<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">To level set, the IdP login seems to work. As far as I can tell, the entire process works up to the last 2%.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">I don't see REMOTE_USER being returned to my application endpoint.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Here are some of the configs and results that seem important.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"><a href="https://imgur.com/a/rCQwuw0" class="OWAAutoLink" id="LPlnk154135" previewremoved="true">https://imgur.com/a/rCQwuw0</a></p>
<div id="LPBorder_GT_15319376442790.03979889325255326" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_15319376442680.7919648298516262" role="presentation" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_15319376442720.29807888997112975" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_15319376442720.7634550737288122" style="background-color: rgb(255, 255, 255); height: 131px; position: relative; margin: auto; display: table; width: 250px;">
<a id="LPImageAnchor_15319376442740.6223906146102436" href="https://imgur.com/a/rCQwuw0" target="_blank" style="display: table-cell; text-align: center;"><img id="LPThumbnailImageID_15319376442740.2181107234294719" width="250" height="131" style="display: inline-block; max-width: 250px; max-height: 250px; height: 131px; width: 250px; border-width: 0px; vertical-align: bottom;" src="https://i.imgur.com/ZArrzqg.jpg?fb"></a></div>
</td>
<td id="TextCell_15319376442750.610673547887469" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_15319376442750.8891703475436759"></div>
<div id="LPTitle_15319376442750.7083238888268568" style="top: 0px; color: rgb(0, 120, 215); font-weight: 400; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_15319376442760.9206147590636611" href="https://imgur.com/a/rCQwuw0" target="_blank" style="text-decoration: none;">Trying to verify REMOTE_USER is being set</a></div>
<div id="LPMetadata_15319376442760.3341826026699257" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
imgur.com</div>
<div id="LPDescription_15319376442780.1796139762159874" style="display: block; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
Imgur</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
<p></p>
<p style="margin-top:0;margin-bottom:0">I've also dumped out the entire http request when control was returned to my endpoint; I see no evidence of REMOTE_USER anywhere there.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">So right now, I am trying to verify that httpd is adding REMOTE_USER. I don't see a mention of it anywhere on the httpd+shib server.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<br style="font-family:Times">
<br style="font-family:Times">
<table id="sig" width="500" border="0" cellspacing="0" cellpadding="0" style="font-family:Arial,sans-serif; width:500px; margin:0px; padding:0px">
<tbody>
<tr>
<td valign="top" width="80" style="width:80px; margin:0px; padding:0px; vertical-align:top">
<a title="Rivera Group" tabindex="0" href="http://www.riverainc.com" target="_blank" style="border:none; text-decoration:none" id="LPNoLP"><img alt="Rivera Group" width="80" height="60" style="border: none; width: 80px; height: 60px; display: block; user-select: none;" src="http://riverainc.com/img/signatures/logo60h.png"></a></td>
<td width="5" style="width:5px; max-width:5px; margin:0px; padding:0px; border-right:2px solid rgb(0,0,0)">
</td>
<td width="5" style="width:5px; max-width:5px; margin:0px; padding:0px"> </td>
<td style="margin:0px; padding:0px">
<table id="sig2" cellspacing="0" cellpadding="0" style="padding:0px; margin:0px; font-size:14px; line-height:16px; color:rgb(0,0,0); border-collapse:collapse">
<tbody>
<tr style="margin:0px; padding:0px">
<td style="font-family:Arial,Arial,sans-serif; margin:0px; padding:0px; white-space:nowrap">
<span style="font-family:Arial,sans-serif"><strong>Tony Ennis</strong></span></td>
</tr>
<tr style="margin:0px; padding:0px">
<td style="margin:0px; padding:0px; white-space:nowrap">Chief Architect</td>
</tr>
<tr style="margin:0px; padding:0px">
<td style="margin:0px; padding:0px; white-space:nowrap"><a tabindex="0" href="mailto:tennis@riverainc.com " style="border:none; text-decoration:none; color:rgb(0,0,0)" id="LPNoLP">tennis@riverainc.com</a> | <a tabindex="0" href="http://www.riverainc.com" target="_blank" style="color:rgb(0,0,0); text-decoration:none" id="LPNoLP">Rivera
Group</a></td>
</tr>
<tr style="margin:0px; padding:0px">
<td style="margin:0px; padding:0px; white-space:nowrap">O: 812.246.4055</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober <peter.schober@univie.ac.at><br>
