<div dir="auto"><div>Ok so that answers how you are able to see status page. But without fiddler trace, Apache+shibboleth logs and metadata details, can't help you much. <br><br><div class="gmail_quote"><div dir="ltr">On Thu 28 Jun, 2018, 5:57 PM George Glessner, <<a href="mailto:gglessner@serviceexpress.com">gglessner@serviceexpress.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Kunal, <br>
<br>
My local host is set to <br>
<br>
127.0.0.1 localhost <a href="http://george-oxygen.seitrakker.com" rel="noreferrer noreferrer" target="_blank">george-oxygen.seitrakker.com</a><br>
<br>
In my hosts file, so technically I am still running through local host. <br>
<br>
I get my metadata file from <a href="http://george-oxygen.seitrakker.com:8080/Shibboleth.sso/Metadata" rel="noreferrer noreferrer" target="_blank">http://george-oxygen.seitrakker.com:8080/Shibboleth.sso/Metadata</a> <br>
<br>
I am not using a linux machine, I am on Windows. <br>
<br>
Thanks, <br>
<br>
George<br>
-----Original Message-----<br>
From: users <<a href="mailto:users-bounces@shibboleth.net" target="_blank" rel="noreferrer">users-bounces@shibboleth.net</a>> On Behalf Of Kunal Shah<br>
Sent: Thursday, June 28, 2018 8:22 AM<br>
To: Shib Users <<a href="mailto:users@shibboleth.net" target="_blank" rel="noreferrer">users@shibboleth.net</a>><br>
Subject: Re: Stuck at /Shibboleth.sso/SAML2/POST<br>
<br>
On Thu, Jun 28, 2018 at 11:55:00AM +0000, George Glessner wrote:<br>
>Hi Kunal,<br>
><br>
>Yes, <a href="http://george-oxygen.seitrakker.com:8080/Shibboleth.sso/Status" rel="noreferrer noreferrer" target="_blank">http://george-oxygen.seitrakker.com:8080/Shibboleth.sso/Status</a> works just fine. I am not sure what you mean that it says it is only allowed from localhost in my shibboleth2.xml, where are you seeing that? <br>
<br>
from your shibboleths.xml file<br>
<br>
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/><br>
<br>
and it is not commented. This actually means that only <a href="http://locahost:8080/Shibboleth.sso/Status" rel="noreferrer noreferrer" target="_blank">http://locahost:8080/Shibboleth.sso/Status</a> should serve the request. if you go by your host name, it should not. I may be wrong. Someone from this list can confirm. This is mentioned in "Initial Testing" section of shibboleth SP documentation @ <br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxInstall" rel="noreferrer noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxInstall</a><br>
<br>
If I am right, your sp is not using shibboleth2.xml file you attached.<br>
<br>
>I already mentioned where it is getting stuck, <br>
>/Shibboleth.sso/SAML2/POST. I am using port 8080 because that is the <br>
>port my local site<br>
(<a href="http://george-oxygen.seitrakker.com" rel="noreferrer noreferrer" target="_blank">george-oxygen.seitrakker.com</a>) is set up on. When you ask me to check metadata for accuracy are you asking me to check SP side or IDP side? IDP side is accurate, can't tell you if mine is or not hence why I am asking for help.<br>
><br>
<br>
If you are sure IDP side is accurate you need to check yours. Where is the metadata file that you as SP sent to IDP?<br>
<br>
Did you try fiddler request trace ?<br>
check this link for how to use fiddler<br>
<br>
<a href="https://zappysys.com/blog/how-to-use-fiddler-to-analyze-http-web-requests/" rel="noreferrer noreferrer" target="_blank">https://zappysys.com/blog/how-to-use-fiddler-to-analyze-http-web-requests/</a><br>
<br>
-Kunal <br>
<br>
>Thank you,<br>
><br>
>George<br>
><br>
><br>
>-----Original Message-----<br>
>From: users <<a href="mailto:users-bounces@shibboleth.net" target="_blank" rel="noreferrer">users-bounces@shibboleth.net</a>> On Behalf Of Kunal Shah<br>
>Sent: Thursday, June 28, 2018 2:48 AM<br>
>To: Shib Users <<a href="mailto:users@shibboleth.net" target="_blank" rel="noreferrer">users@shibboleth.net</a>><br>
>Subject: Re: Stuck at /Shibboleth.sso/SAML2/POST<br>
><br>
><br>
><br>
>On Wed, Jun 27, 2018 at 02:16:53PM +0000, George Glessner wrote:<br>
