<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);">hi im trying to integrate openstack keystone with testshib, stuck with the looping error any help</div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);"><br></div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);">I tried with the auto-generated shibboleth2.xml, just added the application override attribute, now im stuck with looping issue,</div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);">when i access v3/OS-FEDERATION/identity_providers/idp_2/protocols/saml2/auth for the first time it is prompting for username and password once provided it goes on loop.</div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);">i could see session generated <a href="https://115.112.68.53:5000/Shibboleth.sso/Session" target="_blank" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://115.112.68.53:5000/Shibboleth.sso/Session</a></div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);"><pre style="line-height: 22.7199993133545px;"><u style="line-height: 22.7199993133545px;">Miscellaneous</u>
<b style="line-height: 22.7199993133545px;">Client Address:</b> 121.243.33.212
<b style="line-height: 22.7199993133545px;">Identity Provider:</b> <a href="https://idp.testshib.org/idp/shibboleth" target="" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://idp.testshib.org/idp/shibboleth</a>
<b style="line-height: 22.7199993133545px;">SSO Protocol:</b> urn:oasis:names:tc:SAML:2.0:protocol
<b style="line-height: 22.7199993133545px;">Authentication Time:</b> 2015-03-04T06:44:41.625Z
<b style="line-height: 22.7199993133545px;">Authentication Context Class:</b> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
<b style="line-height: 22.7199993133545px;">Authentication Context Decl:</b> (none)
<b style="line-height: 22.7199993133545px;">Session Expiration (barring inactivity):</b> 479 minute(s)
<u style="line-height: 22.7199993133545px;">Attributes</u>
<b style="line-height: 22.7199993133545px;">affiliation</b>: Member@testshib.org;Staff@testshib.org
<b style="line-height: 22.7199993133545px;">entitlement</b>: urn:mace:dir:entitlement:common-lib-terms
<b style="line-height: 22.7199993133545px;">eppn</b>: myself@testshib.org
<b style="line-height: 22.7199993133545px;">persistent-id</b>: <a href="https://idp.testshib.org/idp/shibboleth!https://115.112.68.53/shibboleth!4Q6X4dS2MRhgTZOPTuL9ubMAcIM=" target="" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://idp.testshib.org/idp/shibboleth!https://115.112.68.53/shibboleth!4Q6X4dS2MRhgTZOPTuL9ubMAcIM=</a>
<b style="line-height: 22.7199993133545px;">unscoped-affiliation</b>: Member;Staff</pre><pre style="line-height: 22.7199993133545px;"><font face="Calibri,sans-serif" size="3" style="line-height: normal;"><span style="line-height: 22.7199993133545px; font-size: 12pt;">here are my config files,</span></font></pre></div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);"><div style="line-height: 22.7199993133545px;"><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="1800"></div><div style="line-height: 22.7199993133545px;"> <ApplicationDefaults entityID="<a href="https://115.112.68.53/shibboleth" target="" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://115.112.68.53/shibboleth</a>" REMOTE_USER="eppn"></div><div style="line-height: 22.7199993133545px;"> <Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="true" handlerSSL="true" cookieProps="; path=/; secure"></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> <SSO entityID="<a href="https://idp.testshib.org/idp/shibboleth" target="" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://idp.testshib.org/idp/shibboleth</a>"></div><div style="line-height: 22.7199993133545px;"> SAML2 SAML1</div><div style="line-height: 22.7199993133545px;"> </SSO></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> <Logout>SAML2 Local</Logout></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/></div><div style="line-height: 22.7199993133545px;"> <Handler type="Status" Location="/Status"/></div><div style="line-height: 22.7199993133545px;"> <Handler type="Session" Location="/Session" showAttributeValues="true"/></div><div style="line-height: 22.7199993133545px;"> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/></div><div style="line-height: 22.7199993133545px;"> </Sessions></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> <Errors supportContact="root@localhost" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/></div><div style="line-height: 22.7199993133545px;"> <MetadataProvider type="XML" uri="<a href="https://www.testshib.org/metadata/testshib-providers.xml" target="" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://www.testshib.org/metadata/testshib-providers.xml</a>"</div><div style="line-height: 