<span id="mailbox-conversation"><div>
<div id="mb-reply">> Not the version you’re using but the advice probably still applies:</div>
<div id="mb-reply"><a href="http://shibboleth.net/pipermail/users/2014-April/015191.html">http://shibboleth.net/pipermail/users/2014-April/015191.html</a></div>
<div id="mb-reply"><br></div>
<div id="mb-reply">Thanks. We’re using the RHEL6 packages but it’s possible that we’re running into something similar.</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">> You cannot use packages on the wrong OS, period.</div>
<div><br></div>
<div id="mb-reply">Understood. I’ll see if packages exist for Amazon Linux and if not, will build them ourselves. Our understanding was that Amazon Linux was a variant of RHEL and that RHEL packages would work.</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">If you think rebuilding Shibboleth before trying to troubleshoot this further is the way to go, we can certainly do that.</div>
</div>
<div><br></div>
<div>> I would assume that in both cases it should log the creation of the session</div>
<div><br></div>
<div>I confirmed that in the case where it’s not working, no session is being created.</div>
<div><br></div>
<div>Here’s the shibd.log with DEBUG logging enabled for: OpenSAML.MessageDecoder, Shibboleth.Listener, Shibboleth.RequestMapper, and Shibboleth.SessionCache</div>
<div><br></div>
<div>
<div>2014-10-14 11:18:17 DEBUG Shibboleth.Listener [1]: dispatching message (default/Login::run::SAML2SI)</div>
<div id="mb-reply">2014-10-14 11:18:19 DEBUG Shibboleth.Listener [1]: dispatching message (default/Login::run::SAML2SI)</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">and here’s the Apache request log:</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">
<div>66.194.102.6 - - [14/Oct/2014:11:18:17 -0500] "GET / HTTP/1.1" 302 927 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"</div>
<div>66.194.102.6 - - [14/Oct/2014:11:18:19 -0500] "POST /Shibboleth.sso/SAML2/POST HTTP/1.1" 302 - "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"</div>
<div id="mb-reply">66.194.102.6 - - [14/Oct/2014:11:18:19 -0500] "GET /login.act HTTP/1.1" 302 925 "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36”</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">When it works, I see the following...</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">shibd.log:</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">
<div>2014-10-14 11:26:03 DEBUG Shibboleth.Listener [2]: dispatching message (default/Login::run::SAML2SI)</div>
<div>2014-10-14 11:26:05 DEBUG Shibboleth.Listener [1]: dispatching message (default/SAML2/POST)</div>
<div>2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.4</div>
<div>2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:0.9.2342.19200300.100.1.3</div>
<div>2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.42</div>
<div>2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.5.4.3</div>
<div>2014-10-14 11:26:05 INFO Shibboleth.AttributeExtractor.XML [1]: skipping unmapped SAML 2.0 Attribute with Name: urn:oid:2.16.840.1.113730.3.1.241</div>
<div>2014-10-14 11:26:05 DEBUG Shibboleth.SessionCache [1]: creating new session</div>
<div>2014-10-14 11:26:05 DEBUG Shibboleth.SessionCache [1]: storing new session...</div>
<div>2014-10-14 11:26:05 INFO Shibboleth.SessionCache [1]: new session created: ID (_<REDACTED>) IdP (https://<REDACTED>/idp/shibboleth) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (66.194.102.6)</div>
</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">Apache request log:</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">
<div>66.194.102.6 - - [14/Oct/2014:11:26:03 -0500] "GET / HTTP/1.1" 302 929 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"</div>
<div>66.194.102.6 - - [14/Oct/2014:11:26:05 -0500] "POST /Shibboleth.sso/SAML2/POST HTTP/1.1" 302 326 "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"</div>
<div>66.194.102.6 - <REDACTED>@<REDACTED> [14/Oct/2014:11:26:05 -0500] "GET / HTTP/1.1" 302 - "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36"</div>
<div id="mb-reply">66.194.102.6 - <REDACTED> <REDACTED> [14/Oct/2014:11:26:05 -0500] "GET /login.act HTTP/1.1" 302 - "https://<REDACTED>/idp/profile/SAML2/Redirect/SSO" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.101 Safari/537.36”</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">The troubling thing about this is that when the POST request is not being handled, it’s still forwarding to our app which is the one generating the /login.act redirect. Shouldn’t it immediately forward to the IdP again at that point?</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">Do I need to tweak my require here to be something other than valid-user?</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">
<div> <Location /></div>
<div> AuthType shibboleth</div>
<div> ShibRequestSetting requireSession 1</div>
<div> require valid-user</div>
<div> </Location></div>
</div>
<div id="mb-reply"><br></div>
<div id="mb-reply">So the two issues that remain when that <Location> block is left uncommented:</div>
<div id="mb-reply">
<ul><li id="mb-reply">The POST /Shibboleth.sso/SAML2/POST requests don’t appear to be handled at least according to the Shib logs.</li>
<li id="mb-reply">Even though the POST requests aren’t being handled, it appears to be passing traffic through to our app which is returning a redirect to /login.act. That request that generates another auth request with the IdP.</li>
</ul><div>Thanks!</div>
</div>
</div>
</div>
</div></span><div class="mailbox_signature"><br></div>
<br><br><div class="gmail_quote"><p>On Tue, Oct 14, 2014 at 11:38 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br></p><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><p>On 10/14/14, 11:25 AM, "Bradley Wagner" <bradley.wagner@hannonhill.com>
<br>wrote:
<br><br>>When I comment out the <Location> block, the POST request responds with
<br>>the same 302 redirect but also a _shibsession_<hash> cookie so that
<br>>subsequent GET /a-url-in-my-app is allowed because it passes the session
<br>>cookie.
<br>>
<br>>Does this still point to the POST request not being properly handled or
<br>>possibly something else? I would think that if it were not handled by
<br>>Shibboleth it wouldn¹t try to forward me to my app because I wouldn¹t be
<br>>authenticated.
<br><br>I would assume that in both cases it should log the creation of the
<br>session, in which case the problem is that Apache is doing something wrong
<br>and overwiting the response headers it's trying to set.
<br><br>>Thanks again for the help on this. It feels like something subtler than a
<br>>library mismatch but perhaps not.
<br><br>You cannot use packages on the wrong OS, period.
<br><br>-- Scott
<br><br>--
<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net
<br></p></blockquote></div><br>