<meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Sorry about the last reply. Did not intend to reply without adding more details. In the host section I was under the impression the Path name should be set to the site/application you want to protect? EmpWeb is an application under the ShibTest site. I thought that for Shib to work I had to point to <a href="https://iometer1.kayacorp.com/EmpWeb/Shibboleth.sso" target="_top" rel="nofollow" link="external">https://iometer1.kayacorp.com/EmpWeb/Shibboleth.sso</a>. Sounds like I am completely wrong here? <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> <Host name="IOMETER1.KAYACORP.COM"><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> <Path name="EmpWeb" authType="shibboleth" requireSession="true"/><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </Host><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> Cantor, Scott E. [via Shibboleth] [mailto:<a href="/user/SendEmail.jtp?type=node&node=7605207&i=0" target="_top" rel="nofollow" link="external">[hidden email]</a>] <br><b>Sent:</b> Friday, August 08, 2014 12:31 PM<br><b>To:</b> Bryan Horton<br><b>Subject:</b> Re: Shibboleth SP browser loops when attempting to connect to protected site<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>I can identify a number of obvious mistakes. <br><br>- your <Site> element's name contains a URL, which is not allowed, that's <br>a hostname only <br>- you should not set port or scheme there unless you are actually <br>virtualizing them; if they match what the physical request would determine <br>they should be, then don't set them <br><br>>My setup is a Windows 7 test system with IIS 7.5 and a web applications <br>>configured for SSL only. Shibboleth 2.5.3 is installed to the default <br>>location. My current shibboleth2.xml file is attached. My idP is VMware <br>>Horizon Workspace Portal 2.0 which supports SAML 2.0. Within Workspace I <br>>have configured a web app to point to <br>><a href="https://iometer1.kayacorp.com/EmpWeb/Shibboleth.sso/SAML2/POST" target="_top" rel="nofollow" link="external">https://iometer1.kayacorp.com/EmpWeb/Shibboleth.sso/SAML2/POST</a> as the ACS <br>>URL. <br><br>You should really not do that, those handlers should be at the root, buf <br>if you insist on doing that, then you're going to have to change the <br>default handlerURL to "/EmpWeb/Shibboleth.sso". <br><br>I'm not sure you want or need to do that, however. <br><br>> Note that in the xml file in the MetadataProvider section I have <br>>commented out the filter for the certificate. When I included this line <br>>with either a crt or pem the shibd.log would would error saying the <br>>metadata <br>>source is not signed (the iDP does have a SAML certificate and this is <br>>what <br>>I exported into a pem file). <br><br>How you deal with metadata is a local decision, but you need a secure <br>source of it, and nobody else can tell you what settings to use unless <br>you're using an existing federation that has standing practice about how <br>to consume its metadata. <br><br>If the metadata's not signed, then you'd better not be pulling it from a <br>remote source, and you certainly can't enforce a signature over it, no. <br><br>>Also, I have read through several posts about redirect loops and have <br>>tried <br>>playing with the cookieProps setting but keep getting the same results. <br>>Hopefully someone can point me in the right direction here and tell me <br>>where <br>>I messed thing up? <br><br>Loops are a wholly local matter to fix, but until you correct the major <br>mistakes, it's not worth worrying about it much. <br><br>If /Shibboleth.sso wasn't mapped at the root, you couldn't get a loop. So <br>maybe you're just confused about that entirely. Why do you think you need <br>to mount it below a subdirectory? You don't appear to have done that, and <br>it doesn't appear that you need to. <br><br>-- Scott <br><br>-- <br>To unsubscribe from this list send an email to <a href="/user/SendEmail.jtp?type=node&node=7605204&i=0" target="_top" rel="nofollow" link="external">[hidden email]</a> <br><br><o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=1 width="100%" noshade style='color:#CCCCCC' align=center></div><div><div><p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Tahoma","sans-serif";color:#444444'>If you reply to this email, your message will be added to the discussion below:<o:p></o:p></span></b></p></div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Tahoma","sans-serif";color:#444444'><a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-browser-loops-when-attempting-to-connect-to-protected-site-tp7605202p7605204.html" target="_top" rel="nofollow" link="external">http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-browser-loops-when-attempting-to-connect-to-protected-site-tp7605202p7605204.html</a> <o:p></o:p></span></p></div><div style='margin-top:4.8pt'><p class=MsoNormal style='line-height:18.0pt'><span style='font-size:8.5pt;font-family:"Tahoma","sans-serif";color:#666666'>To unsubscribe from Shibboleth SP browser loops when attempting to connect to protected site, <a href="" target="_top" rel="nofollow" link="external">click here</a>.<br><a href="http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml" target="_top" rel="nofollow" link="external"><span style='font-size:7.0pt;font-family:"Times New Roman","serif"'>NAML</span></a> <o:p></o:p></span></p></div></div>
<br/><hr align="left" width="300" />
View this message in context: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-browser-loops-when-attempting-to-connect-to-protected-site-tp7605202p7605207.html">RE: Shibboleth SP browser loops when attempting to connect to protected site</a><br/>
Sent from the <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html">Shibboleth - Users mailing list archive</a> at Nabble.com.<br/>