<div dir="ltr">Thanks Cameron! I tried your suggestion by adding <div><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console""> <Location /Shibboleth.sso><u></u><u></u></span></p><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console""> AuthType None<u></u><u></u></span></p><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console""> Require all granted<u></u><u></u></span></p><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console""> </Location></span></p><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console"">to the virtual config file, but it didn't work. </span></p><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console""><br></span></p><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console"">I also tried the ProxyPass /Shibboleth.sso ! and this didn't work either.</span></p><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console""><br></span></p><p class="MsoNormal" style="font-size:12.8px"><span style="font-family:"lucida console"">Thanks for sharing the tip about %R switch. I will need to enable better logging than the built in Python debugger. </span></p></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 7, 2017 at 2:07 PM, Cameron Kerr <span dir="ltr"><<a href="mailto:cameron.kerr@otago.ac.nz" target="_blank">cameron.kerr@otago.ac.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-NZ" link="blue" vlink="purple">
<div class="m_-3687393921979954675WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">To prevent Apache from passing /Shibboleth.sso it to the backend, you need to ensure that it handled by another authorization handler<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> #<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> # Ensures handler will be accessible.<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> #<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> <Location /Shibboleth.sso><u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> AuthType None<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-family:"Lucida Console""> Require all granted<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Lucida Console""> </Location></span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Potentially, you might also need to put in a ProxyPass statement to prevent such from being passed to the backend<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">ProxyPass /Shibboleth.sso !<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">But in your case you don’t appear to be using a ProxyPass, so that shouldn’t be needed.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">One useful tip: if your version of Apache httpd supports it (eg. RHEL6+) add %R to your LogFormat to log the handler that processed
a request (can be useful for diagnosing where things like a redirect come from)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Cheers,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Cameron</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
</div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><span style="border-collapse:collapse;font-family:arial,sans-serif;font-size:13px"><div>Tonu Mikk</div><div>Adaptive Technologist | Disability Resource Center | <a href="http://diversity.umn.edu/disability" target="_blank">diversity.umn.edu/disability</a></div><div>University of Minnesota | <a href="http://umn.edu" target="_blank">umn.edu</a> </div><div><a href="mailto:tmikk@umn.edu" target="_blank">tmikk@umn.edu</a> | 612-625-3307</div></span></div></div>
</div>