter/error/403.html
> ErrorDocument 404 /bin/demeter/error/404.html
> ErrorDocument 500 /bin/demeter/error/500.html
>
> LogFormat "%U|%a|%t |\"%{User-Agent}i\"|%u|%r|%i" demeter
> CustomLog /var/log/httpd/demeter_log demeter
>
> #LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \
> #\"%{Referer}i\" \"%{User-Agent}i\" \
> #\"Cookie: %{Cookie}i\"" shibcookie
>
> LogFormat "%{X-Forwarded-For}i|%a %l %u %t \"%r\" %>s %b \
> \"%{Referer}i\"" shibcookie
>
> CustomLog /var/log/httpd/shibcookie_log shibcookie
>
> <Directory />
> ErrorDocument 404 /bin/hform/error/404.html
> </Directory>
>
> <Directory />
> ErrorDocument 302 /bin/hform/error/302.html
> </Directory>
>
>
>
> Terveisin/Regards
>
> Scott Alexander
> Asiantuntija, järjestelmät Systems Specialist
>
> Humak
> Humanistinen ammattikorkeakoulu
> University of Applied Sciences
> www.humak.fi <http://www.humak.fi/>
>
> Tel. +358 (0)50 411 9556
>
> scott.alexander at humak.fi <mailto:scott.alexander at humak.fi>--
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260226/c8a7e41e/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL: <http://shibboleth.net/pipermail/users/attachments/20260226/c8a7e41e/attachment.sig>
More information about the users
mailing list