<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">We have two PeopleSoft sites running on IIS, one for HCM and one for CS. Each site has a distinct FQDN and has been configured as a distinct Shibboleth SP for a little over a year and this has been a very successful integration for us.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Recently a project was initiated to implement a feature of HCM that must be made available through the CS interface. To accomplish this, a Content Reference (CREF) was created in a test environment to pull the HCM content into CS. Unfortunately
I don’t know much about CREFs at this point, but I think of them something like an iframe (sample below). Unfortunately this configuration has presented some challenges regarding the configuration of our SPs for these environments. When an authenticated user
enters a page in CS that contains a CREF referencing HCM, most elements of the protected page appear fine but the IdP logon page appears in the portion of the page that should display the HCM content, and native.log reports “Attempt to spoof header (HTTP_SHIBSESSIONID:)
was detected.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The only way I’ve been able to get the CREF elements to function is by modifying the SP configuration for HCM to set checkSpoofing="false" and the RequestMap to requireSession="false" for the few query string parameters I’ve identified
that trigger the spoof prevention. However, this is not a configuration I feel comfortable moving to production.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been unable to find details about the exact behavior of the checkSpoofing feature of the SP and what exactly causes it to trigger, and I’m finding it difficult to troubleshoot the problem. Setting REMOTE_ADDR="X-Forwarded-For" on both
SPs and then on each of them independently does not appear to change the behavior of the problem, although I’ve confirmed the source IP is available to the SP in that configuration. I need advice on how to troubleshoot the problem and determine exactly what
causes the spoof protection to fire. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">==========<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">native.log<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">==========<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/psc/hcmdev/EMPLOYEE/PONY/c/ROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL?NAVSTACK=Clear&a=a&PORTALPARAM_PTCNAV=HC_EP_CURRENT_MY_PRF_EE_GBL&EOPP.SCNode=HRMS&EOPP.SCPortal=EMPLOYEE&EOPP.SCName=CO_EMPLOYEE_SELF_SERVICE&EOPP.SCLabel=My%20Performance%20Documents&EOPP.SCFName=HC_EP_MY_PRF_DOCS_EE_GBL&EOPP.SCSecondary=true&EOPP.SCPTfname=HC_EP_MY_PRF_DOCS_EE_GBL&FolderPath=PORTAL_ROOT_OBJECT.CO_EMPLOYEE_SELF_SERVICE.HC_EP_EE_SELF_SERVICE_GBL.HC_EP_MY_PRF_DOCS_EE_GBL.HC_EP_CURRENT_MY_PRF_EE_GBL&IsFolder=false&PortalActualURL=https%3a%2f%2fhcmtestsite.university.edu%2fpsc%2fhcmdev%2fEMPLOYEE%2fPONY%2fc%2fROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL%3fNAVSTACK%3dClear%26a%3da&PortalContentURL=https%3a%2f%2fhcmtestsite.university.edu%2fpsc%2fhcmdev%2fEMPLOYEE%2fPONY%2fc%2fROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL%3fNAVSTACK%3dClear%26a%3da&PortalContentProvider=PONY&PortalCRefLabel=Current%20Documents&PortalRegistryName=EMPLOYEE&PortalServletURI=https%3a%2f%2fcstestsite.university.edu%2fpsp%2fcsdev%2f&PortalURI=https%3a%2f%2fcstestsite.university.edu%2fpsc%2fcsdev%2f&PortalHostNode=HRMS&NoCrumbs=yes&PortalKeyStruct=yes
