
<html dir="ltr">

<head>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

<style type="text/css" id="owaParaStyle"></style>

</head>

<body fpstyle="1" ocsi="0">

<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">

<p class="p1">Hello,</p>

<p class="p1">I've recently inherited a Shibboleth server and am still learning, so please forgive me if my issue is something simple I've over looked. A client brought an issue to me and I haven't been able to fix it, even though from the looks of it it should

 work. What is happening is that a user pre log in can access a recourse that has passive session access, but once they log in to shin and try to access that URI that is setup for passive session, the client gets an 'Access Denied' message. When I look at the

 access logs on the web server, I am seeing a 403 get generated. This seems like something that should work and from what I can see in the documentation I am enabling the passive session correctly. So there must be another part of my config that is in conflict,

 but I can't determine what.</p>

<p class="p2"><br>

</p>

<p class="p3">IDP 2.3.8</p>

<p class="p3">SP 2.5.2</p>

<p class="p4">iPlanet&nbsp;<span class="s1">7.0.12</span></p>

<p class="p2"><br>

</p>

<p class="p1">Here is the shibboleth2.xml file, I have cleaned up (removed other hosts and cleaned up url's)</p>

<p class="p2"><br>

</p>

<p class="p1">&lt;SPConfig xmlns=&quot;urn:mace:shibboleth:2.0:native:sp:config&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp; xmlns:conf=&quot;urn:mace:shibboleth:2.0:native:sp:config&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp; xmlns:saml=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp; xmlns:samlp=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot;&nbsp;&nbsp;&nbsp;</p>

<p class="p1">&nbsp;&nbsp;&nbsp; xmlns:md=&quot;urn:oasis:names:tc:SAML:2.0:metadata&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp; clockSkew=&quot;180&quot;&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&lt;RequestMapper type=&quot;Native&quot;&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp; &lt;RequestMap applicationId=&quot;default&quot;&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Host name=&quot;webappdev&quot; authType=&quot;shibboleth&quot; requireSession=&quot;false&quot; applicationId=&quot;webappdev&quot;&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;AccessControl&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Rule require=&quot;eduPersonAffiliation&quot;&gt;nobody&lt;/Rule&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/AccessControl&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Path name=&quot;humanresources&quot; authType=&quot;shibboleth&quot; requireSession=&quot;false&quot; &gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Path name=&quot;phpmy&quot; authType=&quot;shibboleth&quot; requireSession=&quot;false&quot;&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Path&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Path name=&quot;train&quot; authType=&quot;shibboleth&quot; requireSession=&quot;true&quot; &gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;AccessControl&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Rule require=&quot;eduPersonAffiliation&quot;&gt;staff&lt;/Rule&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/AccessControl&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Path&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Path&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Host&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp; &lt;/RequestMap&gt;</p>

<p class="p1">&lt;/RequestMapper&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&lt;ApplicationDefaults entityID=&quot;<a href="https://prev-revproxy/shibboleth"><span class="s2">https://prev-revproxy/shibboleth</span></a>&quot; REMOTE_USER=&quot;eppn persistent-id targeted-id&quot;&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp; &lt;Sessions lifetime=&quot;28800&quot; timeout=&quot;3600&quot; checkAddress=&quot;false&quot; relayState=&quot;ss:mem&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; handlerSSL=&quot;false&quot;&nbsp; handlerURL=&quot;/Shibboleth.sso&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; cookieProps=&quot;; path=/; secure; HttpOnly&quot;&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;SSO entityID=&quot;<a href="https://idptest.queensu.ca/idp/shibboleth"><span class="s2">https://idptest/idp/shibboleth</span></a>&quot; discoveryProtocol=&quot;SAMLDS&quot; discoveryURL=&quot;<a href="https://ds.example.org/DS/WAYF"><span class="s2">https://ds.example.org/DS/WAYF</span></a>&quot;&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SAML2 SAML1</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/SSO&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Logout&gt;SAML2 Local&lt;/Logout&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Handler type=&quot;MetadataGenerator&quot; Location=&quot;/Metadata&quot; signing=&quot;false&quot;/&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Handler type=&quot;Status&quot; Location=&quot;/Status&quot; acl=&quot;127.0.0.1&quot;/&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Handler type=&quot;Session&quot; Location=&quot;/Session&quot; showAttributeValues=&quot;false&quot;/&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Handler type=&quot;DiscoveryFeed&quot; Location=&quot;/DiscoFeed&quot;/&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Sessions&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Errors supportContact=&quot;root@localhost&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; logoLocation=&quot;/shibboleth-sp/logo.jpg&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; styleSheet=&quot;/shibboleth-sp/main.css&quot;/&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;MetadataProvider type=&quot;XML&quot; uri=&quot;<a href="https://idptest/idp/profile/Metadata/SAML"><span class="s2">https://idptest/idp/profile/Metadata/SAML</span></a>&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; backingFilePath=&quot;/opt/shibboleth-sp.64/etc/shibboleth/idptest-metadata.xml&quot;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; reloadInterval=&quot;120&quot;&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;TransportOption provider=&quot;CURL&quot; option=&quot;32&quot;&gt;3&lt;/TransportOption&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/MetadataProvider&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;AttributeExtractor type=&quot;XML&quot; validate=&quot;true&quot; path=&quot;attribute-map.xml&quot;/&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;AttributeResolver type=&quot;Query&quot; subjectMatch=&quot;true&quot;/&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;ApplicationOverride id=&quot;webappdev&quot; entityID=&quot;<a href="https://webappdev/shibboleth"><span class="s2">https://webappdev/shibboleth</span></a>&quot; &gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;AttributeExtractor type=&quot;XML&quot; file=&quot;AttributeRelease/webappdev-attribute-map.xml&quot;/&gt;&nbsp;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/ApplicationOverride&gt;&nbsp;&nbsp;&nbsp;&nbsp;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;AttributeFilter type=&quot;XML&quot; validate=&quot;true&quot; path=&quot;attribute-policy.xml&quot;/&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;CredentialResolver type=&quot;File&quot; key=&quot;sp-key.pem&quot; certificate=&quot;sp-cert.pem&quot;/&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp; &lt;/ApplicationDefaults&gt;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp;</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp; &lt;SecurityPolicyProvider type=&quot;XML&quot; validate=&quot;true&quot; path=&quot;security-policy.xml&quot;/&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&nbsp;&nbsp;&nbsp;&nbsp; &lt;ProtocolProvider type=&quot;XML&quot; validate=&quot;true&quot; reloadChanges=&quot;false&quot; path=&quot;protocols.xml&quot;/&gt;</p>

<p class="p2"><br>

</p>

<p class="p1">&lt;/SPConfig&gt;</p>

<p class="p2"><br>

</p>

<p class="p2"><br>

</p>

<p class="p2">Thank you for any help you can give.</p>

<p class="p2">Rob</p>

<p class="p2"><br>

</p>

</div>

</body>

</html>