<b>Sent:</b> Wednesday, July 18, 2018 11:25:49 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: Can't find attribute REMOTE_USER value in https request</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">External Email! Do not click any links or open any attachments unless you trust the sender and know the content is safe.<br>
________________________________<br>
<br>
* Tony Ennis <tennis@eagle6.com> [2018-07-18 16:33]:<br>
> >> I don't know if my application endpoint is explicitly secured by<br>
> >> Shib SP or not.<br>
><br>
> >Well, who else should know? You don't know and you also don't provide<br>
> >any technical details.<br>
><br>
> Well, "explicitly secured" sounded like a specific technical thing<br>
<br>
I would have understood it in that way, yes. Meaning active protection<br>
or at least passive/lazy sessions, as per the software's documentation:<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent</a><br>
<br>
> For example, my SP does not automatically intercept web requests to<br>
> my app's endpoints. However, I have a decorator in my endpoints that<br>
> redirects to the SP whenever an endpoint is accessed and there's no<br>
> shib session.<br>
<br>
While that's relevant to a certain degree it does not help to<br>
determine whether the SP software actually is invoked for requests<br>
that go to httpd. Only if that's the case will the attributes be<br>
there.<br>
<br>
(REMOTE_USER will only have a value if at least one of the exact<br>
attribute-ids mapped to it in shibboleth2.xml is available, but I'll<br>
assume you have already checked that with your transaction.log.)<br>
<br>
<br>
> I didn't provide any technical details because I didn't just want to<br>
> puke all my configurations on this message, and my configs are on a<br>
> secure server; getting them out is not easy.<br>
<br>
Let's pretend there's a middle ground between pasting the whole config<br>
here without without any discrimination and making some rough<br>
statements about what you've done (e.g. "I've installed and configured<br>
the software according to the docs and protected some resournce on my<br>
server following the example from the wiki page XYZ.")<br>
<br>
<br>
> >* Tony Ennis <tennis@eagle6.com> [2018-07-17 21:46]:<br>
> >> I am using Apache and Shib SP for SSO, and Flask/uwsgi to serve my application.<br>
> [...]<br>
> >> My nginx-powered endpoint checks for a Shib cookie and if not<br>
> >> present in the http request, redirects to the Shib login.<br>
><br>
> >So you're running both Apache httpd *and* Nginx for the same resource?<br>
> >Why? The Shib SP can be used with Nginx, too, if you positively<br>
> >require Nginx but not httpd.<br>
><br>
> Not your problem, but that's how the container was delivered to me<br>
> by the devops team.<br>
<br>
Indeed, none of this here is my problem.<br>
<br>
Then why am I commenting on this: You're asking for help here. And you<br>
may just be doing something that cannot possibly work. No way for me<br>
to tell without any specifics, but running 2 full-blown web servers on<br>
the same machine is a warning sign if I ever saw one.<br>
<br>
> I did add your config, thank you for that. After restarting, I did<br>
> not see a difference in the logs. But I suspect my logs are not<br>
> configured properly as I never see any particularly detailed data. I<br>
> see DEBUG level, which is supposed to be pretty spammy. Instead, I<br>
> see one-liners that pretty much say, "This shib endpoint was<br>
> called".<br>
<br>
Note that I was referring to httpd log files, not the Shib SP's logs.<br>
Are you saying you don't have access to httpd logs, either?<br>
<br>
So I'd make sure:<br>
<br>
* my transaction.log says that it revieced and mapped an attribute<br>
with the exact id that I have configured in the SP's REMOTE_USER<br>
predecence list.<br>
(otherwise also check for lines with "skipping" in shibd.log)<br>
<br>
* you access a resource you have configured in httpd to be "protected"<br>
by the Shib SP, at least lazily ("auth shibboleth" and "require<br>
shibboleth")<br>
<br>
* that httpd's access log shows something other than " - - " for the<br>
authenticated subject (assuming common log format).<br>
<br>
HTH,<br>
-peter<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
<hr>
<div style="font-size:8pt; font-family: serif; color:black; font-style:italic">Confidentiality Notice: This message and any attachments are for the sole use of the intended recipient(s), and may contain information considered confidential or privileged by the
sending organization or trade secrets of the sending organization. This message does not authorize the intended recipient to disclose this information to any other party. Use, disclosure, or retention of any information in this message by anyone other than
the intended user is strictly prohibited, unless otherwise authorized in writing. If you are not the intended recipient, please destroy all copies of this message.
</div>
</body>
</html>