<div>
Awesome, with that point in the right direction, I got it working!
</div>
<div><div><br></div><div>I have two followup questions though…</div><div><br></div><div>1) Can I configure attribute-map.xml to pass through everything (not just explicitly named attributes)?</div><div><br></div><div>2) I current have ShibUseHeaders turned on. My setup looks like this: Apache (shibd) -> Nginx -> Unicorn (Rails). Given that, it is possible to just use ShibUseEnvironment instead of ShibUseHeaders?</div><div><br></div><div>Thanks for the help.</div><div><br></div><div>-- </div><div>Christopher J. Bottaro</div><div>Sent with <a href="http://www.sparrowmailapp.com/?sig">Sparrow</a></div><div><br></div></div>
<p style="color: #A0A0A8;">On Friday, July 13, 2012 at 12:19 PM, Cantor, Scott wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div>On 7/13/12 1:08 PM, "Christopher J. Bottaro" <<a href="mailto:cjbottaro@academicworks.com">cjbottaro@academicworks.com</a>></div><div>wrote:</div><blockquote type="cite"><div><div><br></div><div>I'm basically trying to mimic this:</div><div><a href="http://www.ruby-forum.com/topic/168155">http://www.ruby-forum.com/topic/168155</a> (last post in thread)</div></div></blockquote><div><br></div><div>That seems like a lot of chewing gum and bailing wire vs. just using an</div><div>alternative implementation that is suitable to your environment. I'd be</div><div>very concerned about sustainability and security issues in linking</div><div>multiple servers together like that.</div><div><br></div><blockquote type="cite"><div><div>So I'm testing with <a href="http://testshib.org">testshib.org</a> and I have it working where going to</div><div><a href="http://mydomain.com/secure">http://mydomain.com/secure</a> redirects to the IDP's login page. Then after</div><div>a successful login, it redirects back to</div><div><a href="http://mydomain.com/Shibboleth.sso/SAML2/POST">http://mydomain.com/Shibboleth.sso/SAML2/POST</a>. I have an Apache rewrite</div><div>rule that sends that request to /index.php, which then var_dump($_SERVER).</div></div></blockquote><div><br></div><div>If you're rewriting a request like that, the SP wouldn't ever have a</div><div>chance to do its job, and moreover, unless the SP is told to protect and</div><div>annotate requests for /index.php, it's not going to.</div><div><br></div><div>The SP has to process the POST and then relies on RelayState or the</div><div>homeURL setting to route the request after a session is created. That</div><div>resource MUST be covered by the Apache settings required to activate an</div><div>authentication module (AuthType and require). That, along with the session</div><div>being present, determines what you get.</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent</a></div><div><br></div><div>-- Scott</div><div><br></div><div>--</div><div>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>