22.7199993133545px;"> backingFilePath="/tmp/testshib-two-idp-metadata.xml"</div><div style="line-height: 22.7199993133545px;"> reloadInterval="180000" /></div><div style="line-height: 22.7199993133545px;"> <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/></div><div style="line-height: 22.7199993133545px;"> <AttributeResolver type="Query" subjectMatch="true"/></div><div style="line-height: 22.7199993133545px;"> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/></div></div><div style="line-height: 22.7199993133545px; color: rgb(68, 68, 68); font-family: Calibri; background-color: rgb(255, 255, 255);"><div style="line-height: 22.7199993133545px;"> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/></div><div style="line-height: 22.7199993133545px;"> <ApplicationOverride id="idp_2" entityID="<a href="https://115.112.68.53/shibboleth" target="" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://115.112.68.53/shibboleth</a>"></div><div style="line-height: 22.7199993133545px;"> <!--Sessions lifetime="28800" timeout="3600" checkAddress="false"</div><div style="line-height: 22.7199993133545px;"> relayState="ss:mem" handlerSSL="false"--></div><div style="line-height: 22.7199993133545px;"> <Sessions lifetime="28800" timeout="3600" checkAddress="false"</div><div style="line-height: 22.7199993133545px;"> relayState="ss:mem" handlerSSL="true" cookieProps="; path=/; secure"></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> <!-- Triggers a login request directly to the TestShib IdP. --></div><div style="line-height: 22.7199993133545px;"> <SSO entityID="<a href="https://idp.testshib.org/idp/shibboleth" target="" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://idp.testshib.org/idp/shibboleth</a>" ECP="true"></div><div style="line-height: 22.7199993133545px;"> SAML2 SAML1</div><div style="line-height: 22.7199993133545px;"> </SSO></div><div style="line-height: 22.7199993133545px;"> <Logout>SAML2 Local</Logout></div><div style="line-height: 22.7199993133545px;"> </Sessions></div><div style="line-height: 22.7199993133545px;"> <MetadataProvider type="XML" uri="<a href="https://www.testshib.org/metadata/testshib-providers.xml" target="" style="line-height: 22.7199993133545px; font-weight: inherit; color: rgb(0, 104, 207); cursor: pointer;">https://www.testshib.org/metadata/testshib-providers.xml</a>"</div><div style="line-height: 22.7199993133545px;"> backingFilePath="/tmp/testshib-two-idp-metadata.xml"</div><div style="line-height: 22.7199993133545px;"> reloadInterval="180000" /></div><div style="line-height: 22.7199993133545px;"> </ApplicationOverride></div><div style="line-height: 22.7199993133545px;"> </ApplicationDefaults></div><div style="line-height: 22.7199993133545px;"> <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/></div><div style="line-height: 22.7199993133545px;"> <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/></div><div style="line-height: 22.7199993133545px;"><div style="line-height: 22.7199993133545px;"></SPConfig></div></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;">keystone-httpd</div><div style="line-height: 22.7199993133545px;"><div style="line-height: 22.7199993133545px;">WSGIDaemonProcess keystone user=keystone group=nogroup processes=3 threads=10</div><div style="line-height: 22.7199993133545px;">#WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /var/www/keystone/main/$1</div><div style="line-height: 22.7199993133545px;">WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /var/www/cgi-bin/keystone/main/$1</div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"><VirtualHost *:5000></div><div style="line-height: 22.7199993133545px;"> LogLevel info</div><div style="line-height: 22.7199993133545px;"> ErrorLog /var/log/keystone/keystone-apache-error.log</div><div style="line-height: 22.7199993133545px;"> CustomLog /var/log/keystone/ssl_access.log combined</div><div style="line-height: 22.7199993133545px;"> Options +FollowSymLinks</div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> SSLEngine on</div><div style="line-height: 22.7199993133545px;"> #SSLCertificateFile /etc/ssl/certs/mycert.pem</div><div style="line-height: 22.7199993133545px;"> #SSLCertificateKeyFile /etc/ssl/private/mycert.key</div><div style="line-height: 22.7199993133545px;"> SSLCertificateFile /etc/apache2/ssl/server.crt</div><div style="line-height: 22.7199993133545px;"> SSLCertificateKeyFile /etc/apache2/ssl/server.key</div><div style="line-height: 22.7199993133545px;"> SSLVerifyClient optional</div><div style="line-height: 22.7199993133545px;"> SSLVerifyDepth 10</div><div style="line-height: 22.7199993133545px;"> SSLProtocol all -SSLv2</div><div style="line-height: 22.7199993133545px;"> SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW</div><div style="line-height: 