On Ubuntu using shibboleth 2.3.1 on apache2.2 when I visit:<div><br></div><div><a href="https://mydomain.com/Shibboleth.sso/Metadata">https://mydomain.com/Shibboleth.sso/Metadata</a></div><div><br></div><div>it appears that mod_shib is not intercepting the url, and I'm passed through to my (Rails Passenger) application, which of course responds that it can't find the file.</div>
<div><br></div><div>However, I am certain that mod_shib is installed and working, because when I visit my shibboleth-protected directory (/auth/shibboleth/) I get correctly redirected to the idp.</div><div><br></div><div>
My understanding (maybe wrong) is that mod_shib captures all traffic heading for /Shibboleth.sso/ and handles it.</div><div><br></div><div>I think (again maybe wrongly) that the directory name Shibboleth.sso is defined for shib 2.3.1 in the shibboleth2.xml file, with this line:</div>
<div><br></div><div><div><font face="courier new, monospace"><Sessions lifetime="28800" timeout="3600" checkAddress="false"</font></div><div><font face="courier new, monospace"> handlerURL="/Shibboleth.sso" handlerSSL="true"</font></div>
<div><font face="courier new, monospace"> exportLocation="<a href="http://localhost/Shibboleth.sso/GetAssertion">http://localhost/Shibboleth.sso/GetAssertion</a>" exportACL="127.0.0.1"</font></div>
<div><font face="courier new, monospace"> idpHistory="false" idpHistoryDays="7"></font></div></div><div><br></div><div>But it isn't working.</div><div><br></div><div><div>I've done one other installation, with shibboleth 2.5, and it eventually worked fine (on OSX) with a MUCH simpler shibboleth2.xml file.</div>
</div><div><br></div><div>I suspect that somehow Apache is masking the Shibboleth.sso directory from mod_shib, so it never gets handed over to shibd. (am I right?)</div><div><br></div><div>Things I've tried:</div><div>
<br></div><div>1. Lots of googling to see if others have had this problem. Not much out there.</div><div><br></div><div>2. Commenting out some apache conf lines that did Rewrites. Didn't help.</div><div><br></div><div>
3. Added a <Location> command to make sure /Shibboleth.sso/ was accessible. Didn't help.</div><div><br></div><div>Next I'm trying:</div><div><br></div><div>1. I'll strip down to a super bare-bones apache conf and see if something I've eliminated was the problem.</div>
<div><br></div><div>2. Doing a manual build of shib 2.5 on that machine and using my configuration that works on OSX (with appropriate adjustments of course)</div><div><br></div><div>But I don't have much hope.</div><div>
<br></div><div>Here is my shibboleth2.xml file:</div><div><br></div><div><div><font face="courier new, monospace"><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"</font></div><div><font face="courier new, monospace"> xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"</font></div>
<div><font face="courier new, monospace"> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"</font></div><div><font face="courier new, monospace"> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" </font></div>
<div><font face="courier new, monospace"> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"</font></div><div><font face="courier new, monospace"> logger="syslog.logger" clockSkew="180"></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- The OutOfProcess section contains properties affecting the shibd daemon. --></font></div><div><font face="courier new, monospace"> <OutOfProcess logger="shibd.logger"></font></div>
<div><font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"> <Extensions></font></div><div><font face="courier new, monospace"> <Library path="odbc-store.so" fatal="true"/></font></div>
<div><font face="courier new, monospace"> </Extensions></font></div><div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> </OutOfProcess></font></div>
<div><font face="courier new, monospace"> </font></div><div><font face="courier new, monospace"> <!-- The InProcess section conrains settings affecting web server modules/filters. --></font></div><div><font face="courier new, monospace"> <InProcess logger="native.logger"></font></div>
<div><font face="courier new, monospace"> <ISAPI normalizeRequest="true" safeHeaderNames="true"></font></div><div><font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"> Maps IIS Instance ID values to the host scheme/name/port. The name is</font></div>
<div><font face="courier new, monospace"> required so that the proper <Host> in the request map above is found without</font></div><div><font face="courier new, monospace"> having to cover every possible DNS/IP combination the user might enter.</font></div>
<div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> <Site id="1" name="<a href="http://appsoma.com">appsoma.com</a>"/></font></div>
<div><font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"> When the port and scheme are omitted, the HTTP request's port and scheme are used.</font></div>
