<div dir="ltr"><div>I'm attempting to use mod_shib to provide with SSO for an application that is running in a tomcat container. There's an Apache server, running as a reverse proxy, in front of the Tomcat container.</div><div><br></div><div>I set up mod_shib with the following proprities in shibboleth2.xml:</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><br><ApplicationDefaults entityID="myapp-sp"<br>                         REMOTE_USER="eppn persistent-id targeted-id"><br>...<br><SSO entityID="ssg-idp"><br>  SAML2 SAML1<br></SSO><br>...<br><MetadataProvider type="XML" file="/etc/shibboleth/metadata/SAM-metadata.xml"/></blockquote><div> </div><div>Here's my apache2 conf for this vhost:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><VirtualHost *:80><br>        ServerName <a href="http://server.com" target="_blank">server.com</a><br>        UseCanonicalName on<br><br>        ProxyPreserveHost On<br>        ProxyPass /myapp <a href="http://localhost:8080/myapp" target="_blank">http://localhost:8080/myapp</a><br>        ProxyPassReverse /myapp <a href="http://localhost:8080/myapp" target="_blank">http://localhost:8080/myapp</a><br>        LogLevel debug<br>        ErrorLog ${APACHE_LOG_DIR}/myapp.error.log<br>        CustomLog ${APACHE_LOG_DIR}/myapp.access.log combined<br></VirtualHost><br><Location /Shibboleth.sso>  <br>    SetHandler shib<br></Location><br><Location /myapp><br>    ShibRequestSetting requireSession 1<br>    AuthType shibboleth<br>    ShibExportAssertion Off<br>    Require valid-user<br></Location></blockquote><div>If I navigate to <a href="http://server.com/myapp" target="_blank">server.com/myapp</a>, I'm redirected to the IDP login page. I used a tracer to identify what's going on and it seems as though the IDP redirects me to make a POST request to <a href="http://server.com/Shibboleth.sso/SAML/POST" target="_blank">http://server.com/Shibboleth.sso/SAML/POST</a> with the following SAML assertion:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><?xml version="1.0" encoding="UTF-8"?><br><saml2p:Response Destination="<a href="http://server.com/Shibboleth.sso/SAML/POST" target="_blank">http://server.com/Shibboleth.sso/SAML/POST</a>"<br>   ID="_stsfnerwkh_70d9842a74e3e08f16efa8c0dc12d121" InResponseTo="_70d9842a74e3e08f16efa8c0dc12d121"<br>   IssueInstant="2016-05-04T23:43:37.927Z" Version="2.0"<br>   xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><br>   <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"<br>      xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">ssg-idp</saml2:Issuer><br>   <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br>      <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/><br>         <ds:Reference URI="#_stsfnerwkh_70d9842a74e3e08f16efa8c0dc12d121"><br>            <ds:Transforms><ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></ds:Transforms><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#sha1</a>"/><br>            <ds:DigestValue>lhEjyr7or/1HiJy3B0PCwydxJ9o=</ds:DigestValue><br>         </ds:Reference><br>      </ds:SignedInfo><br>      <ds:SignatureValue>Lpy1RvtHO8G2iQIdYslN3o4GnxFzDXAwjzhdUCSqOnfQ/8jhv5Et+/APBl6Xp7xoHhfEidomOc8b7u9OrfJFl5Oac9kdWcwZs3ADqmy6rfLxkkalUXBA/f5g4tTHJl7BjTI4uwvqU5LeujMORY/dChY2lPGDgk9yI4WLgWj3P4q6BYZ3Yjh44wEzqFodwUNLVtiUn+cZXCuCDiiw6UtaZG/E4VGCngpMayp7ML8KUTnmqcLnMGfYtoJBdG0OjvJxuqhaH9DbSG6VtIMcSXSlJPKlG7Ohz/FKDFtYLAM8MKG/6CgyK61jqDgiV0jOZCsNDx+2H/2/TU9qxi4jOTpF2Q==</ds:SignatureValue><br>   </ds:Signature><br>   <saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status><br>   <saml2:Assertion ID="_7f550c02-ee46-41eb-96fc-884971e92651" IssueInstant="2016-05-04T23:43:37.928Z"<br>      Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br>      <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">ssg-idp</saml2:Issuer><br>      <ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br>         <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/><br>            <ds:Reference URI="#_7f550c02-ee46-41eb-96fc-884971e92651"><br>               <ds:Transforms><ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></ds:Transforms><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#sha1</a>"/><br>               <ds:DigestValue>TEaINCBQjk29gFzZZEW2rAMr2Jo=</ds:DigestValue><br>            </ds:Reference><br>         </ds:SignedInfo><br>         <ds:SignatureValue>Q9ympsGe9QQt1NwOnXx2zJzxkJbTCEXJ1hmDyQO8DL+KLr7wEE+6dEcbKJSzKjSRI1uiYqlrpXx2smjCf/WXA5c61HbO6bQXR8YSBcpzjWrmNtRUnJm49Nh7gUnawdp4YWrOQTfYulfbMvvzBwoEcKNNN+az/b+wQtCF/NEActAJdsyZqlPTRdGziKW2Tb8q2THoJAdSHRQQHZVoGu4npUVdhQsn8H93YhLxcz5pIBBJPBy7j2fSEEQdwzrD0bT7GK7wDXqRS5SAmpoapnVouVVCaXiJDNwDcUXx8R30RNbDAox8WSfEBXZEr58akXqaq64EHd5zY6Gusbjw4qUQcg==</ds:SignatureValue><br>      </ds:Signature><br>      <saml2:Subject><br>         <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">user_x</saml2:NameID><br>         <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="172.22.164.92"<br>            InResponseTo="_70d9842a74e3e08f16efa8c0dc12d121" NotOnOrAfter="2016-05-04T23:48:37.928Z"<br>            Recipient="<a href="http://server.com/Shibboleth.sso/SAML/POST" target="_blank">http://server.com/Shibboleth.sso/SAML/POST</a>"/></saml2:SubjectConfirmation><br>      </saml2:Subject><br>      <saml2:Conditions NotBefore="2016-05-04T23:38:37.927Z" NotOnOrAfter="2016-05-04T23:48:37.928Z"><br>         <saml2:AudienceRestriction><br>            <saml2:Audience>myapp-sp</saml2:Audience><br>         </saml2:AudienceRestriction><br>      </saml2:Conditions><br>      <saml2:AuthnStatement AuthnInstant="2016-05-04T23:43:37.927Z"<br>         SessionIndex="_7f550c02-ee46-41eb-96fc-884971e92651"><br>         <saml2:AuthnContext><br>            <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef><br>         </saml2:AuthnContext><br>      </saml2:AuthnStatement><br>   </saml2:Assertion><br></saml2p:Response></blockquote><div> </div><div>However, when looking through the shibd logs, I find the following in the transaction logs:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">2016-05-05 00:00:58 INFO Shibboleth-TRANSACTION [10]: New session (ID: ) with (applicationId: default) for principal from (IdP: none) at (ClientAddress: 172.22.164.92) with (NameIdentifier: none) using (Protocol: urn:oasis:names:tc:SAML:1.1:protocol) from (AssertionID: )<br>2016-05-05 00:00:58 INFO Shibboleth-TRANSACTION [10]: Cached the following attributes with session (ID: ) for (applicationId: default) {<br>2016-05-05 00:00:58 INFO Shibboleth-TRANSACTION [10]: }</blockquote><div><br></div><div> </div><div>It seems as though the shibd daemon receives an empty SAML assertion. I've been scratching my brain around this for quite some time. Any help would be greatly appreciated.</div></div>