22.7199993133545px;"> SSLOptions +StdEnvVars +ExportCertData</div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> WSGIScriptAlias / /var/www/cgi-bin/keystone/main</div><div style="line-height: 22.7199993133545px;"> WSGIProcessGroup keystone</div><div style="line-height: 22.7199993133545px;"></VirtualHost></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"><VirtualHost *:35357></div><div style="line-height: 22.7199993133545px;"> LogLevel info</div><div style="line-height: 22.7199993133545px;"> ErrorLog /var/log/keystone/keystone-apache-error.log</div><div style="line-height: 22.7199993133545px;"> CustomLog /var/log/keystone/ssl_access.log combined</div><div style="line-height: 22.7199993133545px;"> Options +FollowSymLinks</div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> SSLEngine on</div></div><div style="line-height: 22.7199993133545px;"><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> SSLEngine on</div><div style="line-height: 22.7199993133545px;"> #SSLCertificateFile /etc/ssl/certs/mycert.pem</div><div style="line-height: 22.7199993133545px;"> #SSLCertificateKeyFile /etc/ssl/private/mycert.key</div><div style="line-height: 22.7199993133545px;"> SSLCertificateFile /etc/apache2/ssl/server.crt</div><div style="line-height: 22.7199993133545px;"> SSLCertificateKeyFile /etc/apache2/ssl/server.key</div><div style="line-height: 22.7199993133545px;"> SSLVerifyClient optional</div><div style="line-height: 22.7199993133545px;"> SSLVerifyDepth 10</div><div style="line-height: 22.7199993133545px;"> SSLProtocol all -SSLv2</div><div style="line-height: 22.7199993133545px;"> SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW</div><div style="line-height: 22.7199993133545px;"> SSLOptions +StdEnvVars +ExportCertData</div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"> WSGIScriptAlias / /var/www/cgi-bin/keystone/admin</div><div style="line-height: 22.7199993133545px;"> WSGIProcessGroup keystone</div><div style="line-height: 22.7199993133545px;"></VirtualHost></div></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;">wsgi-keystone</div><div style="line-height: 22.7199993133545px;"><div style="line-height: 22.7199993133545px;">WSGIScriptAlias /keystone/main /var/www/cgi-bin/keystone/main</div><div style="line-height: 22.7199993133545px;">WSGIScriptAlias /keystone/admin /var/www/cgi-bin/keystone/admin</div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"><Location "/keystone"></div><div style="line-height: 22.7199993133545px;"># NSSRequireSSL</div><div style="line-height: 22.7199993133545px;">SSLRequireSSL</div><div style="line-height: 22.7199993133545px;">Authtype none</div><div style="line-height: 22.7199993133545px;"></Location></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"><Location /Shibboleth.sso></div><div style="line-height: 22.7199993133545px;"># SetHandler shib</div><div style="line-height: 22.7199993133545px;"> Require all granted</div><div style="line-height: 22.7199993133545px;"></Location></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"><Location /v3/OS-FEDERATION/identity_providers/idp_1/protocols/saml2/auth></div><div style="line-height: 22.7199993133545px;"> ShibRequestSetting requireSession 1</div><div style="line-height: 22.7199993133545px;"> ShibRequestSetting applicationId idp_1</div><div style="line-height: 22.7199993133545px;"> AuthType shibboleth</div><div style="line-height: 22.7199993133545px;"> ShibRequireAll On</div><div style="line-height: 22.7199993133545px;"> ShibRequireSession On</div><div style="line-height: 22.7199993133545px;"> ShibExportAssertion Off</div><div style="line-height: 22.7199993133545px;"> Require valid-user</div><div style="line-height: 22.7199993133545px;"></Location></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;"><Location /v3/OS-FEDERATION/identity_providers/idp_2/protocols/saml2/auth></div><div style="line-height: 22.7199993133545px;"> ShibRequestSetting requireSession 1</div><div style="line-height: 22.7199993133545px;"> ShibRequestSetting applicationId idp_2</div><div style="line-height: 22.7199993133545px;"> AuthType shibboleth</div><div style="line-height: 22.7199993133545px;"> ShibRequireAll On</div><div style="line-height: 22.7199993133545px;"> ShibRequireSession On</div><div style="line-height: 22.7199993133545px;"> ShibExportAssertion Off</div><div style="line-height: 22.7199993133545px;"> Require valid-user</div></div><div style="line-height: 22.7199993133545px;"><div style="line-height: 22.7199993133545px;"></Location></div></div><div style="line-height: 22.7199993133545px;"><br style="line-height: 22.7199993133545px;"></div><div style="line-height: 22.7199993133545px;">Regards,</div><div style="line-height: 22.7199993133545px;">Akshik</div></div></div> </div></body>
</html>