Shibboleth Sp 3.5 behind Azure APP GW

Thu Feb 26 10:16:59 UTC 2026

Hi,

On Thu, 2026-02-26 at 09:33 +0000, Scott Alexander via users wrote:
> 
> I have cookieProps="https" and if I set handlerSSL="false"  to true
> it doesn't work. 
> 

Have you tried with checkAddress="false" consistentAddress="false" ?

Does appgw send clients address in X-Forwarded-For ? Have you tried
mod_remoteip(https://httpd.apache.org/docs/current/mod/mod_remoteip.html)
to set clients address from X-Forwarded-For:
RemoteIPHeader X-Forwarded-For
RemoteIPInternalProxy 10.100.32.0/24
# or
#RemoteIPInternalProxy 10.100.32.4
#RemoteIPInternalProxy 10.100.32.6

Is traffic from appgw->apache in http or https ? AFAIK there's apache
directive to lie/force http like it it secure (maybe something like
SetENv HTTPS=on). This might make handlerSSL="true" work if appgw-
>apache traffic is http.

-Jarno

> 
> The Azure APP GW mucks things up a lot. Last resort will be to give
> the site it's own public ip address. 
> 
> 
> It was working fine before we migrated to a new server behind Azure
> APP GW
> 
> 
> 
> 
> 
> 
> Terveisin/Regards
> 
>  
> 
> Scott Alexander
> Asiantuntija, järjestelmätSystems Specialist
>  
> Humak
> Humanistinen ammattikorkeakoulu
> University of Applied Sciences
> 
> www.humak.fi
>  
> Tel. +358 (0)50 411 9556
> 
> 
> scott.alexander at humak.fi
> 
> 
> 
> From: Björn Mattsson
> Sent: Thursday, February 26, 2026 10:59
> To: Shib Users
> Cc: Scott Alexander
> Subject: Re: Shibboleth Sp 3.5 behind Azure APP GW 
> 
> 
> Hi 
> 
> Sorry wrong link in last
> mail https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/211039036
> 5/AddressChecking .
> 
> // Björn M.
> 
> 
> > On 26 Feb 2026, at 09:37, Scott Alexander via users
> > <users at shibboleth.net> wrote:
> > 
> > Hi,
> > 
> > 
> > in my logs I see
> > 
> > 
> > 11.22.33.44:55915|10.100.32.4 -
> > alexsc01 at example.fi [26/Feb/2026:09:47:47 +0200] "GET
> > /bin/hform/index.pl HTTP/1.1" 200 22712 "https://rap.example.fi/"
> > 11.22.33.44:55915|10.100.32.4 -
> > alexsc01 at example.fi [26/Feb/2026:09:47:47 +0200] "GET
> > /bin/hform/form/keep_alive01.pl HTTP/1.1" 200 2
> > "https://hform.example.fi/bin/hform/index.pl"
> > 11.22.33.44:56087|10.100.32.6 - - [26/Feb/2026:09:50:48 +0200] "GET
> > /bin/hform/form/keep_alive01.pl HTTP/1.1" 302 -
> > "https://hform.example.fi/bin/hform/index.pl"
> > 
> > 
> > So aso soon as the Azure APP GW changes the 10.100.32.4  to
> > 10.100.32.6 it's gets a 302 redirect to login or in opposite
> > direction from 10.100.32.6 to 10.100.32.4
> > 
> > 
> > Anyone have success using Shibbolet 3.5 SP behind Azure App GW?
> > 
> > 
> > My Shibbolet2.xml is 
> > 
> > 
> > <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
> >     xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
> >     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
> >     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"    
> >     xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> >     clockSkew="180">
> > 
> > 
> >     <ApplicationDefaults entityID="https://example.fi"
> > REMOTE_USER="eppn persistent-id targeted-id"
> > homeURL="https://example.fi/">
> >         
> >         <Sessions lifetime="43200" timeout="14400"
> >  relayState="ss:mem" checkAddress="false" handlerSSL="false"
> > cookieProps="https" handlerURL="/Shibboleth.sso">            
> >             <SSO discoveryProtocol="SAMLDS"
> > discoveryURL="https://haka.funet.fi/shibboleth/WAYF"> SAML2 </SSO>
> >             
> >             <Logout>SAML2 Local</Logout>       
> >             <Handler type="MetadataGenerator" Location="/Metadata"
> > signing="false"/>
> >             <Handler type="Status" Location="/Status"
> > acl="192.168.0.109 ::1"/>
> >             <Handler type="Session" Location="/Session"
> > showAttributeValues="false"/>
> >             <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>  
> >   
> >         </Sessions>
> >         
> >     <Errors supportContact="email at address"
> > helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
> >             