<div><font face="courier new, monospace"> If these are wrong because of virtualization, they can be explicitly set here to</font></div><div><font face="courier new, monospace"> ensure proper redirect generation.</font></div>
<div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"> <Site id="42" name="<a href="http://virtual.example.org">virtual.example.org</a>" scheme="https" port="443"/></font></div>
<div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> </ISAPI></font></div><div><font face="courier new, monospace"> </InProcess></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Only one listener can be defined, to connect in-process modules to shibd. --></font></div><div><font face="courier new, monospace"> <UnixListener address="shibd.sock"/></font></div>
<div><font face="courier new, monospace"> <!-- <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/> --></font></div><div><font face="courier new, monospace"> </font></div>
<div><font face="courier new, monospace"> <!-- This set of components stores sessions and other persistent data in daemon memory. --></font></div><div><font face="courier new, monospace"> <StorageService type="Memory" id="mem" cleanupInterval="900"/></font></div>
<div><font face="courier new, monospace"> <SessionCache type="StorageService" StorageService="mem" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/></font></div>
<div><font face="courier new, monospace"> <ReplayCache StorageService="mem"/></font></div><div><font face="courier new, monospace"> <ArtifactMap artifactTTL="180"/></font></div><div><font face="courier new, monospace"><br>
</font></div><div><font face="courier new, monospace"> <!-- This set of components stores sessions and other persistent data in an ODBC database. --></font></div><div><font face="courier new, monospace"> <!--</font></div>
<div><font face="courier new, monospace"> <StorageService type="ODBC" id="db" cleanupInterval="900"></font></div><div><font face="courier new, monospace"> <ConnectionString></font></div>
<div><font face="courier new, monospace"> DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth</font></div><div><font face="courier new, monospace"> </ConnectionString></font></div>
<div><font face="courier new, monospace"> </StorageService></font></div><div><font face="courier new, monospace"> <SessionCache type="StorageService" StorageService="db" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/></font></div>
<div><font face="courier new, monospace"> <ReplayCache StorageService="db"/></font></div><div><font face="courier new, monospace"> <ArtifactMap StorageService="db" artifactTTL="180"/></font></div>
<div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- To customize behavior, map hostnames and path components to applicationId and other settings. --></font></div>
<div><font face="courier new, monospace"> <RequestMapper type="Native"></font></div><div><font face="courier new, monospace"> <RequestMap applicationId="default"></font></div><div>
<font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>The example requires a session for documents in /secure on the containing host with http and</font></div>
<div><font face="courier new, monospace"> https on the default ports. Note that the name and port in the <Host> elements MUST match</font></div><div><font face="courier new, monospace"> Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element</font></div>
<div><font face="courier new, monospace"> below.</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>--></font></div><div><font face="courier new, monospace"> <Host name="<a href="http://appsoma.com">appsoma.com</a>"></font></div>
<div><font face="courier new, monospace"> <Path name="secure" authType="shibboleth" requireSession="true"/></font></div><div><font face="courier new, monospace"> </Host></font></div>
<div><font face="courier new, monospace"> </RequestMap></font></div><div><font face="courier new, monospace"> </RequestMapper></font></div><div><font face="courier new, monospace"><br></font></div><div>
<font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"> The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined.</font></div><div><font face="courier new, monospace"> Resource requests are mapped by the RequestMapper to an applicationId that</font></div>
<div><font face="courier new, monospace"> points into to this section.</font></div><div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> <ApplicationDefaults id="default" policyId="default"</font></div>
<div><font face="courier new, monospace"> entityID="<a href="https://appsoma.com/shibboleth">https://appsoma.com/shibboleth</a>"</font></div><div><font face="courier new, monospace"> REMOTE_USER="eppn persistent-id targeted-id"</font></div>
<div><font face="courier new, monospace"> signing="false" encryption="false"></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!--</font></div>