to default<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: sending message (default::getHeaders::Application)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: trying to connect to listener<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: socket (832) connected successfully<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: send completed, reading response message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.SessionInitiator.SAML2 [2692] isapi_shib: attempting to initiate session using SAML 2.0 with provider (https://idp.university.net/idp/shibboleth)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: sending message (default/Login::run::SAML2SI)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib: send completed, reading response message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/Shibboleth.sso/SAML2/POST to default<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.ISAPI [2692] isapi_shib_extension: mapped https://hcmtestsite.university.edu/Shibboleth.sso/SAML2/POST to default<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib_extension: sending message (default/SAML2/POST)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:52 DEBUG Shibboleth.Listener [2692] isapi_shib_extension: send completed, reading response message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/psc/hcmdev/EMPLOYEE/PONY/c/ROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL?NAVSTACK=Clear&a=a&PORTALPARAM_PTCNAV=HC_EP_CURRENT_MY_PRF_EE_GBL&EOPP.SCNode=HRMS&EOPP.SCPortal=EMPLOYEE&EOPP.SCName=CO_EMPLOYEE_SELF_SERVICE&EOPP.SCLabel=My%20Performance%20Documents&EOPP.SCFName=HC_EP_MY_PRF_DOCS_EE_GBL&EOPP.SCSecondary=true&EOPP.SCPTfname=HC_EP_MY_PRF_DOCS_EE_GBL&FolderPath=PORTAL_ROOT_OBJECT.CO_EMPLOYEE_SELF_SERVICE.HC_EP_EE_SELF_SERVICE_GBL.HC_EP_MY_PRF_DOCS_EE_GBL.HC_EP_CURRENT_MY_PRF_EE_GBL&IsFolder=false&PortalActualURL=https%3a%2f%2fhcmtestsite.university.edu%2fpsc%2fhcmdev%2fEMPLOYEE%2fPONY%2fc%2fROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL%3fNAVSTACK%3dClear%26a%3da&PortalContentURL=https%3a%2f%2fhcmtestsite.university.edu%2fpsc%2fhcmdev%2fEMPLOYEE%2fPONY%2fc%2fROLE_EMPLOYEE.EP_CURRENT_MY_PRF.GBL%3fNAVSTACK%3dClear%26a%3da&PortalContentProvider=PONY&PortalCRefLabel=Current%20Documents&PortalRegistryName=EMPLOYEE&PortalServletURI=https%3a%2f%2fcstestsite.university.edu%2fpsp%2fcsdev%2f&PortalURI=https%3a%2f%2fcstestsite.university.edu%2fpsc%2fcsdev%2f&PortalHostNode=HRMS&NoCrumbs=yes&PortalKeyStruct=yes
to default<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: searching local cache for session (_4ce68e6035c2dfa9a023adef97b14b2e)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: session not found locally, remoting the search<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.Listener [2692] isapi_shib: sending message (find::StorageService::SessionCache)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.Listener [2692] isapi_shib: send completed, reading response message<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.ServiceProvider [2692] isapi_shib: doAuthentication succeeded<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: searching local cache for session (_4ce68e6035c2dfa9a023adef97b14b2e)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: session found locally, validating it for use<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:37:53 DEBUG Shibboleth.SessionCache [2692] isapi_shib: unmarshalled attribute (ID: cn) with 1 value<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:38:22 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/psp/hcmdev/?cmd=start to default<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:38:22 ERROR Shibboleth.ISAPI [2692] isapi_shib: Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:38:23 DEBUG Shibboleth.ISAPI [2692] isapi_shib: mapped https://hcmtestsite.university.edu/psc/hcmdev_1/EMPLOYEE/PONY/c/EP_WC_LAUNCH.EP_WC_STEP_PAGELET.GBL?target=HC_EP_STEP_PAGELET_GBL&unPgltRequest=true&PTAL_ID=EMPLOYEE.HC_EP_WC_LAUNCH_GBL&PAGELET_OBJNAME=HC_EP_STEP_PAGELET_GBL&pageletname=HC_EP_STEP_PAGELET_GBL&&pgltnode=HRMS&PTAL_TAB=1&pageletname=HC_EP_STEP_PAGELET_GBL&PTAL_ID=EMPLOYEE.HC_EP_WC_LAUNCH_GBL&PTAL_TAB=1&PAGELET_OBJNAME=HC_EP_STEP_PAGELET_GBL&pgltnode=HRMS&unPgltRequest=true&PortalRegistryName=EMPLOYEE&PortalServletURI=https%3a%2f%2fcstestsite.university.edu%2fpsp%2fcsdev%2f&PortalURI=https%3a%2f%2fcstestsite.university.edu%2fpsc%2fcsdev%2f&PortalHostNode=HRMS&PortalIsPagelet=true&NoCrumbs=yes&PortalCrefName=HC_EP_STEP_PAGELET_GBL
to default<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New"">2017-02-20 00:38:23 ERROR Shibboleth.ISAPI [2692] isapi_shib: Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.<o:p></o:p></span></p>
</div>
</body>
</html>