<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
This weekend I located some issues with the SP metadata (http instead of https on some of the handler entries) but when that was corrected it still did not fix the looping. I've checked screenshots of the IdP's settings page for my SP, and I can't detect any
issues with his settings.
<div><br>
</div>
<div>So today we went through and examined every bit of the network requests and cookies from a login attempt. </div>
<div><br>
</div>
<div>We didn't find any smoking guns until we changed the relayState setting to "cookie" and inspected the value of the cookie. It turns out there is alway a double slash after the "content" part of the path:</div>
<div><br>
</div>
<div> <a href="https://proxyserver.com/content">https://proxyserver.com/content</a><b>//</b>whatever</div>
<div><br>
</div>
<div>for example: </div>
<div><br>
</div>
<div> <a href="https://proxyserver.com/content//Shibboleth.sso">https://proxyserver.com/content//Shibboleth.sso</a></div>
<div><br>
</div>
<div> <a href="https://proxyserver.com/content//mycontent.htm">https://proxyserver.com/content//mycontent.htm</a></div>
<div><br>
</div>
<div>There are absolutely no trailing slashes after the word "content" in shibboleth2.xml. </div>
<div><br>
</div>
<div><br>
</div>
<div>I am thinking this has something to do with the reverse proxy mapping settings or with my IIS settings. So I have two questions: </div>
<div><br>
</div>
<div>A. Do you think the extra slash in path in the cookie value might cause the looping problem? </div>
<div><br>
</div>
<div>B. Where would you start to look for the cause?</div>
<div><br>
</div>
<div> </div>
<div>Thanks for your help, </div>
<div><br>
</div>
<div>Ellen</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
<div>
<div>On Aug 22, 2014, at 7:08 PM, Cantor, Scott wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div>On 8/22/14, 4:30 PM, "Meiselman, Ellen" <<a href="mailto:emeiselm@med.umich.edu">emeiselm@med.umich.edu</a>> wrote:<br>
<blockquote type="cite"><br>
</blockquote>
<blockquote type="cite">I need help with the best practice for debugging the looping behavior.<br>
</blockquote>
<blockquote type="cite">I'm not sure what to look for in particular.<br>
</blockquote>
<br>
Step 0: Check all logs and rule out the cookie being sent at the end but<br>
the session being invalidated for some reason. Assuming no sign of that,<br>
the cookie's not sent.<br>
<br>
Step 1: Read, and fully grasp, the flows and cookies used [1].<br>
<br>
Step 2: Trace all the traffic and find the spot where the cookie is<br>
dropped.<br>
<br>
-- Scott<br>
<br>
[1] <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig">
https://wiki.shibboleth.net/confluence/display/SHIB2/FlowsAndConfig</a><br>
<br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</div>
</blockquote>
</div>
<br>
______________________________<br>
Ellen Meiselman<br>
University of Michigan Health System<br>
MLearning<br>
NCRC<br>
2800 Plymouth Rd. <br>
Building 200, Rm 207<br>
Ann Arbor, MI 48109-2800<br>
E-Mail: <a href="mailto:emeiselm@umich.edu">emeiselm@umich.edu</a><br>
Phone (734) 936-2334<br>
<br>
</div>
<p>**********************************************************<br>
Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues </p></body>
</html>