<div><font face="courier new, monospace"> Controls session lifetimes, address checks, cookie handling, and the protocol handlers.</font></div><div><font face="courier new, monospace"> You MUST supply an effectively unique handlerURL value for each of your applications.</font></div>
<div><font face="courier new, monospace"> The value can be a relative path, a URL with no hostname (https:///path) or a full URL.</font></div><div><font face="courier new, monospace"> The system can compute a relative value based on the virtual host. Using handlerSSL="true"</font></div>
<div><font face="courier new, monospace"> will force the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"</font></div><div><font face="courier new, monospace"> in that case. Note that while we default checkAddress to "false", this has a negative</font></div>
<div><font face="courier new, monospace"> impact on the security of the SP. Stealing cookies/sessions is much easier with this disabled.</font></div><div><font face="courier new, monospace"> --></font></div>
<div><font face="courier new, monospace"> <Sessions lifetime="28800" timeout="3600" checkAddress="false"</font></div><div><font face="courier new, monospace"> handlerURL="/Shibboleth.sso" handlerSSL="true"</font></div>
<div><font face="courier new, monospace"> exportLocation="<a href="http://localhost/Shibboleth.sso/GetAssertion">http://localhost/Shibboleth.sso/GetAssertion</a>" exportACL="127.0.0.1"</font></div>
<div><font face="courier new, monospace"> idpHistory="false" idpHistoryDays="7"></font></div><div><font face="courier new, monospace"> </font></div><div><font face="courier new, monospace"> <!--</font></div>
<div><font face="courier new, monospace"> SessionInitiators handle session requests and relay them to a Discovery page,</font></div><div><font face="courier new, monospace"> or to an IdP if possible. Automatic session setup will use the default or first</font></div>
<div><font face="courier new, monospace"> element (or requireSessionWith can specify a specific id to use).</font></div><div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"><br>
</font></div><div><font face="courier new, monospace"> <!-- Default example directs to a specific IdP's SSO service (favoring SAML 2 over Shib 1). --></font></div><div><font face="courier new, monospace"> <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"</font></div>
<div><font face="courier new, monospace"> relayState="cookie" entityID="<a href="https://idp.its.utexas.edu/idp/shibboleth">https://idp.its.utexas.edu/idp/shibboleth</a>"></font></div>
<div><font face="courier new, monospace"> <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/></font></div><div><font face="courier new, monospace"> <SessionInitiator type="Shib1" acsIndex="5"/></font></div>
<div><font face="courier new, monospace"> </SessionInitiator></font></div><div><font face="courier new, monospace"> </font></div><div><font face="courier new, monospace"> <!-- An example using an old-style WAYF, which means Shib 1 only unless an entityID is provided. --></font></div>
<div><font face="courier new, monospace"> <SessionInitiator type="Chaining" Location="/WAYF" id="WAYF" relayState="cookie"></font></div><div><font face="courier new, monospace"> <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/></font></div>
<div><font face="courier new, monospace"> <SessionInitiator type="Shib1" acsIndex="5"/></font></div><div><font face="courier new, monospace"> <SessionInitiator type="WAYF" acsIndex="5" URL="<a href="https://wayf.example.org/WAYF">https://wayf.example.org/WAYF</a>"/></font></div>
<div><font face="courier new, monospace"> </SessionInitiator></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- An example supporting the new-style of discovery service. --></font></div>
<div><font face="courier new, monospace"> <SessionInitiator type="Chaining" Location="/DS" id="DS" relayState="cookie"></font></div><div><font face="courier new, monospace"> <SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/></font></div>
<div><font face="courier new, monospace"> <SessionInitiator type="Shib1" acsIndex="5"/></font></div><div><font face="courier new, monospace"> <SessionInitiator type="SAMLDS" URL="<a href="https://ds.example.org/DS/WAYF">https://ds.example.org/DS/WAYF</a>"/></font></div>
<div><font face="courier new, monospace"> </SessionInitiator></font></div><div><font face="courier new, monospace"> </font></div><div><font face="courier new, monospace"> <!--</font></div>
<div><font face="courier new, monospace"> md:AssertionConsumerService locations handle specific SSO protocol bindings,</font></div><div><font face="courier new, monospace"> such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes</font></div>
