<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Texte de bulles Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.TextedebullesCar
{mso-style-name:"Texte de bulles Car";
mso-style-priority:99;
mso-style-link:"Texte de bulles";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’m trying to get a php application to use shibboleth SP for authentication.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I have installed Shibboleth SP (2.5) on the apche http server.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">It is configured to work my my IdP.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I have configured a fake “/secure” URL which required shibboleth authentication.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">When I call the URL, I get properly redirected to the IdP, I then authenticate and get redirected to my URL and thus get a 404 error, which is the expected behavior because the page does not exist.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Now if I just change the configuration to protect not just that dummy test URL but the actual application, I then get an “Http/1.1 Service Unavailable” when I try to connect to the application (I don’t even get redirected
to the IdP). When apache is not configured to require shibboleth authentication, the application works properly, it does not yet include the code to use the attribute provided by shibboleth sp, so I would expect no change in the application behavior when protected
by shibboleth SP.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Here’s my apache shibboleth config :<o:p></o:p></span></p>
<p class="MsoNormal"><i><span lang="EN-US"><Location /><o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> AuthType shibboleth<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> Require shibboleth<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> #mode lazy session<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> ShibRequestSetting requireSession 0<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"># ShibRequestSetting requireSession 1<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"># ShibRequestSetting applicationId default<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"># require valid-user<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"># require shibboleth<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> ShibUseHeaders Off<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"></Location><o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"><o:p> </o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"><Location /secure><o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> AuthType shibboleth<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> ShibRequestSetting requireSession 1<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> ShibRequestSetting applicationId default<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> require valid-user<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> ShibUseHeaders Off<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"></Location><o:p></o:p></span></i></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The problem occurs if I change /secure by /medecin (the actual application path) or if I try to enable requireSession on /<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I can’t see anything in the logs to explain this issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Does anybody know what could lead to this behavior ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thank you.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Frederic JEAN<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<PRE>_________________________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
</PRE></body>
</html>