<div dir="ltr">Hi Scott,<div><br></div><div>You're absolutely right! I was able to verify that indeed the /Shibboleth.sso* URLs were not being handled by the module. So while the IdP was correctly redirecting me to "POST <a href="http://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST">myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST</a>", it was my app and not the shibboleth module that was responding.</div>
<div><br></div><div>I'm using Apache 2.2 and Shibboleth 2.5.2. I was trying to protect all resources from the root "/" excluding "/Shibboleth.sso*".</div><div><br></div><div>I took the syntax for excluding /Shibboleth.sso directly from the apache22.config file that was created when I built shibboleth.</div>
<div><br></div><div>But I had to change it from:</div><div><br></div><div><div><div style="font-family:arial,sans-serif;font-size:13px"><Location /Shibboleth.sso></div><div style="font-family:arial,sans-serif;font-size:13px">
Satisfy Any</div><div style="font-family:arial,sans-serif;font-size:13px"> Allow from all</div><div style="font-family:arial,sans-serif;font-size:13px"></Location></div></div></div><div><br></div><div>to:</div><div>
<br></div><div><div><Location /Shibboleth.sso></div><div> Require all granted</div><div></Location></div></div><div><br></div><div>and I'm not exactly sure why.</div><div><br></div><div>Perhaps the former only works when you're protecting specific resources ("/protected") instead of the root? Or maybe it's something odd in my Apache configuration.</div>
<div><br></div><div>Regardless, works now. Thanks for the help. </div><div><br></div><div>Moral of the story is to make sure that the /Shibboleth.sso handlers are accessible. I know /Shibboleth.sso/Status is only accessible from localhost but it looks like /Shibboleth.sso/Session is a good one to test.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Nov 4, 2013 at 4:53 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 11/4/13, 2:46 PM, "Bradley Wagner" <<a href="mailto:bradley.wagner@hannonhill.com">bradley.wagner@hannonhill.com</a>><br>
wrote:<br>
<div class="im"><br>
>Hi, I'm running into a loop problem with Shibboleth over SSL. But it<br>
>doesn't appear to be any of the usual issues that people run into.<br>
>Basically, it looks like the /Shibboleth.sso/SAML2/POST request is not<br>
>sending a cookie in the response and therefore<br>
> not setting a cookie in the browser and so I get stuck in an<br>
>authentication loop.<br>
<br>
</div>There's no POST period. Whatever you think you see, that isn't it. There<br>
is no logging indicating it ever processes the POST. So by definition no<br>
cookie.<br>
<br>
>- POST<br>
><a href="https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST" target="_blank">https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST</a><br>
<br>
If you see that, then you have the SP only partly configured because the<br>
*SP* isn't seeing that. Your web server isn't handing that off to my code.<br>
<br>
I suspect because you're ProxyPassing everything and not excluding<br>
/Shibboleth.sso. You can't do that.<br>
<div class="im"><br>
>I'm surprised I'm not seeing any logging about it unpacking the<br>
>SAMLResponse and extracting the attributes. Is that to be expected?<br>
<br>
</div>Nope.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>