<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Hi all,</div>
<div><br>
</div>
<div>I don't believe there is anything to be done on the Shibboleth side of things but I wanted to let others know and perhaps someone will have some info that I dont. But I am looking to log a bug with Apple.</div>
<div><br>
</div>
<div>So this is an issue that has popped up with the latest version of Safari for OSX (5.1.5 released March 26th) and one of our Shibboleth setups. I have included the diagram for ease of visualisation (http://moshpit.net.au/images/ReverseProxy.png) the dashed
lines are the Shibboleth SSO process through the browser (and not indicative of actual communication between the servers and the IdP). The reason we have the reverse proxy is because the permissions on the intranet are user controlled and we have had confidential
data exposed to the internet previously due to user misconfiguration so the reverse proxy is a way of enforcing a minimum level of authentication before getting access to internal resources without using a VPN and still allowing users to control access. </div>
<div><br>
</div>
<div>The reverse proxy is set up with the Intranet URL and an SP under <a href="https://intranet.example.com/Shibboleth-proxy.sso">
https://intranet.example.com/Shibboleth-proxy.sso</a>/ and uses apache mod_proxy (excerpt of the config below)</div>
<div>The intranet is set up with the Intranet URL and an SP under <a href="https://intranet.example.com/Shibboleth.sso">https://intranet.example.com/Shibboleth.sso</a>/</div>
<div>The load balancer/site selector will direct external traffic to the Reverse Proxy the reverse proxy makes request with an internal address and the whole process just works</div>
<div><br>
</div>
<div>What appears to be occurring with the new Safari - is that there are 2 form POSTs that occur automatically (using javascript) from the IdP in the whole process of gaining access to the Intranet (one to the Reverse Proxy and one to the Staff Intranet) -
the latest version of Safari is submitting the contents of the first POST both times instead of the expected behaviour of submitting the contents of the second form on the second POST. You can see this definitely occurring when you trace the traffic. </div>
<div><br>
</div>
<div>So a session is successfully created with the Reverse Proxy and then the Intranet throws a Binding error because it is receiving post data for Shibboleth-proxy.sso instead of Shibboleth.sso. If I try and access the original URL again I will get through
because there is a existing Session with the Reverse Proxy and it then only needs to do a single POST to the Intranet (which then has the correct data). If I switch off javascript and click the submit buttons manually the whole process works fine. Every
other browser works fine as well (including previous versions of Safari and Safari for iOS).</div>
<div><br>
</div>
<div>I was hoping to be able to reproduce the issue with a simple PHP application and using redirects and javascript therefore eliminating Shibboleth from the equation but unfortunately I have been unsuccessful so far so believe I may be missing something
else in the process as well. Maybe it's related to mod_proxy or maybe it's related to the size of the POST data so still have some further testing to do I think.</div>
<div><br>
</div>
<div>Cheers</div>
<div>Aaron</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>#Reverse Proxy Apache Configuration</div>
<div>
<div>NameVirtualHost *:80</div>
</div>
<div>ProxyRequests off</div>
<div>
<div><VirtualHost *:80></div>
<div> ServerName <a href="https://intranet.example.com">https://intranet.example.com</a></div>
<div> SSLProxyEngine on</div>
<div> ProxyPass / <a href="https://intranet.example.com/">https://intranet.example.com/</a></div>
<div> <Location "/"></div>
<div> AuthType shibboleth</div>
<div> ShibRequestSetting requireSession 1</div>
<div> Require eduPersonAffiliation staff</div>
<div> </Location></div>
<div></VirtualHost></div>
</div>
<div>ProxyPass /Shibboleth-proxy.sso !</div>
<div>
<div><Location /Shibboleth-proxy.sso></div>
<div> Satisfy Any</div>
<div> Allow from all</div>
<div> AuthType None</div>
<div> Require all granted</div>
<div></Location></div>
</div>
<div><br>
</div>
</div>
</div>
</span>
</body>
</html>