<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Segoe UI",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>It’s MOSTLY working. But mostly isn’t good enough, and I need some advice.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>Environment: Ubuntu 18.04.5 kernel 4.15.0-1063-aws / Apache 2.4.41 with PHP 7.2.28 / Shibboleth SP 3.0.4 (via libapache2-mod-shib and shibboleth installed via apt with this repo: https://pkg.switch.ch/switchaai/ubuntu/dists/bionic/main/binary-all/misc/switchaai-apt-source_1.0.0ubuntu1_all.deb)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>I’m to the point where I can authenticate with the IdP and I receive the SAML response, and the Shibboleth session gets set up. Navigating to /Shibboleth.sso/Session and /Shibboleth.sso/Status work properly and show that I’ve been authenticated. The NameID attribute is filled with my logon name. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>The problem is that <b>my application can’t seem to see the authentication info</b>. None of the Shibboleth environment variables get set in Apache for the session… REMOTE_USER is not there, nor is Shib-Identity-Provider or any other Shib* variable. My logs are set to debug level, and I see “shib_fixups entered in pid” messages but nothing about adding variables.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>After I authenticate, when I try to access the site after declaring in the application’s VirtualHost directive, for example, the following:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> <Location /login><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> AuthType None<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> Require all granted<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> </Location><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> <Location /><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> AuthType shibboleth<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> ShibRequestSetting requireSession false<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> Require shibboleth<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> </Location><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> <Location /Shibboleth.sso><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> SetHandler shib<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'> </Location> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>I get 500 errors with the following sample apache error log entries:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449533 2020] [mod_shib:debug] [pid 25353] mod_shib.cpp(369): [client 10.0.1.96:17652] get_request_config created per-request structure<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449565 2020] [ssl:debug] [pid 25353] ssl_engine_kernel.c(383): [client 10.0.1.96:17652] AH02034: Initial (No.1) HTTPS request received for child 2 (server mytestserver.example.com:443)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449696 2020] [mod_shib:debug] [pid 25353] mod_shib.cpp(1613): [client 10.0.1.96:17652] shib_base_check_authz found uninitialized request object<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449702 2020] [authz_core:debug] [pid 25353] mod_authz_core.c(820): [client 10.0.1.96:17652] AH01626: authorization result of Require shibboleth : denied (no authenticated user yet)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449706 2020] [authz_core:debug] [pid 25353] mod_authz_core.c(820): [client 10.0.1.96:17652] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449711 2020] [mod_shib:debug] [pid 25353] mod_shib.cpp(783): [client 10.0.1.96:17652] shib_check_user entered in pid (25353)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449764 2020] [authn_core:error] [pid 25353] [client 10.0.1.96:17652] AH01796: AuthType shibboleth configured without corresponding module<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449780 2020] [headers:debug] [pid 25353] mod_headers.c(900): AH01503: headers: ap_headers_error_filter()<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>[Wed Mar 25 17:09:18.449883 2020] [ssl:debug] [pid 25353] ssl_engine_io.c(1106): [client 10.0.1.96:17652] AH02001: Connection closed to child 2 with standard shutdown (server mytestserver.example.com:443)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>but then I go to https://mytestserver.example.com/Shibboleth.sso/Session and see<o:p></o:p></span></p><p class=MsoNormal><u><span style='font-size:8.0pt;font-family:"Courier New";color:black'>Miscellaneous</span></u><span style='font-size:8.0pt;font-family:"Courier New";color:black'><o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>Session Expiration (barring inactivity):</span></b><span style='font-size:8.0pt;font-family:"Courier New";color:black'> 430 minute(s)<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>Client Address:</span></b><span style='font-size:8.0pt;font-family:"Courier New";color:black'> 10.0.1.96<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>SSO Protocol:</span></b><span style='font-size:8.0pt;font-family:"Courier New";color:black'> urn:oasis:names:tc:SAML:2.0:protocol<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>Identity Provider:</span></b><span style='font-size:8.0pt;font-family:"Courier New";color:black'> MYEXAMPLEIDP-ENTITYID<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>Authentication Time:</span></b><span style='font-size:8.0pt;font-family:"Courier New";color:black'> 2020-03-25T20:26:09.130Z<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>Authentication Context Class:</span></b><span style='font-size:8.0pt;font-family:"Courier New";color:black'> urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>Authentication Context Decl:</span></b><span style='font-size:8.0pt;font-family:"Courier New";color:black'> (none)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New";color:black'><o:p> </o:p></span></p><p class=MsoNormal><u><span style='font-size:8.0pt;font-family:"Courier New";color:black'>Attributes</span></u><span style='font-size:8.0pt;font-family:"Courier