<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Segoe UI";
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Also this in the server.xml, in particular relaxing the constraint on the attribute names (allowedRequestAttributesPattern)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false" secretRequired="false" allowedRequestAttributesPattern=".*"/><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Spencer Thomas <Spencer.Thomas@ithaka.org><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Thursday, March 26, 2020 at 9:03 AM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: Configuring Apache 2.4 with Shibboleth SP 3.0.4<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">How are you connecting from Apache to your protected application?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">If you have a Java app, have you configured AJP forwarding? Here’s the stanza from our apache configuration:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Listen 80<o:p></o:p></p>
<p class="MsoNormal">Listen 8080<o:p></o:p></p>
<p class="MsoNormal"><VirtualHost *:80 *:8080><o:p></o:p></p>
<p class="MsoNormal"> ProxyPass /secure ajp://localhost:8009/secure<o:p></o:p></p>
<p class="MsoNormal"> ProxyPassReverse /secure ajp://localhost:8009/secure<o:p></o:p></p>
<p class="MsoNormal"> ProxyPass /start ajp://localhost:8009/start<o:p></o:p></p>
<p class="MsoNormal"> ProxyPassReverse /start ajp://localhost:8009/start<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> ServerName https://<o:p></o:p></p>
<p class="MsoNormal"></VirtualHost><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of "Christopher J. Hinkle" <chinkle@netlinkrg.com><br>
<b>Organization: </b>NetLink Resource Group, Inc.<br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Wednesday, March 25, 2020 at 10:22 PM<br>
<b>To: </b>"users@shibboleth.net" <users@shibboleth.net><br>
<b>Subject: </b>Configuring Apache 2.4 with Shibboleth SP 3.0.4</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">It’s MOSTLY working. But mostly isn’t good enough, and I need some advice.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">Environment: Ubuntu 18.04.5 kernel 4.15.0-1063-aws / Apache 2.4.41 with PHP 7.2.28 / Shibboleth SP 3.0.4 (via libapache2-mod-shib and shibboleth installed via apt with this repo: https://pkg.switch.ch/switchaai/ubuntu/dists/bionic/main/binary-all/misc/switchaai-apt-source_1.0.0ubuntu1_all.deb)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">I’m to the point where I can authenticate with the IdP and I receive the SAML response, and the Shibboleth session gets set up. Navigating to /Shibboleth.sso/Session and /Shibboleth.sso/Status
work properly and show that I’ve been authenticated. The NameID attribute is filled with my logon name.
</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">The problem is that
<b>my application can’t seem to see the authentication info</b>. None of the Shibboleth environment variables get set in Apache for the session… REMOTE_USER is not there, nor is Shib-Identity-Provider or any other Shib* variable. My logs are set to debug
level, and I see “shib_fixups entered in pid” messages but nothing about adding variables.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">After I authenticate, when I try to access the site after declaring in the application’s VirtualHost directive, for example, the following:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> <Location /login></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> AuthType None</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> Require all granted</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> </Location></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> <Location /></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> AuthType shibboleth</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> ShibRequestSetting requireSession false</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> Require shibboleth</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> </Location></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> <Location /Shibboleth.sso></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> SetHandler shib</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas"> </Location>
</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">I get 500 errors with the following sample apache error log entries:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449533 2020] [mod_shib:debug] [pid 25353] mod_shib.cpp(369): [client 10.0.1.96:17652] get_request_config created per-request structure</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449565 2020] [ssl:debug] [pid 25353] ssl_engine_kernel.c(383): [client 10.0.1.96:17652] AH02034: Initial (No.1) HTTPS request received for child 2 (server mytestserver.example.com:443)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449696 2020] [mod_shib:debug] [pid 25353] mod_shib.cpp(1613): [client 10.0.1.96:17652] shib_base_check_authz found uninitialized request object</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449702 2020] [authz_core:debug] [pid 25353] mod_authz_core.c(820): [client 10.0.1.96:17652] AH01626: authorization result of Require shibboleth : denied (no authenticated
user yet)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449706 2020] [authz_core:debug] [pid 25353] mod_authz_core.c(820): [client 10.0.1.96:17652] AH01626: authorization result of <RequireAny>: denied (no authenticated
user yet)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449711 2020] [mod_shib:debug] [pid 25353] mod_shib.cpp(783): [client 10.0.1.96:17652] shib_check_user entered in pid (25353)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449764 2020] [authn_core:error] [pid 25353] [client 10.0.1.96:17652] AH01796: AuthType shibboleth configured without corresponding module</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449780 2020] [headers:debug] [pid 25353] mod_headers.c(900): AH01503: headers: ap_headers_error_filter()</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">[Wed Mar 25 17:09:18.449883 2020] [ssl:debug] [pid 25353] ssl_engine_io.c(1106): [client 10.0.1.96:17652] AH02001: Connection closed to child 2 with standard shutdown (server mytestserver.example.com:443)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">but then I go to https://mytestserver.example.com/Shibboleth.sso/Session and see</span><o:p></o:p></p>
