Shibboleth Sp 3.5 behind Azure APP GW
Scott Alexander
scott.alexander at humak.fi
Thu Feb 26 09:33:57 UTC 2026
I have cookieProps="https" and if I set handlerSSL="false" to true it doesn't work.
The Azure APP GW mucks things up a lot. Last resort will be to give the site it's own public ip address.
It was working fine before we migrated to a new server behind Azure APP GW
Terveisin/Regards
Scott Alexander
Asiantuntija, järjestelmät Systems Specialist
Humak
Humanistinen ammattikorkeakoulu
University of Applied Sciences
www.humak.fi<http://www.humak.fi/>
Tel. +358 (0)50 411 9556
scott.alexander at humak.fi<mailto:scott.alexander at humak.fi>
________________________________
From: Björn Mattsson
Sent: Thursday, February 26, 2026 10:59
To: Shib Users
Cc: Scott Alexander
Subject: Re: Shibboleth Sp 3.5 behind Azure APP GW
Hi
Sorry wrong link in last mail https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2110390365/AddressChecking .
// Björn M.
On 26 Feb 2026, at 09:37, Scott Alexander via users <users at shibboleth.net> wrote:
Hi,
in my logs I see
11.22.33.44:55915|10.100.32.4 - alexsc01 at example.fi<mailto:alexsc01 at example.fi> [26/Feb/2026:09:47:47 +0200] "GET /bin/hform/index.pl HTTP/1.1" 200 22712 "https://rap.example.fi/"
11.22.33.44:55915|10.100.32.4 - alexsc01 at example.fi<mailto:alexsc01 at example.fi> [26/Feb/2026:09:47:47 +0200] "GET /bin/hform/form/keep_alive01.pl HTTP/1.1" 200 2 "https://hform.example.fi/bin/hform/index.pl"
11.22.33.44:56087|10.100.32.6 - - [26/Feb/2026:09:50:48 +0200] "GET /bin/hform/form/keep_alive01.pl HTTP/1.1" 302 - "https://hform.example.fi/bin/hform/index.pl"
So aso soon as the Azure APP GW changes the 10.100.32.4 to 10.100.32.6 it's gets a 302 redirect to login or in opposite direction from 10.100.32.6 to 10.100.32.4
Anyone have success using Shibbolet 3.5 SP behind Azure App GW?
My Shibbolet2.xml is
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<ApplicationDefaults entityID="https://example.fi<https://example.fi/>" REMOTE_USER="eppn persistent-id targeted-id" homeURL="https://example.fi<https://example.fi/>/">
<Sessions lifetime="43200" timeout="14400" relayState="ss:mem" checkAddress="false" handlerSSL="false" cookieProps="https" handlerURL="/Shibboleth.sso">
<SSO discoveryProtocol="SAMLDS" discoveryURL="https://haka.funet.fi/shibboleth/WAYF"> SAML2 </SSO>
<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<Handler type="Status" Location="/Status" acl="192.168.0.109 ::1"/>
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<Errors supportContact="email at address" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" validate="true" url="https://haka.funet.fi/metadata/haka-metadata-v9.xml" reloadInterval="3600"/>
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/>
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File">
<Key>
<Path>/etc/shibboleth/hformsp.example.fi.key</Path>
</Key>
<Certificate>
<Path>/etc/shibboleth/hformsp.example.fi.crt</Path>
</Certificate>
</CredentialResolver>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
on almalinux 9 I have
yum info shibboleth
Last metadata expiration check: 2:09:16 ago on Thu 26 Feb 2026 08:23:03 AM EET.
Installed Packages
Name : shibboleth
Version : 3.5.2
Release : 1.el9
And in httpd/conf.d/ssl is this include file
PerlModule Apache::DBI
PerlWarn Off
#Apache Startup file
PerlRequire /systems/demeter/config/startup2.pl
RewriteEngine on
RewriteRule ^/bin/([^/]+)/(.*) /systems/demeter/$2
PerlTransHandler +Apache::TransHandler
PerlOptions +GlobalRequest
PerlModule ModPerl::Registry
<Location /Shibboleth.sso>
Require all granted
Satisfy any
</Location>
<Location /bin/hform/form/keep_alive01.pl>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shibboleth
</Location>
<Location /bin/hform/open>
AuthType Shibboleth
ShibRequestSetting requireSession false
Require shibboleth
</Location>
<Directory /systems/hform/documents/>
Require all granted
</Directory>
<Directory /systems/demeter/>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shibboleth
SetHandler perl-script
PerlResponseHandler ModPerl::Registry
PerlOptions +ParseHeaders
Options +ExecCGI +FollowSymLinks +Indexes +MultiViews
</Directory>
# ERROR DOCUMENTS
ErrorDocument 302 /bin/demeter/error/302.html
ErrorDocument 401 /bin/demeter/error/401.html
ErrorDocument 403 /bin/demeter/error/403.html
ErrorDocument 404 /bin/demeter/error/404.html
ErrorDocument 500 /bin/demeter/error/500.html
LogFormat "%U|%a|%t |\"%{User-Agent}i\"|%u|%r|%i" demeter
CustomLog /var/log/httpd/demeter_log demeter
#LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \
#\"%{Referer}i\" \"%{User-Agent}i\" \
#\"Cookie: %{Cookie}i\"" shibcookie
LogFormat "%{X-Forwarded-For}i|%a %l %u %t \"%r\" %>s %b \
\"%{Referer}i\"" shibcookie
CustomLog /var/log/httpd/shibcookie_log shibcookie
<Directory />
ErrorDocument 404 /bin/hform/error/404.html
</Directory>
<Directory />
ErrorDocument 302 /bin/hform/error/302.html
</Directory>
Terveisin/Regards
Scott Alexander
Asiantuntija, järjestelmät Systems Specialist
Humak
Humanistinen ammattikorkeakoulu
University of Applied Sciences
www.humak.fi<http://www.humak.fi/>
Tel. +358 (0)50 411 9556
scott.alexander at humak.fi<mailto:scott.alexander at humak.fi>
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260226/408d7a3e/attachment.htm>
More information about the users
mailing list