<div><font face="courier new, monospace"> are used when sessions are initiated to determine how to tell the IdP where and</font></div><div><font face="courier new, monospace"> how to return the response.</font></div>
<div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> <md:AssertionConsumerService Location="/SAML2/POST" index="1"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/></font></div><div><font face="courier new, monospace"> <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/></font></div><div><font face="courier new, monospace"> <md:AssertionConsumerService Location="/SAML2/Artifact" index="3"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/></font></div><div><font face="courier new, monospace"> <md:AssertionConsumerService Location="/SAML2/ECP" index="4"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/></font></div><div><font face="courier new, monospace"> <md:AssertionConsumerService Location="/SAML/POST" index="5"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/></font></div><div><font face="courier new, monospace"> <md:AssertionConsumerService Location="/SAML/Artifact" index="6"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. --></font></div>
<div><font face="courier new, monospace"> <LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie"></font></div><div><font face="courier new, monospace"> <LogoutInitiator type="SAML2" template="bindingTemplate.html"/></font></div>
<div><font face="courier new, monospace"> <LogoutInitiator type="Local"/></font></div><div><font face="courier new, monospace"> </LogoutInitiator></font></div><div><font face="courier new, monospace"><br>
</font></div><div><font face="courier new, monospace"> <!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. --></font></div><div><font face="courier new, monospace"> <md:SingleLogoutService Location="/SLO/SOAP"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/></font></div><div><font face="courier new, monospace"> <md:SingleLogoutService Location="/SLO/Redirect" conf:template="bindingTemplate.html"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/></font></div><div><font face="courier new, monospace"> <md:SingleLogoutService Location="/SLO/POST" conf:template="bindingTemplate.html"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/></font></div><div><font face="courier new, monospace"> <md:SingleLogoutService Location="/SLO/Artifact" conf:template="bindingTemplate.html"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- md:ManageNameIDService locations handle NameID management (NIM) protocol messages. --></font></div>
<div><font face="courier new, monospace"> <md:ManageNameIDService Location="/NIM/SOAP"</font></div><div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/></font></div>
<div><font face="courier new, monospace"> <md:ManageNameIDService Location="/NIM/Redirect" conf:template="bindingTemplate.html"</font></div><div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/></font></div>
<div><font face="courier new, monospace"> <md:ManageNameIDService Location="/NIM/POST" conf:template="bindingTemplate.html"</font></div><div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/></font></div>
<div><font face="courier new, monospace"> <md:ManageNameIDService Location="/NIM/Artifact" conf:template="bindingTemplate.html"</font></div><div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"> md:ArtifactResolutionService locations resolve artifacts issued when using the</font></div>
<div><font face="courier new, monospace"> SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.</font></div><div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"</font></div>
<div><font face="courier new, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Extension service that generates "approximate" metadata based on SP configuration. --></font></div>
<div><font face="courier new, monospace"> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/></font></div><div><font face="courier new, monospace"><br></font></div>
<div><font face="courier new, monospace"> <!-- Status reporting service. --></font></div><div><font face="courier new, monospace"> <Handler type="Status" Location="/Status" acl="127.0.0.1"/></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Session diagnostic service. --></font></div><div><font face="courier new, monospace"> <Handler type="Session" Location="/Session" showAttributeValues="false"/></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> </Sessions></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!--</font></div>
<div><font face="courier new, monospace"> Allows overriding of error template filenames. You can also add attributes with values</font></div><div><font face="courier new, monospace"> that can be plugged into the templates.</font></div>
<div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> <Errors supportContact="<a href="mailto:ken.demarest@gmail.com">ken.demarest@gmail.com</a>"</font></div>
