<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0"><span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>* Tony Ennis <tennis@eagle6.com> [2018-07-18 15:46]:</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>> I don't know if my application endpoint is explicitly secured by</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>> Shib SP or not.</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>Well, who else should know? You don't know and you also don't provide</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>any technical details.</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<br>
Well, "explicitly secured" sounded like a specific technical thing, and I didn't</p>
<p style="margin-top:0;margin-bottom:0">want to say that it was secured when it wasn't done in some specific way.</p>
<p style="margin-top:0;margin-bottom:0">For example, my SP does not automatically intercept web requests to my</p>
<p style="margin-top:0;margin-bottom:0">app's endpoints. However, I have a decorator in my endpoints that redirects</p>
<p style="margin-top:0;margin-bottom:0">to the SP whenever <span style="font-size: 12pt;">an endpoint is accessed and there's no shib session.</span></p>
<p style="margin-top:0;margin-bottom:0"><span style="font-size: 12pt;">That is in accordance to the document given to me by the client.</span></p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">I didn't provide any technical details because I didn't just want to puke all</p>
<p style="margin-top:0;margin-bottom:0">my configurations on this message, and my configs are on a secure server;</p>
<p style="margin-top:0;margin-bottom:0">getting them out is not easy.</p>
<p style="margin-top:0;margin-bottom:0"><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>* Tony Ennis <tennis@eagle6.com> [2018-07-17 21:46]:</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>> I am using Apache and Shib SP for SSO, and Flask/uwsgi to serve my application.</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">[...]</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>> My nginx-powered endpoint checks for a Shib cookie and if not</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>> present in the http request, redirects to the Shib login.</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>So you're running both Apache httpd *and* Nginx for the same resource?</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>Why? The Shib SP can be used with Nginx, too, if you positively</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>require Nginx but not httpd.</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<br>
Not your problem, but that's how the container was delivered to me by the</p>
<p style="margin-top:0;margin-bottom:0">devops team. But thank you, that gives me a different avenue. I would</p>
<p style="margin-top:0;margin-bottom:0">prefer to not use httpd.</p>
<p style="margin-top:0;margin-bottom:0"><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>Other than that I don't understand what the above means, so it's</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>likely a hint that something weird going on in your deployment.</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<br>
Yes, lol. <br>
<br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>> I don't have any confidence that Shib SP is creating REMOTE_USER at</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>> all.</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>If it's protecting content (or configured as I suggested before, which</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>you didn't not comment on at all) it httpd will log REMOTE_USER in</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<span style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">>httpd's access log.</span><br style="color: rgb(33, 33, 33); font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, serif, EmojiFont; font-size: 14.6667px;">
<br>
</p>
<p style="margin-top:0;margin-bottom:0">I did add your config, thank you for that. After restarting, I did not see</p>
<p style="margin-top:0;margin-bottom:0">a difference in the logs. But I suspect my logs are not configured properly</p>
<p style="margin-top:0;margin-bottom:0">as I never see any particularly detailed data. I see DEBUG level, which is</p>
<p style="margin-top:0;margin-bottom:0">supposed to be pretty spammy. Instead, I see one-liners that pretty much</p>
<p style="margin-top:0;margin-bottom:0">say, "This shib endpoint was called".</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<br style="font-family:Times">
<br style="font-family:Times">
<table id="sig" width="500" border="0" cellspacing="0" cellpadding="0" style="font-family:Arial,sans-serif; width:500px; margin:0px; padding:0px">
<tbody>
<tr>
<td valign="top" width="80" style="width:80px; margin:0px; padding:0px; vertical-align:top">
<a title="Rivera Group" tabindex="0" href="http://www.riverainc.com" target="_blank" style="border:none; text-decoration:none" id="LPNoLP"><img alt="Rivera Group" width="80" height="60" style="border: none; width: 80px; height: 60px; display: block; user-select: none;" src="http://riverainc.com/img/signatures/logo60h.png"></a></td>
<td width="5" style="width:5px; max-width:5px; margin:0px; padding:0px; border-right:2px solid rgb(0,0,0)">
</td>
<td width="5" style="width:5px; max-width:5px; margin:0px; padding:0px"> </td>
<td style="margin:0px; padding:0px">
<table id="sig2" cellspacing="0" cellpadding="0" style="padding:0px; margin:0px; font-size:14px; line-height:16px; color:rgb(0,0,0); border-collapse:collapse">
<tbody>
<tr style="margin:0px; padding:0px">
<td style="font-family:Arial,Arial,sans-serif; margin:0px; padding:0px; white-space:nowrap">
<span style="font-family:Arial,sans-serif"><strong>Tony Ennis</strong></span></td>
</tr>
<tr style="margin:0px; padding:0px">
<td style="margin:0px; padding:0px; white-space:nowrap">Chief Architect</td>
</tr>
<tr style="margin:0px; padding:0px">
<td style="margin:0px; padding:0px; white-space:nowrap"><a tabindex="0" href="mailto:tennis@riverainc.com " style="border:none; text-decoration:none; color:rgb(0,0,0)" id="LPNoLP">tennis@riverainc.com</a> | <a tabindex="0" href="http://www.riverainc.com" target="_blank" style="color:rgb(0,0,0); text-decoration:none" id="LPNoLP">Rivera
Group</a></td>
</tr>
<tr style="margin:0px; padding:0px">
<td style="margin:0px; padding:0px; white-space:nowrap">O: 812.246.4055</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober <peter.schober@univie.ac.at><br>
<b>Sent:</b> Wednesday, July 18, 2018 9:59:18 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: Can't find attribute REMOTE_USER value in https request</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">External Email! Do not click any links or open any attachments unless you trust the sender and know the content is safe.<br>
________________________________<br>
<br>
* Tony Ennis <tennis@eagle6.com> [2018-07-18 15:46]:<br>
> I don't know if my application endpoint is explicitly secured by<br>
> Shib SP or not.<br>
<br>
Well, who else should know? You don't know and you also don't provide<br>
any technical details.<br>
<br>
* Tony Ennis <tennis@eagle6.com> [2018-07-17 21:46]:<br>
> I am using Apache and Shib SP for SSO, and Flask/uwsgi to serve my application.<br>
[...]<br>
> My nginx-powered endpoint checks for a Shib cookie and if not<br>
> present in the http request, redirects to the Shib login.<br>
<br>
So you're running both Apache httpd *and* Nginx for the same resource?<br>
Why? The Shib SP can be used with Nginx, too, if you positively<br>
require Nginx but not httpd.<br>
<br>
Other than that I don't understand what the above means, so it's<br>
likely a hint that something weird going on in your deployment.<br>
<br>
> I don't have any confidence that Shib SP is creating REMOTE_USER at<br>
> all.<br>
<br>
If it's protecting content (or configured as I suggested before, which<br>
you didn't not comment on at all) it httpd will log REMOTE_USER in<br>
httpd's access log.<br>
<br>
-peter<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
<hr>
<div style="font-size:8pt; font-family: serif; color:black; font-style:italic">Confidentiality Notice: This message and any attachments are for the sole use of the intended recipient(s), and may contain information considered confidential or privileged by the
sending organization or trade secrets of the sending organization. This message does not authorize the intended recipient to disclose this information to any other party. Use, disclosure, or retention of any information in this message by anyone other than
the intended user is strictly prohibited, unless otherwise authorized in writing. If you are not the intended recipient, please destroy all copies of this message.
</div>
</body>
</html>