> >       <MetadataProvider type="XML" validate="true"
> > url="https://haka.funet.fi/metadata/haka-metadata-v9.xml"
> > reloadInterval="3600"/>
> >       
> >     <AttributeExtractor type="XML" validate="true"
> > reloadChanges="false" path="attribute-map.xml"/>
> >     <AttributeResolver type="Query" subjectMatch="true"/>
> >     <AttributeFilter type="XML" validate="true" path="attribute-
> > policy.xml"/>
> >     
> >       <CredentialResolver type="File">
> >           <Key>
> >               <Path>/etc/shibboleth/hformsp.example.fi.key</Path>
> >           </Key>
> >           <Certificate>
> >               <Path>/etc/shibboleth/hformsp.example.fi.crt</Path>
> >           </Certificate>
> >        </CredentialResolver>
> >     </ApplicationDefaults>
> >     <SecurityPolicyProvider type="XML" validate="true"
> > path="security-policy.xml"/>
> >     <ProtocolProvider type="XML" validate="true"
> > reloadChanges="false" path="protocols.xml"/>
> > </SPConfig>
> > 
> > 
> > 
> > 
> > on almalinux 9 I have
> > 
> > 
> > yum info shibboleth
> > Last metadata expiration check: 2:09:16 ago on Thu 26 Feb 2026
> > 08:23:03 AM EET.
> > Installed Packages
> > Name         : shibboleth
> > Version      : 3.5.2
> > Release      : 1.el9
> > 
> > 
> > And in httpd/conf.d/ssl is this include file 
> > 
> > 
> > PerlModule Apache::DBI
> > PerlWarn Off
> > 
> > 
> > #Apache Startup file
> > PerlRequire /systems/demeter/config/startup2.pl
> > 
> > 
> > RewriteEngine on
> > RewriteRule ^/bin/([^/]+)/(.*) /systems/demeter/$2
> > 
> > 
> > 
> > 
> > PerlTransHandler +Apache::TransHandler
> > PerlOptions +GlobalRequest
> > 
> > 
> > PerlModule ModPerl::Registry
> > 
> > 
> > 
> > 
> > <Location /Shibboleth.sso>
> >     Require all granted
> >     Satisfy any
> > </Location>
> > 
> > 
> > 
> > 
> > <Location /bin/hform/form/keep_alive01.pl>
> >     AuthType shibboleth
> >     ShibRequestSetting requireSession 1
> >     Require shibboleth
> > </Location>
> > 
> > 
> > 
> > 
> > <Location /bin/hform/open>
> >     AuthType Shibboleth
> >     ShibRequestSetting requireSession false
> >     Require shibboleth
> > </Location>
> > 
> > 
> > <Directory /systems/hform/documents/>
> >       Require all granted
> > </Directory>
> > 
> > 
> > <Directory /systems/demeter/>
> > 
> > 
> >       AuthType shibboleth
> >       ShibRequestSetting requireSession 1       
> >       Require shibboleth
> >           
> >       SetHandler perl-script
> >       PerlResponseHandler ModPerl::Registry
> >       PerlOptions +ParseHeaders
> >       Options +ExecCGI +FollowSymLinks +Indexes +MultiViews
> >                 
> > </Directory>
> > 
> > 
> > # ERROR DOCUMENTS
> > ErrorDocument 302 /bin/demeter/error/302.html
> > ErrorDocument 401 /bin/demeter/error/401.html
> > ErrorDocument 403 /bin/demeter/error/403.html
> > ErrorDocument 404 /bin/demeter/error/404.html
> > ErrorDocument 500 /bin/demeter/error/500.html
> > 
> > 
> > LogFormat "%U|%a|%t |\"%{User-Agent}i\"|%u|%r|%i" demeter
> > CustomLog /var/log/httpd/demeter_log demeter
> > 
> > 
> > #LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \
> > #\"%{Referer}i\" \"%{User-Agent}i\" \
> > #\"Cookie: %{Cookie}i\"" shibcookie
> > 
> > 
> > LogFormat "%{X-Forwarded-For}i|%a %l %u %t \"%r\" %>s %b \
> > \"%{Referer}i\"" shibcookie
> > 
> > 
> > CustomLog /var/log/httpd/shibcookie_log shibcookie
> > 
> > 
> > <Directory />
> > ErrorDocument 404 /bin/hform/error/404.html
> > </Directory>
> > 
> > 
> > <Directory />
> > ErrorDocument 302 /bin/hform/error/302.html
> > </Directory>
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > Terveisin/Regards
> > 
> >  
> > 
> > Scott Alexander
> > Asiantuntija, järjestelmät Systems Specialist
> >  
> > Humak
> > Humanistinen ammattikorkeakoulu
> > University of Applied Sciences
> > 
> > www.humak.fi
> >  
> > Tel. +358 (0)50 411 9556
> > 
> > 
> > scott.alexander at humak.fi
> > -- 
> > For Consortium Member technical support,
> > seehttps://shibboleth.atlassian.net/wiki/x/ZYEpPw
> > To unsubscribe from this list send an email
> > tousers-unsubscribe at shibboleth.net

-- 
Jarno Huuskonen