<div dir="ltr"><div>Back on this subject again - I thought I had found an acceptable solution but it is turning out to be a performance bottleneck as I scale my system because all web service requests go through Shib.<br></div>To recap my problem: I'm using Lighttpd with shibauthorizer/responder. Users authenticate by browsing to <a href="https://hostname/autheticate">https://hostname/autheticate</a> which works fine. I need to access shib attributes from https//hostname/service. The Requesmapper below doesn't work for me in Lighttpd. <br><br><br><pre style="white-space:pre-wrap;color:rgb(80,0,80);margin-top:0px;padding:5px;border:0px none;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;word-wrap:normal;background-color:rgb(238,238,238)"><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;white-space:normal"><pre style="white-space:pre-wrap;color:rgb(80,0,80);margin-top:0px;padding:5px;border:0px none;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;word-wrap:normal"><code style="margin:0px;padding:0px;border:0px none;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;white-space:inherit"><RequestMapper type="Native">
<RequestMap applicationId="default" exportStdVars="true">
<Host name="hostname</code><code style="margin:0px;padding:0px;border:0px none;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;white-space:inherit">"</code><code style="margin:0px;padding:0px;border:0px none;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;white-space:inherit"></code><code style="margin:0px;padding:0px;border:0px none;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;white-space:inherit"> </code>authType="shibboleth<span style="white-space:inherit">></span></pre><pre style="white-space:pre-wrap;color:rgb(80,0,80);margin-top:0px;padding:5px;border:0px none;font-size:13px;overflow:auto;width:auto;max-height:600px;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;word-wrap:normal"><code style="margin:0px;padding:0px;border:0px none;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;white-space:inherit"> <Path name="authenticate" authType="shibboleth" requireSession="true" <span class="">exportAssertion</span>="true"/>
</Host>
</RequestMap>
</RequestMapper></code></pre></div></pre><br>I suppose it's because in Lighttpd one has to specifically set fastcgi authrorizer path to
/authenticate which seems to be the only way for Shib to intercept the
sesssion and based on RequestMapper requireSession attribute do a
redirect to IdP. Simply adding authType="shibboleth" to Host section of
Requestmapper as above doesn't make the attribute appear in /service or even in "/" because Shib knows nothing about that path. Is my understanding
correct and there is no practical way to export assertions to a path
that Shibauthorizer knows nothing about (via shibauthorizer fcgi) or my understanding is wrong and
there is a way around this.<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 17, 2015 at 5:45 PM, Guy Tadi <span dir="ltr"><<a href="mailto:tadiguy812@gmail.com" target="_blank">tadiguy812@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks. That was helpful. I had tried that earlier and it didn't work, but after your response above I decided to try it again. Of course it still didn't work, but then it struck me there might be something else wrong and indeed it was my webserver config. All is well now. Thanks a million.</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 17, 2015 at 4:58 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>> I'm still unclear about this. If I change my RequestMapper to<br>
> <Path authType="shibboleth" /> I get a configuration error.<br>
<br>
</span>I didn't say to do that, and that isn't valid, Paths require names. If you want to attach settings to a Host, you put it in the Host element.<br>
<span><br>
> I thought requireSession="true" is needed to trigger SP and get assertion<br>
> from IdP.<br>
<br>
</span>If you want to trigger a session for /secure, then do that. You asked how to get the data visible for other content, and the answer is to attach the authType setting to *that* content. With or without requireSession being set, any existing session will be processed and exported for that request.<br>
<span><br>
> Using my current configuration below can you please clarify a bit which<br>
> values to use for each attribute and which ones, if any, I should remove<br>
> completely?<br>
<br>
</span>Add authType to the Host. If that doesn't work, then I'm not remembering the code well enough and would have to go do some checking.<br>
<div><div><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>