<div dir="ltr"><div>Hi, I'm running into a loop problem with Shibboleth over SSL. But it doesn't appear to be any of the usual issues that people run into. Basically, it looks like the /Shibboleth.sso/SAML2/POST request is not sending a cookie in the response and therefore not setting a cookie in the browser and so I get stuck in an authentication loop.</div>
<div><br></div><div>I've reviewed the [looping page](<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLooping">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLooping</a>) and [flows and config](<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig">https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig</a>). </div>
<div><br></div><div>I've verified that all of my requests are happening over SSL.</div><div><br></div><div>I'm seeing the following requests:</div><div><br></div><div>- GET <a href="https://myserver.cascadeserver.com">https://myserver.cascadeserver.com</a> - redirects to IDP</div>
<div>- GET <a href="https://idp.school.edu">https://idp.school.edu</a> - sets _idp_authn_lc_key cookie for <a href="http://idp.blah.com">idp.blah.com</a></div><div>- POST <a href="https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST">https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST</a> - post data includes a RelayState and a SAMLResponse but the server response doesn't set a cookie. It does include a redirect to my "target" <a href="https://myserver.cascadeserver.com/login.act">https://myserver.cascadeserver.com/login.act</a></div>
<div>- GET <a href="https://myserver.cascadeserver.com">https://myserver.cascadeserver.com</a> - because no cookie was set during the POST, none is passed in this request and again no cookie is set in the response</div><div>
</div><div> and then it goes back to the IDP and loops indefinitely.</div><div><br></div><div>I've set both shibd.logger and native.logger root category to DEBUG and attached the logging from 3 cycles of the loop below.</div>
<div><br></div><div>I'm surprised I'm not seeing any logging about it unpacking the SAMLResponse and extracting the attributes. Is that to be expected?</div><div><br></div><div>I'm not seeing any problems per se. The main "symptom" is that the cookies are not getting sent in the response, not being set in my browser and thus not being sent in the subsequent requests.</div>
<div><br></div><div>Thanks!</div><div><br></div><div>shibd.log</div><div><br></div><div>2013-11-04 14:35:02 DEBUG Shibboleth.Listener [1]: dispatching message (default/Login::run::SAML2SI)</div><div>2013-11-04 14:35:02 DEBUG XMLTooling.StorageService [1]: inserted record (0f9eddbece19507bdf266a30e335ae15a8c5ab30fd43990a9d11c72dae0c480e) in context (RelayState) with expiration (1383594302)</div>
<div>2013-11-04 14:35:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: validating input</div><div>2013-11-04 14:35:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: marshalling, deflating, base64-encoding the message</div>
<div>2013-11-04 14:35:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: marshalled message:</div><div><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="<a href="https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST">https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST</a>" Destination="<a href="https://idp.school.edu/idp/profile/SAML2/Redirect/SSO">https://idp.school.edu/idp/profile/SAML2/Redirect/SSO</a>" ID="_333270a428b0ef2cebaabc0493d38a76" IssueInstant="2013-11-04T19:35:02Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://myserver.cascadeserver.com/shibboleth">https://myserver.cascadeserver.com/shibboleth</a></saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest></div>
<div>2013-11-04 14:35:02 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: message encoded, sending redirect to client</div><div>2013-11-04 14:35:03 DEBUG Shibboleth.Listener [1]: dispatching message (default/Login::run::SAML2SI)</div>
<div>2013-11-04 14:35:03 DEBUG XMLTooling.StorageService [1]: inserted record (dc774a67d7c09ceddcdcecfcd61205c61edfb9439e13490ae55641968225f166) in context (RelayState) with expiration (1383594303)</div><div>2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: validating input</div>
<div>2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: marshalling, deflating, base64-encoding the message</div><div>2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: marshalled message:</div>
<div><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="<a href="https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST">https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST</a>" Destination="<a href="https://idp.school.edu/idp/profile/SAML2/Redirect/SSO">https://idp.school.edu/idp/profile/SAML2/Redirect/SSO</a>" ID="_51062bd5050319691cb4850db5c227b0" IssueInstant="2013-11-04T19:35:03Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://myserver.cascadeserver.com/shibboleth">https://myserver.cascadeserver.com/shibboleth</a></saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest></div>
<div>2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: message encoded, sending redirect to client</div><div>2013-11-04 14:35:03 DEBUG Shibboleth.Listener [1]: dispatching message (default/Login::run::SAML2SI)</div>
<div>2013-11-04 14:35:03 DEBUG XMLTooling.StorageService [1]: inserted record (5cbe51db3513eb20a5e825f8b3d0789f1a30c0720fb0d3d6ff89ad43996fb269) in context (RelayState) with expiration (1383594303)</div><div>2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: validating input</div>
<div>2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: marshalling, deflating, base64-encoding the message</div><div>2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: marshalled message:</div>
<div><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="<a href="https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST">https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST</a>" Destination="<a href="https://idp.school.edu/idp/profile/SAML2/Redirect/SSO">https://idp.school.edu/idp/profile/SAML2/Redirect/SSO</a>" ID="_86341d1ac119e7f14359d1f4194eb857" IssueInstant="2013-11-04T19:35:03Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://myserver.cascadeserver.com/shibboleth">https://myserver.cascadeserver.com/shibboleth</a></saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest></div>