<div><font face="courier new, monospace"> logoLocation="/shibboleth-sp/logo.jpg"</font></div><div><font face="courier new, monospace"> styleSheet="/shibboleth-sp/main.css"/></font></div>
<div><font face="courier new, monospace"> </font></div><div><font face="courier new, monospace"> <!-- Uncomment and modify to tweak settings for specific IdPs or groups. --></font></div><div><font face="courier new, monospace"> <!-- <RelyingParty Name="SpecialFederation" keyName="SpecialKey"/> --></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Chains together all your metadata sources. --></font></div><div><font face="courier new, monospace"> <MetadataProvider type="Chaining"></font></div>
<div><font face="courier new, monospace"> <!-- Example of remotely supplied batch of signed metadata. --></font></div><div><font face="courier new, monospace"> </font></div><div><font face="courier new, monospace"> <MetadataProvider type="XML" backingFilePath="/etc/shibboleth/UTfed-metadata.xml" uri="<a href="https://idm.utsystem.edu/downloads/UTfed-metadata.xml">https://idm.utsystem.edu/downloads/UTfed-metadata.xml</a>" reloadInterval="7200"></font></div>
<div><font face="courier new, monospace"><!-- <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/> --></font></div><div><font face="courier new, monospace"><!-- <MetadataFilter type="Signature" certificate="fedsigner.pem"/> --></font></div>
<div><font face="courier new, monospace"> </MetadataProvider></font></div><div><font face="courier new, monospace"> </font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Example of locally maintained metadata. --></font></div>
<div><font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"> <MetadataProvider type="XML" file="partner-metadata.xml"/></font></div>
<div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> </MetadataProvider></font></div><div><font face="courier new, monospace"><br></font></div><div>
<font face="courier new, monospace"> <!-- Chain the two built-in trust engines together. --></font></div><div><font face="courier new, monospace"> <TrustEngine type="Chaining"></font></div>
<div><font face="courier new, monospace"> <TrustEngine type="ExplicitKey"/></font></div><div><font face="courier new, monospace"> <TrustEngine type="PKIX"/></font></div>
<div><font face="courier new, monospace"> </TrustEngine></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Map to extract attributes from SAML assertions. --></font></div>
<div><font face="courier new, monospace"> <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/></font></div><div><font face="courier new, monospace"> </font></div>
<div><font face="courier new, monospace"> <!-- Use a SAML query if no attributes are supplied during SSO. --></font></div><div><font face="courier new, monospace"> <AttributeResolver type="Query" subjectMatch="true"/></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Default filtering policy for recognized attributes, lets other data pass. --></font></div><div><font face="courier new, monospace"> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Simple file-based resolver for using a single keypair. --></font></div><div><font face="courier new, monospace"> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> <!-- Example of a second application (using a second vhost) that has a different entityID. --></font></div><div>
<font face="courier new, monospace"> <!-- <ApplicationOverride id="admin" entityID="<a href="https://admin.example.org/shibboleth">https://admin.example.org/shibboleth</a>"/> --></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"> </ApplicationDefaults></font></div><div><font face="courier new, monospace"> </font></div><div><font face="courier new, monospace"> <!-- Each policy defines a set of rules to use to secure messages. --></font></div>
<div><font face="courier new, monospace"> <SecurityPolicies></font></div><div><font face="courier new, monospace"> <!--</font></div><div><font face="courier new, monospace"> The predefined policy enforces replay/freshness, standard</font></div>
<div><font face="courier new, monospace"> condition processing, and permits signing and client TLS.</font></div><div><font face="courier new, monospace"> --></font></div><div><font face="courier new, monospace"> <Policy id="default" validate="false"></font></div>
<div><font face="courier new, monospace"> <PolicyRule type="MessageFlow" checkReplay="true" expires="60"/></font></div><div><font face="courier new, monospace"> <PolicyRule type="Conditions"></font></div>
<div><font face="courier new, monospace"> <PolicyRule type="Audience"/></font></div><div><font face="courier new, monospace"> <!-- Enable Delegation rule to permit delegated access. --></font></div>
<div><font face="courier new, monospace"> <!-- <PolicyRule type="Delegation"/> --></font></div><div><font face="courier new, monospace"> </PolicyRule></font></div><div>
