<div dir="ltr">Hey guys I have been trying to figure this one out for a long time and am hoping someone can identify what I am missing. I am trying to setup shibb sp on Apache that's in-front of a jboss application. The application is expecting to see the "<span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;line-height:20px">Shib-Identity-Provider</span>" header along with some attributes from the IDP. the problem is that these headers are never present when the shibb protected path is accessed even though a session is present. the only shibboleth related header is the "_shibsession_" cookie.<div><br></div><div>the page that needs to have the headers is:</div><div><br></div><div><font face="monospace, monospace">http://<vhost</font><span style="font-family:monospace,monospace">.fqdn</span><span style="font-family:monospace,monospace">>/app1/singlesignon/SsoShibbolethService</span></div><div><br></div><div>I am using an IDP initiated url to access the site in the following format:</div><div><br></div><div><font face="monospace, monospace">http://<span style="background-color:rgb(243,243,243)"><idp_url></span>?providerid=<span style="background-color:rgb(243,243,243)"><entityID_of_Shibb_SP></span>&returnurl=<span style="background-color:rgb(243,243,243)"><Shibb_protected_Site_that_needs_headers></span></font></div><div><font face="monospace, monospace"><span style="background-color:rgb(243,243,243)"><br></span></font></div><div><font face="arial, helvetica, sans-serif">this goes to the IDP login page, credentials supplied to login, then gets redirected to the sp app site that requires the headers, but the shibb headers are never set...</font></div><div><font face="arial, helvetica, sans-serif"><br></font></div><div><font face="arial, helvetica, sans-serif">my configuration is as follows:</font></div><div><font face="arial, helvetica, sans-serif"><br></font></div><div><div><font face="monospace, monospace">/etc/shibboleth/shibboleth2.xml:</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> <ApplicationDefaults entityID="http://<vhost.fqdn>/Shibboleth"</font></div><div><font face="monospace, monospace"> REMOTE_USER="repid mail"</font></div><div><font face="monospace, monospace"> attributePrefix="AJP_"></font></div><div><font face="monospace, monospace"> <Sessions lifetime="28800"</font></div><div><font face="monospace, monospace"> timeout="3600"</font></div><div><font face="monospace, monospace"> relayState="ss:mem"</font></div><div><font face="monospace, monospace"> checkAddress="false"</font></div><div><font face="monospace, monospace"> handlerSSL="false"</font></div><div><font face="monospace, monospace"> handlerURL="/Shibboleth.sso"</font></div><div><font face="monospace, monospace"> cookieProps="http"></font></div><div><font face="monospace, monospace"> <Logout>SAML2 Local</Logout></font></div><div><font face="monospace, monospace"> <md:AssertionConsumerService Location="/SAML2/POST" index="1"</font></div><div><font face="monospace, monospace"> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/></font></div><div><font face="monospace, monospace"> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/></font></div><div><font face="monospace, monospace"> <Handler type="Status" Location="/Status"/></font></div><div><font face="monospace, monospace"> <Handler type="Session" Location="/Session" showAttributeValues="true"/></font></div><div><font face="monospace, monospace"> </Sessions></font></div></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">/etc/shibboleth/attribute-map.xml (just the repid attribute shown):<br></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> <Attribute id="repid" name="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName" /><br></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">/etc/httpd/conf/extra/httpd-default.conf:<br></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"><div>UseCanonicalName Off<br></div><div>Include /etc/httpd/conf/shib.conf<br></div><div><LocationMatch "/app1/singlesignon/*" ><br></div><div> AuthType shibboleth</div><div> ShibCompatWith24 on</div><div> ShibRequestSetting requireSession 1</div><div> ShibUseHeaders on</div><div> require valid-user</div><div></LocationMatch></div><div>Include /etc/httpd/conf/mod_jk.conf<br></div></font></div><div><font face="monospace, monospace"><br></font></div><div>when i access <font face="monospace, monospace">http://<vhost</font><span style="font-family:monospace,monospace">.fqdn</span><span style="font-family:monospace,monospace">>/Shibboleth.sso/Session </span><font face="arial, helvetica, sans-serif">i get:</font></div><div><font face="arial, helvetica, sans-serif"><br></font></div><div><pre style="color:rgb(0,0,0)"><u>Miscellaneous</u>
<strong>Session Expiration (barring inactivity):</strong> 24 minute(s)
<strong>Client Address:</strong> 10.10.42.211
<strong>SSO Protocol:</strong> urn:oasis:names:tc:SAML:2.0:protocol
<strong>Identity Provider:</strong> http://<idp_url>:7499/fed/idp
<strong>Authentication Time:</strong> 2015-04-24T15:54:16Z
<strong>Authentication Context Class:</strong> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
<strong>Authentication Context Decl:</strong> (none)
<u>Attributes</u>
<strong>repid</strong>: 50001</pre></div><div><font face="monospace, monospace"><br></font></div><div><font face="arial, helvetica, sans-serif">but repid and the default shibboleth headers like </font>"<span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;line-height:20px">Shib-Identity-Provider</span>" are not present after the redirect to <font face="monospace, monospace">http://<vhost</font><span style="font-family:monospace,monospace">.fqdn</span><span style="font-family:monospace,monospace">>/app1/singlesignon/SsoShibbolethService</span></div><div><font face="monospace, monospace"><br></font></div><div><font face="arial, helvetica, sans-serif">any ideas what i am missing???</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"><br></font></div></div>