<div>2013-11-04 14:35:03 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [1]: message encoded, sending redirect to client</div><div><br></div><div><br></div><div>native.log</div><div><br></div><div>2013-11-04 14:35:02 DEBUG Shibboleth.Apache [16087] shib_check_user: mapped <a href="https://myserver.cascadeserver.com/">https://myserver.cascadeserver.com/</a> to default</div>
<div>2013-11-04 14:35:02 DEBUG Shibboleth.SessionInitiator.SAML2 [16087] shib_check_user: attempting to initiate session using SAML 2.0 with provider (<a href="https://idp.school.edu/idp/shibboleth">https://idp.school.edu/idp/shibboleth</a>)</div>
<div>2013-11-04 14:35:02 DEBUG Shibboleth.Listener [16087] shib_check_user: sending message (default/Login::run::SAML2SI)</div><div>2013-11-04 14:35:02 DEBUG Shibboleth.Listener [16087] shib_check_user: send completed, reading response message</div>
<div>2013-11-04 14:35:03 DEBUG Shibboleth.Apache [16087] shib_check_user: mapped <a href="https://myserver.cascadeserver.com/login.act">https://myserver.cascadeserver.com/login.act</a> to default</div><div>2013-11-04 14:35:03 DEBUG Shibboleth.SessionInitiator.SAML2 [16087] shib_check_user: attempting to initiate session using SAML 2.0 with provider (<a href="https://idp.school.edu/idp/shibboleth">https://idp.school.edu/idp/shibboleth</a>)</div>
<div>2013-11-04 14:35:03 DEBUG Shibboleth.Listener [16087] shib_check_user: sending message (default/Login::run::SAML2SI)</div><div>2013-11-04 14:35:03 DEBUG Shibboleth.Listener [16087] shib_check_user: send completed, reading response message</div>
<div>2013-11-04 14:35:03 DEBUG Shibboleth.Apache [16087] shib_check_user: mapped <a href="https://myserver.cascadeserver.com/login.act">https://myserver.cascadeserver.com/login.act</a> to default</div><div>2013-11-04 14:35:03 DEBUG Shibboleth.SessionInitiator.SAML2 [16087] shib_check_user: attempting to initiate session using SAML 2.0 with provider (<a href="https://idp.school.edu/idp/shibboleth">https://idp.school.edu/idp/shibboleth</a>)</div>
<div>2013-11-04 14:35:03 DEBUG Shibboleth.Listener [16087] shib_check_user: sending message (default/Login::run::SAML2SI)</div><div>2013-11-04 14:35:03 DEBUG Shibboleth.Listener [16087] shib_check_user: send completed, reading response message</div>
<div><br></div><div><br></div><div>Here's my Apache config:</div><div><br></div><div>LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so</div><div><br></div><div># Ensures handler will be accessible.</div><div><Location /Shibboleth.sso></div>
<div> Satisfy Any</div><div> Allow from all</div><div></Location></div><div><br></div><div>ProxyIOBufferSize 65536</div><div><br></div><div><VirtualHost *:80></div><div> RewriteEngine on</div><div> RewriteRule ^(.*)$ <a href="https://myserver.cascadeserver.com">https://myserver.cascadeserver.com</a>$1 [R=301,L]</div>
<div></VirtualHost></div><div><br></div><div><VirtualHost *:443></div><div> ServerName <a href="http://myserver.cascadeserver.com">myserver.cascadeserver.com</a></div><div> SSLEngine on</div><div> SSLProxyEngine on</div>
<div> SSLProtocol all</div><div> SSLCertificateFile /path/to/crt</div><div> SSLCertificateKeyFile /path/to/key</div><div> SSLCertificateChainFile /path/to/intermediate_crt</div><div> <Location /></div><div> AuthType shibboleth</div>
<div> ShibRequestSetting requireSession 1</div><div> require valid-user</div><div> </Location></div><div><br></div><div> ProxyPass / ajp://localhost:8009/</div><div> ProxyPassReverse / ajp://localhost:8009/</div>
<div></VirtualHost></div><div><br></div><div><br></div><div>Here's my shibboleth2.xml file:</div><div><br></div><div><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"</div><div> xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"</div>
<div> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"</div><div> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"</div><div> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"</div>
<div> clockSkew="180"></div><div><br></div><div> <ApplicationDefaults entityID="<a href="https://myserver.cascadeserver.com/shibboleth">https://myserver.cascadeserver.com/shibboleth</a>"</div>
<div> REMOTE_USER="eppn uid persistent-id targeted-id"</div><div> attributePrefix="AJP_"></div><div><br></div><div> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"</div>
<div> checkAddress="false" handlerSSL="true" cookieProps="https"></div><div><br></div><div> <SSO entityID="<a href="https://idp.school.edu/idp/shibboleth">https://idp.school.edu/idp/shibboleth</a>"></div>
<div> SAML2</div><div> </SSO></div><div> <Logout>SAML2 Local</Logout></div><div> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/></div>
<div> <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/></div><div> <Handler type="Session" Location="/Session" showAttributeValues="false"/></div>
<div> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/></div><div> </Sessions></div><div><br></div><div> <Errors supportContact="<a href="mailto:support@hannonhill.com">support@hannonhill.com</a>"</div>
<div> helpLocation="/about.html"</div><div> styleSheet="/shibboleth-sp/main.css"/></div><div><br></div><div> <MetadataProvider type="XML" uri="<a href="https://idp.school.edu/idp-metadata.xml">https://idp.school.edu/idp-metadata.xml</a>"</div>
<div> reloadInterval="7200"</div><div> backingFilePath="example-metadata.xml"></div><div> </MetadataProvider></div><div><br></div><div> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/></div>
<div><br></div><div> <AttributeResolver type="Query" subjectMatch="true"/></div><div> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/></div>
<div><br></div><div> <!-- CredentialResolver type="File" key="/path/to/key" certificate="/path/to/crt" / --></div><div> </ApplicationDefaults></div><div><br></div><div> <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/></div>
<div> <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/></div><div></SPConfig></div><div><br></div></div>