<font face="courier new, monospace"> <PolicyRule type="ClientCertAuth" errorFatal="true"/></font></div><div><font face="courier new, monospace"> <PolicyRule type="XMLSigning" errorFatal="true"/></font></div>
<div><font face="courier new, monospace"> <PolicyRule type="SimpleSigning" errorFatal="true"/></font></div><div><font face="courier new, monospace"> </Policy></font></div>
<div><font face="courier new, monospace"> </SecurityPolicies></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"></SPConfig></font></div></div><div>
<br></div><div>And here is the relevant part of the apache configuration:</div><div><br></div><div><div><font face="courier new, monospace"><IfModule mod_ssl.c></font></div><div><font face="courier new, monospace"><VirtualHost _default_:443></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>ErrorDocument 503 /503.html</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>RewriteEngine on</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>RewriteCond %{DOCUMENT_ROOT}/../tmp/stop.txt -f</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>RewriteCond %{DOCUMENT_ROOT}/${REQUEST_FILENAME} !-f</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>RewriteRule ^(.*)$ /$1 [R=503,L]</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>ServerName <a href="http://www.appsoma.com">www.appsoma.com</a></font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>DocumentRoot /webapps/hsc/current/public</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span><Directory /webapps/hsc/current/public></font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>Allow from all</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>Options -MultiViews</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span></Directory></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span><Location /auth/shibboleth/callback></font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span># this Location directive is what redirects apache over to the IdP.</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>AuthType shibboleth</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>ShibRequestSetting requireSession 1</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>require valid-user</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span></Location></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span><Location /Shibboleth.sso></font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>Satisfy Any</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>Allow from all</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>AuthType None</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>Require all granted</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span></Location></font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>ErrorLog ${APACHE_LOG_DIR}/error.log</font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>LogLevel warn</font></div><div><font face="courier new, monospace"><br>
</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>CustomLog ${APACHE_LOG_DIR}/access.log combined</font></div><div><font face="courier new, monospace"><br></font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>SSLEngine on</font></div><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>SSLCertificateFile /etc/apache2/ssl/appsoma.com.crt</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>SSLCertificateKeyFile /etc/apache2/ssl/appsoma.com.key</font></div><div><font face="courier new, monospace"><br></font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span><FilesMatch "\.(cgi|shtml|phtml|php)$"></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>SSLOptions +StdEnvVars</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span></FilesMatch></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span><Directory /usr/lib/cgi-bin></font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>SSLOptions +StdEnvVars</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span></Directory></font></div>
<div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>BrowserMatch "MSIE [2-6]" \</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>nokeepalive ssl-unclean-shutdown \</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>downgrade-1.0 force-response-1.0</font></div><div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span># MSIE 7 and newer should be able to use keepalive</font></div>
<div><font face="courier new, monospace"><span class="Apple-tab-span" style="white-space:pre"> </span>BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown</font></div><div><font face="courier new, monospace"><br></font></div>
<div><font face="courier new, monospace"></VirtualHost></font></div><div><font face="courier new, monospace"></IfModule></font></div></div><div><br></div><div>Any and all help is much appreciated!!</div><div><br>
</div><div>Ken Demarest</div><div><br></div><div><br></div><div><br></div>