<div dir="ltr">Ha, now I'm confused again.<div><br></div><div>I just tried removing the:</div><div><br></div><div><div style="font-family:arial,sans-serif;font-size:13px"><Location /Shibboleth.sso></div><div style="font-family:arial,sans-serif;font-size:13px">
Require all granted</div><div style="font-family:arial,sans-serif;font-size:13px"></Location></div></div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">
altogether and everything worked.</div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">All URLs were protected by Shibboleth and proxied to my Tomcat app (once a valid Shibb session was established) *except* for /Shibboleth.sso/* even though I wasn't explicitly exposing those. </div>
<div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">Is the Apache module smart enough to know how to do this on its own? This is my entire working config at this point.</div>
<div style="font-family:arial,sans-serif;font-size:13px"><br></div><div><font face="arial, sans-serif">LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so</font><br></div><div style="font-family:arial,sans-serif;font-size:13px">
<br></div><div><div><font face="arial, sans-serif"><VirtualHost *:443></font></div><div><font face="arial, sans-serif"> ServerName <a href="http://blah.cascadeserver.com">blah.cascadeserver.com</a></font></div><div>
<font face="arial, sans-serif"> SSLEngine on</font></div><div><font face="arial, sans-serif"> SSLProxyEngine on</font></div><div><font face="arial, sans-serif"> SSLProtocol all</font></div><div><font face="arial, sans-serif"> SSLCertificateFile /path/to/crt</font></div>
<div><font face="arial, sans-serif"> SSLCertificateKeyFile /path/to/key</font></div><div><font face="arial, sans-serif"> SSLCertificateChainFile /path/to/intermediate.crt</font></div><div><font face="arial, sans-serif"><br>
</font></div><div><font face="arial, sans-serif"> <Location /></font></div><div><font face="arial, sans-serif"> AuthType shibboleth</font></div><div><font face="arial, sans-serif"> ShibRequestSetting requireSession 1</font></div>
<div><font face="arial, sans-serif"> Require valid-user</font></div><div><font face="arial, sans-serif"> </Location></font></div><div><font face="arial, sans-serif"><br></font></div><div><font face="arial, sans-serif"> ProxyPass / ajp://localhost:8009/</font></div>
<div><font face="arial, sans-serif"> ProxyPassReverse / ajp://localhost:8009/</font></div><div><font face="arial, sans-serif"></VirtualHost></font></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Mon, Nov 4, 2013 at 6:09 PM, Bradley Wagner <span dir="ltr"><<a href="mailto:bradley.wagner@hannonhill.com" target="_blank">bradley.wagner@hannonhill.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hi Scott,<div><br></div><div>You're absolutely right! I was able to verify that indeed the /Shibboleth.sso* URLs were not being handled by the module. So while the IdP was correctly redirecting me to "POST <a href="http://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST" target="_blank">myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST</a>", it was my app and not the shibboleth module that was responding.</div>
<div><br></div><div>I'm using Apache 2.2 and Shibboleth 2.5.2. I was trying to protect all resources from the root "/" excluding "/Shibboleth.sso*".</div><div><br></div><div>I took the syntax for excluding /Shibboleth.sso directly from the apache22.config file that was created when I built shibboleth.</div>
<div><br></div><div>But I had to change it from:</div><div class="im"><div><br></div><div><div><div style="font-family:arial,sans-serif;font-size:13px"><Location /Shibboleth.sso></div><div style="font-family:arial,sans-serif;font-size:13px">
Satisfy Any</div><div style="font-family:arial,sans-serif;font-size:13px"> Allow from all</div><div style="font-family:arial,sans-serif;font-size:13px"></Location></div></div></div><div><br></div></div><div>to:</div>
<div>
<br></div><div><div><Location /Shibboleth.sso></div><div> Require all granted</div><div></Location></div></div><div><br></div><div>and I'm not exactly sure why.</div><div><br></div><div>Perhaps the former only works when you're protecting specific resources ("/protected") instead of the root? Or maybe it's something odd in my Apache configuration.</div>
<div><br></div><div>Regardless, works now. Thanks for the help. </div><div><br></div><div>Moral of the story is to make sure that the /Shibboleth.sso handlers are accessible. I know /Shibboleth.sso/Status is only accessible from localhost but it looks like /Shibboleth.sso/Session is a good one to test.</div>
</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Nov 4, 2013 at 4:53 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 11/4/13, 2:46 PM, "Bradley Wagner" <<a href="mailto:bradley.wagner@hannonhill.com" target="_blank">bradley.wagner@hannonhill.com</a>><br>
wrote:<br>
<div><br>
>Hi, I'm running into a loop problem with Shibboleth over SSL. But it<br>
>doesn't appear to be any of the usual issues that people run into.<br>
>Basically, it looks like the /Shibboleth.sso/SAML2/POST request is not<br>
>sending a cookie in the response and therefore<br>
> not setting a cookie in the browser and so I get stuck in an<br>
>authentication loop.<br>
<br>
</div>There's no POST period. Whatever you think you see, that isn't it. There<br>
is no logging indicating it ever processes the POST. So by definition no<br>
cookie.<br>
<br>
>- POST<br>
><a href="https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST" target="_blank">https://myserver.cascadeserver.com/Shibboleth.sso/SAML2/POST</a><br>
<br>
If you see that, then you have the SP only partly configured because the<br>
*SP* isn't seeing that. Your web server isn't handing that off to my code.<br>
<br>
I suspect because you're ProxyPassing everything and not excluding<br>
/Shibboleth.sso. You can't do that.<br>
<div><br>
>I'm surprised I'm not seeing any logging about it unpacking the<br>
>SAMLResponse and extracting the attributes. Is that to be expected?<br>
<br>
</div>Nope.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>