<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div>Hi all,</div><div><br></div><div>I need to install an environment which use shibboleth authentification. To do this I want to test my Shibboleth SP which testshib.org tools. </div><div><div id="gt-src-tools"><div id="gt-src-tools-l"></div></div><div id="gt-input-tool" style="display: inline-block;"><div id="itamenu"><span class="ita-kd-inputtools-div"></span></div></div><div id="gt-src-c" class="g-unit"><div id="gt-src-p"><div class="" id="gt-src-wrap"><div id="gt-src-tools"><div id="gt-src-tools-r"></div></div></div></div></div><div id="gt-res-c" class="g-unit"><div id="gt-res-p"><div id="gt-res-data"><div id="gt-res-wrap"><div id="gt-res-content" class="almost_half_cell"><div dir="ltr" style="zoom: 1;"><div id="tts_button">Unfortunately, the test don’t work. When I join the URL myhost.org/secure i’m never redirect.</div><div id="tts_button">I’m on CentOS 6.6 server with apache 2.2 and Shibboleth SP 2.5.4. </div><div id="tts_button"><br></div><div id="tts_button">I copy the shibboleth2.xml generates with tools of testshib.org using the hostname « lea-preprod.hautenormandie.fr ».</div><div id="tts_button">My apache configuration is the following. </div><div id="tts_button">A first virtual host get the http request on host name lea-preprod.hautenormandie.fr to https. I don’t have any shibboleth specific configuration on it, I’m sure it works.</div><div id="tts_button">The configuration for ssl host must be interesting, it’s combine the configuration of my application and part of shibboleth configuration :</div><div id="tts_button"><br></div><div id="tts_button"><p style="font-family: Menlo; font-size: 11px; margin: 0px;"><VirtualHost *:443></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> ServerAdmin <a href="mailto:alexandre.lefevre@pentila.com">alexandre.lefevre@pentila.com</a></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> ServerName lea-preprod.hautenormandie.fr</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> DocumentRoot /var/www</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> ErrorDocument 503 "/erreur_503.html"</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> RewriteEngine On</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> RewriteCond %{HTTP_HOST} !^lea-preprod\.hautenormandie\. [NC]</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> RewriteRule ^(.*)$ <a href="https://lea-preprod.hautenormandie.fr/$1">https://lea-preprod.hautenormandie.fr/$1</a> [L,R=301]</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> # RewriteRule du serveur CAS pour rediriger vers l'interne!!!!</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> RewriteRule ^/cas/(.*) <a href="https://lea-preprod.hautenormandie.fr/c/portal/cas/$1">https://lea-preprod.hautenormandie.fr/c/portal/cas/$1</a> [P,L]</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Include conf/proxy.conf</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Include conf/mod_auth_cas.conf</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> <Location /cas/></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Allow from all</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Satisfy any</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> </Location></p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> #SSL Default configuration</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> SSLEngine on</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> SSLCertificateFile<span class="Apple-tab-span" style="white-space: pre;"> </span>conf/ssl.crt/lea-hautenormandie-fr.crt</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> SSLCertificateKeyFile conf/ssl.key/lea-hautenormandie-fr.pem</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> SSLCertificateChainFile conf/ssl.crt/GlobalSignOrganizationValidationCA-G2.crt</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> #RequestHeader SET ENT_PORTEUR CRHN</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> RequestHeader SET ENT_PORTEUR DEMO</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JkMount /jkstatus jkstatus</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> #JkMountCopy On</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKMount /cas lb_auth</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKMount /cas/* lb_auth</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKMount / nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKMount /* nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKUnMount /index.html nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKUnMount /img/* nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JkUnMount /Shibboleth.sso nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JkUnMount /Shibboleth.sso/* nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JkUnMount /wayf nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JkUnMount /wayf/* nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKUnMount /secure nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKUnMount /secure/* nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKUnMount /error nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JKUnMount /error/* nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JkUnMount /SWITCHaai nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> JkUnMount /SWITCHaai/* nerolb</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> ################</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> # Conf du WAYF #</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> ################</p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> <Files WAYF></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> ForceType application/x-httpd-php</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> #AddHandler fcgid-script .php</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> #FCGIWrapper /usr/lib/cgi-bin/php5 .php</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> #Options ExecCGI</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> </Files></p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Alias /wayf /usr/local/SWITCHwayf</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Alias /SWITCHaai/images /usr/local/SWITCHwayf/images</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> # SHIB</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"><span class="Apple-tab-span" style="white-space: pre;"> </span><Location /Shibboleth.sso></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> SetHandler shib</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> </Location></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> <Location /></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> AuthType shibboleth</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Require valid-user</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> </Location></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> <LocationMatch "^/(?!zimbraAdmin|piwik|wayf|index.html)"></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> AuthType shibboleth</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> require shibboleth</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> ShibUseHeaders On</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> ShibRequestSetting requireSession 0</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> </LocationMatch></p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> RewriteEngine on</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> <Proxy *></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Order deny,allow</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> Allow from all</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> </Proxy></p><p style="font-family: Menlo; font-size: 11px; margin: 0px; min-height: 13px;"><br></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"> SSLProxyEngine on</p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"></VirtualHost></p><p style="font-family: Menlo; font-size: 11px; margin: 0px;"><br></p><p style="margin: 0px;">Moreover i have the file a apache22.config from shibboleth which is include in my httpd.conf: </p><p style="margin: 0px;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so</p><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">#</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"># Ensures handler will be accessible.</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">#</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><Location /Shibboleth.sso></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"> Satisfy Any</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"> Allow from all</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"></Location></p><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">#</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"># Used for example style sheet in error templates.</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">#</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><IfModule mod_alias.c></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"> <Location /shibboleth-sp></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"> Satisfy Any</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"> Allow from all</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"> </Location></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"> Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css</p><p style="margin: 0px;"></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"></IfModule></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></p><p style="margin: 0px;">Some part of my httpd.conf file where i’m configuring some stuff usefull for shibboleth sp(e.g. : <span style="font-family: Menlo; font-size: 11px;">UseCanonicalName)</span> :</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">ServerRoot /etc/httpd/</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">ServerName lea-preprod.hautenormandie.fr</p><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"># pour ecouter sur 178.33.128.123 et 192.168.0.10</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">Listen *:80</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">Listen *:443</p><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">User apache</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">Group web</p><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">ServerTokens Prod</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">ServerSignature Off</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">Header set Server "ws"</p><p style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">HostnameLookups Off</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">UseCanonicalName On</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">NameVirtualHost *:443</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">Include conf.d/*.conf #my Vhosts</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"></p><p style="margin: 0px; font-size: 11px; font-family: Menlo;">Include /etc/shibboleth/apache22.config</p><p style="margin: 0px; font-size: 11px; font-family: Menlo;"><br></p><p style="margin: 0px;">If you need more stuff to help, claim me them. </p><p style="margin: 0px;"><br></p><p style="margin: 0px;">Best regards,</p></div></div></div></div></div></div></div></div><div><p class="p3" style="font-family: Calibri; margin: 0px;">Alexandre Lefèvre </p></div><div><br></div></body></html>