New";color:black'><o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>NameID</span></b><span style='font-size:8.0pt;font-family:"Courier New";color:black'>: jsmit628<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>and https://mytestserver.example.com/Shibboleth.sso/Status:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New";color:black'><StatusHandler time="2020-03-25T21:16:59Z"><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Version Xerces-C="3.2.0" XML-Tooling-C="3.0.5" XML-Security-C="2.0.2" OpenSAML-C="3.0.1" Shibboleth="3.0.4"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><NonWindows sysname="Linux" nodename="myhostname" release="4.15.0-1063-aws" version="#67-Ubuntu SMP Mon Mar 2 07:24:29 UTC 2020" machine="x86_64"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><SessionCache><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in;text-indent:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><OK/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'></SessionCache><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Application id="default" entityID="MYEXAMPLESP-ENTITYID"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><MetadataProvider source="/etc/shibboleth/MYEXAMPLEIDP-ENTITYID.xml" lastUpdate="2020-03-25T19:17:22Z"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Handlers><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Handler type="AssertionConsumerService" Location="/SAML2/POST" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Handler type="SessionInitiator" Location="/Login"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Handler type="LogoutInitiator" Location="/Logout"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Handler type="LogoutInitiator" Location="/Logout/Admin"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Handler type="MetadataGenerator" Location="/Metadata"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Handler type="Status" Location="/Status"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:1.0in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Handler type="Session" Location="/Session"/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'></Handlers><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><md:KeyDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" use="signing">...</md:KeyDescriptor><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><md:KeyDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" use="encryption">...</md:KeyDescriptor><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><Status><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in;text-indent:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'><OK/><o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'><span style='font-size:8.0pt;font-family:"Courier New";color:black'></Status><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Courier New";color:black'></StatusHandler><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>My /var/log/shibboleth/transaction.log shows these entries:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>2020-03-25 16:25:52|Shibboleth-TRANSACTION.AuthnRequest|||MYEXAMPLEIDP-ENTITYID||||||urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST||||||<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:Consolas'>2020-03-25 16:26:09|Shibboleth-TRANSACTION.Login|jsmit628|_1b2688e008f0c9f7a5c81bded3ff4cdb|MYEXAMPLEIDP-ENTITYID|HWveYbCHEeoQpUwxtQ.1MfedLhF|urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified|2020-03-25T16:26:09|NameID(1)|jsmit628|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST||urn:oasis:names:tc:SAML:2.0:status:Success|||Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36|10.0.1.96<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>To be clear, when I’ve tried to examine the environment variables like REMOTE_USER, I can only get that information if I omit the <Location> declarations from the Apache VirtualHost config… otherwise attempts to view the application return 500 errors.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>Where am I going wrong? I’ve been beating my head against a wall for a couple weeks on this. I’d appreciate any insight. Happy to provide more information as well.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>Thank you,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'>chris.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Segoe UI",sans-serif'><o:p> </o:p></span></p><div><div class=MsoNormal><hr size=1 width=30 style='width:22.5pt' noshade style='color:#9E9E9E' align=left></div></div><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 align=left><tr><td width="50%" style='width:50.0%;padding:0in 0in 0in 0in'><p class=MsoNormal style='mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly'><span style='font-size:9.0pt;font-family:"Tahoma",sans-serif;color:#3C3625'><a href="https://www.linkedin.com/in/chinkle"><span style='color:#772432;text-decoration:none'>Christopher J. Hinkle, CISSP</span></a><br>he/him/his<br><a href="tel:+17033383850p110"><span style='color:#772432;text-decoration:none'>+1 703.299.1580 x110</span></a> <o:p></o:p></span></p></td><td style='padding:0in 0in 0in 0in'><p class=MsoNormal style='mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly'><span style='font-size:9.0pt;font-family:"Tahoma",sans-serif;color:#3C3625'><a href="mailto:chinkle@netlinkrg.com"><span style='color:#772432;text-decoration:none'>chinkle@netlinkrg.com</span></a><br>NetLink Resource Group, Inc.<br><a href="https://www.netlinkrg.com/"><span style='color:#772432;text-decoration:none'>www.netlinkrg.com</span></a><o:p></o:p></span></p></td></tr><tr><td colspan=2 style='padding:3.75pt 0in 0in 0in'><p class=MsoNormal style='mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly'><img border=0 width=317 height=86 style='width:3.302in;height:.8958in' id="_x0000_i1026" src="https://www.netlinkrg.com/newlogo.gif" alt="NetLink Resource Group, Inc."><o:p></o:p></p></td></tr></table><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>