>>The POST to the request url: <a href="http://george-oxygen.seitrraker.com:8080/Shibboleth.sso/SAML2/POST" rel="noreferrer noreferrer" target="_blank">http://george-oxygen.seitrraker.com:8080/Shibboleth.sso/SAML2/POST</a> had a status of failed. When I exit out of my browser and open it back up and navigate to <a href="http://george-oxygen.seitrraker.com:8080/Shibboleth.sso/Status" rel="noreferrer noreferrer" target="_blank">http://george-oxygen.seitrraker.com:8080/Shibboleth.sso/Status</a> it loads up fine.<br>
><br>
>are you sure <a href="http://george-oxygen.seitrraker.com:8080/Shibboleth.sso/Status" rel="noreferrer noreferrer" target="_blank">http://george-oxygen.seitrraker.com:8080/Shibboleth.sso/Status</a> comes up fine? shibboleth2.xml you attached says it is allowed only from localhost.<br>
>you should have gotten forbidden error.<br>
>Something is not right. Either you are not using correct shibboleth2.xml or your SP metadata has problem.<br>
><br>
>>If I then enter in <a href="http://george-oxygen.seitrraker.com:8080/Shibboleth.sso/SAML2/POST" rel="noreferrer noreferrer" target="_blank">http://george-oxygen.seitrraker.com:8080/Shibboleth.sso/SAML2/POST</a> I get the site can't be reached error, and then when going back to the status page I get the same error even though it was working fine just before I went to the POST page. It seems as though the POST page may be modifying something that is causing this?<br>
>><br>
><br>
>web/app server and shibd.log should log error for this.<br>
><br>
>basic troubleshooting steps.<br>
>A) check metadata for accuracy<br>
>B) use fiddler or if you are using chrome, enable developer tools. Trace your request and see where it is getting stuck.<br>
>C) use exact time stamp to correlate logs in web/app server, shibd and native log files.<br>
><br>
>I am mentioning web/app server because I am not sure why you are using port 8080.<br>
><br>
>For us to help you, more detailed information is needed.<br>
><br>
>-Kunal Shah<br>
><br>
>>-----Original Message-----<br>
>>From: Peter Schober <<a href="mailto:peter.schober@univie.ac.at" target="_blank" rel="noreferrer">peter.schober@univie.ac.at</a>><br>
>>Sent: Wednesday, June 27, 2018 10:01 AM<br>
>>To: George Glessner <<a href="mailto:gglessner@serviceexpress.com" target="_blank" rel="noreferrer">gglessner@serviceexpress.com</a>><br>
>>Subject: Re: Stuck at /Shibboleth.sso/SAML2/POST<br>
>><br>
>>* George Glessner <<a href="mailto:gglessner@serviceexpress.com" target="_blank" rel="noreferrer">gglessner@serviceexpress.com</a>> [2018-06-27 15:47]:<br>
>>> When you say it looks like I'm trying to access something that <br>
>>> doesn't exist, are you talking about the /Shibboleth.sso/SAML2/POST?<br>
>><br>
>>No, you wrote earlier:<br>
>><br>
>>* George Glessner <<a href="mailto:gglessner@serviceexpress.com" target="_blank" rel="noreferrer">gglessner@serviceexpress.com</a>> [2018-06-26 19:44]:<br>
>>> I get an error saying that the site cannot be reached and that my <br>
>>> server IP address cannot be reached<br>
>><br>
>>That's not a technical error report, of course, but if I had to guess (and I have, lacking evidence from your web server logs or HTTP status codes from the browser) to me that sounds like your browser cannot reach the server.<br>
>><br>
>>-peter<br>
>><br>
>>--<br>
>>For Consortium Member technical support, see <br>
>><a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
>>To unsubscribe from this list send an email to <br>
>><a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer">users-unsubscribe@shibboleth.net</a><br>
>--<br>
>For Consortium Member technical support, see <br>
><a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
>To unsubscribe from this list send an email to <br>
><a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer">users-unsubscribe@shibboleth.net</a><br>
><br>
>--<br>
>For Consortium Member technical support, see <br>
><a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
>To unsubscribe from this list send an email to <br>
><a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer">users-unsubscribe@shibboleth.net</a><br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer">users-unsubscribe@shibboleth.net</a><br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div></div>