<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">As far as I can tell there are no VirtualHosts explicitly configured so I assume that means that everything runs in one single vhost.<div class=""><br class=""></div><div class="">Just to clarify, are you saying that the cookie that holds the credentials is is no way tied to the machine/address for which it was issued? So I should be able to take the credentials from one users machine and use it in a request form another machine to gain access to my resource? Granted that is exactly what I would like to do, I just find it surprising that it would work that way. </div><div class=""><br class=""></div><div class="">For the record you are absolutely correct when you say that our current design is not a good one and hopefully I will be able to fix this at some point. </div><div class="">This is a legacy system that we as of yet have not had time to change and when this is run in a setting where basic auth is used we are able to extract the credentials and login again from the cgi scripts thus allowing us to do what we need.</div><div class=""><br class=""></div><div class=""><div class=""><br class=""><div class="">
<div class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><span lang="EN-US" class="" style="font-size: 10pt; font-family: 'Myriad Pro', sans-serif; color: rgb(89, 89, 89);">Daniel Södling, Software Development Manager</span></b><b class=""><span lang="DE" class="" style="font-size: 10pt; font-family: 'Myriad Pro', sans-serif; color: rgb(31, 73, 125);"><o:p class=""></o:p></span></b></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><u class=""><span class="" style="font-size: 9pt; color: rgb(89, 89, 89);">___________________________________________</span></u></b><u class=""><span class="" style="font-family: Helvetica, sans-serif; color: rgb(89, 89, 89);"><o:p class=""></o:p></span></u></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; orphans: 2; widows: 2; font-size: 10pt; font-family: 'Myriad Pro', sans-serif; color: rgb(89, 89, 89);"><br class=""></span><span class="" style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; orphans: 2; widows: 2; font-size: 9pt; font-family: 'Myriad Pro', sans-serif; color: rgb(31, 73, 125);"><span><span><img apple-inline="yes" id="8C51E1D1-1295-4D5F-80A7-E03FCD6D42B9" src="cid:image002.jpg@01CD8FA6.3B2E3700" class=""></span><div style="font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; color: rgb(0, 0, 0); font-family: Helvetica; orphans: auto; widows: auto;" class=""><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; text-align: -webkit-auto; orphans: 2; widows: 2; font-size: 9pt; font-family: 'Myriad Pro', sans-serif; color: rgb(31, 73, 125);"><div class="" style="font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; text-align: -webkit-auto; color: rgb(0, 0, 0); font-family: Calibri;"><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-family: 'Myriad Pro', sans-serif; font-size: 9pt;"><br class="Apple-interchange-newline"><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">Stora Åvägen 19B | SE-433 36 Askim | SWEDEN</span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span class="" style="font-size: 9pt; font-family: 'Myriad Pro', sans-serif;">Phone: +46 (0) 767 899949</span><span class="" style="color: rgb(31, 73, 125);"><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><u class=""><span lang="DE" class="" style="font-size: 9pt; font-family: 'Myriad Pro', sans-serif; color: blue;"><a href="x-msg://16/www.pdsvision.com" class="" style="color: purple;"><span class="" style="color: blue;">www.pdsvision.</span></a>se</span></u><span class="" style="color: rgb(31, 73, 125);"><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b class=""><u class=""><span class="" style="font-size: 9pt; font-family: 'Myriad Pro', sans-serif; color: rgb(166, 166, 166);">___________________________________________</span></u></b></div></div></span></div></div><div style="font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; color: rgb(0, 0, 0); font-family: Helvetica; orphans: auto; widows: auto;" class=""><br class=""></div><br class="Apple-interchange-newline" style="color: rgb(31, 73, 125); font-family: 'Myriad Pro', sans-serif; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class="Apple-interchange-newline">
</span></span></div>
</div></div><div><br class=""><blockquote type="cite" class=""><div class="">On 15 Oct 2018, at 14:23, Peter Schober <<a href="mailto:peter.schober@univie.ac.at" class="">peter.schober@univie.ac.at</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">* Daniel Södling <<a href="mailto:daniel.sodling@pdsvision.se" class="">daniel.sodling@pdsvision.se</a>> [2018-10-15 13:08]:<br class=""><blockquote type="cite" class="">1. Our service is a web application running on Apache. Lets call this AppA.<br class="">2. We have a second web application that runs in the same Apache<br class=""> server. Lets call this AppB.<br class=""></blockquote><br class="">"Same Apache server" doesn't really help much. Is it the same vhost?<br class="">By default a session cookie with a path=/ will be issued, so as long<br class="">as the applications share a vhost a single shib session will be<br class="">available for all apps to use.<br class=""><br class=""><blockquote type="cite" class="">3. The user will access the AppB which is an angualrjs driven SPA app.<br class="">4. Accessing AppB triggers the sign-on process via our Idp.<br class="">5. Once logged in the user can enter some search criteria and click on<br class=""> a serach button which calls a cgi-script also running in the same<br class=""> Apache.<br class="">6. This cgi-script will now try to call AppA using the _shibboleth_<br class=""> cookie/token stored in the users broswer.<br class=""><br class="">Step 6 is where we run into problems because it seems that we cannot<br class="">simply transer the credentials token from the users browser session<br class="">and use it in the call from the cgiscript.<br class=""></blockquote><br class="">You fail to say just those problems are specifically, but having the<br class="">CGI script on the web server impersonate the subject (instead of the<br class="">script merely issuing HTTP responses to the subject's browser which<br class="">cause the browser to access AppA itself) doesn't seem right/a good<br class="">design.<br class=""><br class="">-peter<br class="">-- <br class="">For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a><br class=""></div></div></blockquote></div><br class=""></div></div></body></html>