<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Bryan,
<div><br>
</div>
<div>You should think of the problem as two pieces: first the user shows up at the SP with an assertion from the IdP that needs to be processed by Shibboleth, and then the user is given a session and sent to the protected resource, e.g. the application. The
first half happens under /Shibboleth.sso, while the resource itself is responsible for issuing the ultimate response. The configuration you're using touches both, but the host name and path below would require a Shibboleth session for
<a href="scheme://IOMETER1.KAYACORP.COM:port/EmpWeb*">scheme://IOMETER1.KAYACORP.COM:port/EmpWeb*</a> . That won't be connected to the things done under the /Shibboleth.sso tree.</div>
<div><br>
</div>
<div>You may find this article helpful:</div>
<div><br>
</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPEnableApplication</a></div>
<div><br>
</div>
<div>Hope this helps,</div>
<div>Nate.</div>
<div><br>
<div>
<div>On Aug 8, 2014, at 12:51 PM, String76 <<a href="mailto:hortonb@kayacorp.com">hortonb@kayacorp.com</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Sorry about the last reply. Did not intend to reply without adding more details. In the host section I was under the impression the Path name should be set
to the site/application you want to protect? EmpWeb is an application under the ShibTest site. I thought that for Shib to work I had to point to
<a href="https://iometer1.kayacorp.com/EmpWeb/Shibboleth.sso" target="_top" rel="nofollow" link="external">
https://iometer1.kayacorp.com/EmpWeb/Shibboleth.sso</a>. Sounds like I am completely wrong here?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> <Host name="<a href="http://IOMETER1.KAYACORP.COM">IOMETER1.KAYACORP.COM</a>"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> <Path name="EmpWeb" authType="shibboleth" requireSession="true"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </Host><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Cantor, Scott E. [via Shibboleth] [mailto:<a href="x-msg://7303/user/SendEmail.jtp?type=node&node=7605207&i=0" target="_top" rel="nofollow" link="external">[hidden
email]</a>] <br>
<b>Sent:</b> Friday, August 08, 2014 12:31 PM<br>
<b>To:</b> Bryan Horton<br>
<b>Subject:</b> Re: Shibboleth SP browser loops when attempting to connect to protected site<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">I can identify a number of obvious mistakes.
<br>
<br>
- your <Site> element's name contains a URL, which is not allowed, that's <br>
a hostname only <br>
- you should not set port or scheme there unless you are actually <br>
virtualizing them; if they match what the physical request would determine <br>
they should be, then don't set them <br>
<br>
>My setup is a Windows 7 test system with IIS 7.5 and a web applications <br>
>configured for SSL only. Shibboleth 2.5.3 is installed to the default <br>
>location. My current shibboleth2.xml file is attached. My idP is VMware <br>
>Horizon Workspace Portal 2.0 which supports SAML 2.0. Within Workspace I <br>
>have configured a web app to point to <br>
><a href="https://iometer1.kayacorp.com/EmpWeb/Shibboleth.sso/SAML2/POST" target="_top" rel="nofollow" link="external">https://iometer1.kayacorp.com/EmpWeb/Shibboleth.sso/SAML2/POST</a> as the ACS
<br>
>URL. <br>
<br>
You should really not do that, those handlers should be at the root, buf <br>
if you insist on doing that, then you're going to have to change the <br>
default handlerURL to "/EmpWeb/Shibboleth.sso". <br>
<br>
I'm not sure you want or need to do that, however. <br>
<br>
> Note that in the xml file in the MetadataProvider section I have <br>
>commented out the filter for the certificate. When I included this line <br>
>with either a crt or pem the shibd.log would would error saying the <br>
>metadata <br>
>source is not signed (the iDP does have a SAML certificate and this is <br>
>what <br>
>I exported into a pem file). <br>
<br>
How you deal with metadata is a local decision, but you need a secure <br>
source of it, and nobody else can tell you what settings to use unless <br>
you're using an existing federation that has standing practice about how <br>
to consume its metadata. <br>
<br>
If the metadata's not signed, then you'd better not be pulling it from a <br>
remote source, and you certainly can't enforce a signature over it, no. <br>
<br>
>Also, I have read through several posts about redirect loops and have <br>
>tried <br>
>playing with the cookieProps setting but keep getting the same results. <br>
>Hopefully someone can point me in the right direction here and tell me <br>
>where <br>
>I messed thing up? <br>
<br>
Loops are a wholly local matter to fix, but until you correct the major <br>
mistakes, it's not worth worrying about it much. <br>
<br>
If /Shibboleth.sso wasn't mapped at the root, you couldn't get a loop. So <br>
maybe you're just confused about that entirely. Why do you think you need <br>
to mount it below a subdirectory? You don't appear to have done that, and <br>
it doesn't appear that you need to. <br>
<br>
-- Scott <br>
<br>
-- <br>
To unsubscribe from this list send an email to <a href="x-msg://7303/user/SendEmail.jtp?type=node&node=7605204&i=0" target="_top" rel="nofollow" link="external">
[hidden email]</a> <br>
<br>
<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="1" width="100%" noshade="" style="color:#CCCCCC" align="center">
</div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:"Tahoma","sans-serif";color:#444444">If you reply to this email, your message will be added to the discussion below:<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Tahoma","sans-serif";color:#444444"><a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-browser-loops-when-attempting-to-connect-to-protected-site-tp7605202p7605204.html" target="_top" rel="nofollow" link="external">http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-browser-loops-when-attempting-to-connect-to-protected-site-tp7605202p7605204.html</a>
<o:p></o:p></span></p>
</div>
<div style="margin-top:4.8pt">
<p class="MsoNormal" style="line-height:18.0pt"><span style="font-size:8.5pt;font-family:"Tahoma","sans-serif";color:#666666">To unsubscribe from Shibboleth SP browser loops when attempting to connect to protected site,
<a href="x-msg://7303/" target="_top" rel="nofollow" link="external">click here</a>.<br>
<a href="http://shibboleth.1660669.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml" target="_top" rel="nofollow" link="external"><span style="font-size:7.0pt;font-family:"Times New Roman","serif"">NAML</span></a>
<o:p></o:p></span></p>
</div>
</div>
<br>
<hr align="left" width="300">
View this message in context: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-browser-loops-when-attempting-to-connect-to-protected-site-tp7605202p7605207.html">
RE: Shibboleth SP browser loops when attempting to connect to protected site</a><br>
Sent from the <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html">
Shibboleth - Users mailing list archive</a> at <a href="http://Nabble.com">Nabble.com</a>.<br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</div>
<br>
</div>
</body>
</html>