<p class="MsoNormal"><u><span style="font-size:8.0pt;font-family:"Courier New";color:black">Miscellaneous</span></u><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Courier New";color:black">Session Expiration (barring inactivity):</span></b><span style="font-size:8.0pt;font-family:"Courier New";color:black"> 430 minute(s)</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Courier New";color:black">Client Address:</span></b><span style="font-size:8.0pt;font-family:"Courier New";color:black"> 10.0.1.96</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Courier New";color:black">SSO Protocol:</span></b><span style="font-size:8.0pt;font-family:"Courier New";color:black"> urn:oasis:names:tc:SAML:2.0:protocol</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Courier New";color:black">Identity Provider:</span></b><span style="font-size:8.0pt;font-family:"Courier New";color:black"> MYEXAMPLEIDP-ENTITYID</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Courier New";color:black">Authentication Time:</span></b><span style="font-size:8.0pt;font-family:"Courier New";color:black"> 2020-03-25T20:26:09.130Z</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Courier New";color:black">Authentication Context Class:</span></b><span style="font-size:8.0pt;font-family:"Courier New";color:black"> urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Courier New";color:black">Authentication Context Decl:</span></b><span style="font-size:8.0pt;font-family:"Courier New";color:black"> (none)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New";color:black"> </span><o:p></o:p></p>
<p class="MsoNormal"><u><span style="font-size:8.0pt;font-family:"Courier New";color:black">Attributes</span></u><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Courier New";color:black">NameID</span></b><span style="font-size:8.0pt;font-family:"Courier New";color:black">: jsmit628</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">and https://mytestserver.example.com/Shibboleth.sso/Status:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><StatusHandler time="2020-03-25T21:16:59Z"></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Version Xerces-C="3.2.0" XML-Tooling-C="3.0.5" XML-Security-C="2.0.2" OpenSAML-C="3.0.1" Shibboleth="3.0.4"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><NonWindows sysname="Linux" nodename="myhostname" release="4.15.0-1063-aws" version="#67-Ubuntu SMP Mon Mar 2 07:24:29 UTC 2020" machine="x86_64"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><SessionCache></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><OK/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"></SessionCache></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Application id="default" entityID="MYEXAMPLESP-ENTITYID"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><MetadataProvider source="/etc/shibboleth/MYEXAMPLEIDP-ENTITYID.xml" lastUpdate="2020-03-25T19:17:22Z"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Handlers></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Handler type="AssertionConsumerService" Location="/SAML2/POST" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Handler type="SessionInitiator" Location="/Login"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Handler type="LogoutInitiator" Location="/Logout"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Handler type="LogoutInitiator" Location="/Logout/Admin"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Handler type="MetadataGenerator" Location="/Metadata"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Handler type="Status" Location="/Status"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Handler type="Session" Location="/Session"/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"></Handlers></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><md:KeyDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" use="signing">...</md:KeyDescriptor></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><md:KeyDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" use="encryption">...</md:KeyDescriptor></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><Status></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"><OK/></span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:8.0pt;font-family:"Courier New";color:black"></Status></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Courier New";color:black"></StatusHandler></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">My /var/log/shibboleth/transaction.log shows these entries:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">2020-03-25 16:25:52|Shibboleth-TRANSACTION.AuthnRequest|||MYEXAMPLEIDP-ENTITYID||||||urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST||||||</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:Consolas">2020-03-25 16:26:09|Shibboleth-TRANSACTION.Login|jsmit628|_1b2688e008f0c9f7a5c81bded3ff4cdb|MYEXAMPLEIDP-ENTITYID|HWveYbCHEeoQpUwxtQ.1MfedLhF|urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified|2020-03-25T16:26:09|NameID(1)|jsmit628|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST||urn:oasis:names:tc:SAML:2.0:status:Success|||Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36|10.0.1.96</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">To be clear, when I’ve tried to examine the environment variables like REMOTE_USER, I can only get that information if I omit the <Location> declarations from the Apache VirtualHost
config… otherwise attempts to view the application return 500 errors.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">Where am I going wrong? I’ve been beating my head against a wall for a couple weeks on this. I’d appreciate any insight. Happy to provide more information as well.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">Thank you,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI"">chris.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Segoe UI""> </span><o:p></o:p></p>
<div>
<div>
<div>
<div class="MsoNormal">
<hr size="1" width="30" style="width:22.5pt" noshade="" style="color:#A0A0A0" align="left">
</div>
</div>
</div>
</div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left">
<tbody>
<tr>
<td width="50%" style="width:50.0%;padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:#3C3625"><a href="https://www.linkedin.com/in/chinkle"><span style="color:#772432;text-decoration:none">Christopher J. Hinkle, CISSP</span></a><br>
he/him/his<br>
<a href="tel:+17033383850p110"><span style="color:#772432;text-decoration:none">+1 703.299.1580 x110</span></a>
</span><o:p></o:p></p>
</td>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;font-family:"Tahoma",sans-serif;color:#3C3625"><a href="mailto:chinkle@netlinkrg.com"><span style="color:#772432;text-decoration:none">chinkle@netlinkrg.com</span></a><br>
NetLink Resource Group, Inc.<br>
<a href="https://www.netlinkrg.com/"><span style="color:#772432;text-decoration:none">www.netlinkrg.com</span></a></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td colspan="2" style="padding:3.75pt 0in 0in 0in">
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="border:solid windowtext 1.0pt;padding:0in"><img border="0" width="317" height="86" style="width:3.302in;height:.8958in" id="_x0000_i1025" src="cid:~WRD000.jpg" alt="Image removed by sender. NetLink Resource Group, Inc."></span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</body>
</html>