<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Christopher,<br>
Thank you very much for your reply. I'm a bit out of my depth in
web server configuration here. <br>
<br>
I can view the shibboleth protected back-end target file: it sends
a _shibsession_ cookie along with the 302 redirect, makes a quick
round-trip through the IdP, and it sends a _shibsession_ cookie
along with the content. If I try to access the front-end page the
same target is redirecting to the IdP and is _not_ including the
existing _shibsession_ cookie for the back end site.<br>
<br>
If I leave the site as it was, using HTTP-Redirect, and the
_shibsession_ cookie exists, wouldn't it make an appropriate
circuit and return the data that the front-end site needs?<br>
<br>
I changed the HTTP-Redirect to HTTP-POST, and then the 200
"success" page returned from the call is:<br>
<br>
Note: Since your browser does not support JavaScript, you must
press<br>
the Continue button once to proceed to the authentication
service.<br>
[ Continue ]<br>
<br>
<br>
Please feel free to tell me I'm missing something obvious.<br>
Thanks!<br>
Allan<br>
<br>
On 2020/08/19 11:02 AM, Christopher Bongaarts wrote:<br>
</div>
<blockquote type="cite"
cite="mid:57f9941b-1053-1f21-0f03-c78fa79e04fe@umn.edu">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div><span
style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#FA4616"><b>[External
Email]</b></span>
</div>
<table width="100%" cellspacing="0" cellpadding="0" border="0"
align="left">
</table>
<div>
<div class="moz-cite-prefix">My guide to doing this (which
others have reported issues with, though we did have it
working at one point in the past) is here:</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><a class="moz-txt-link-freetext"
href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_IDP30_Cross-2Dorigin-2BAJAX-2Brequests-2Bfor-2BShib-2Dprotected-2Bresources&d=DwMDaQ&c=sJ6xIWYx-zLMB3EPkvcnVg&r=ShjSugJjxZV-LntxbSRXig&m=btdjvuEVkCjEyLjuNzOtWvZ5YHtkArvfG5TCcn6VbtM&s=1e6F2-oFSuiQlCMZmRDG8xfFqfyv-8iO-CEXGQn4xyk&e="
moz-do-not-send="true">https://wiki.shibboleth.net/confluence/display/IDP30/Cross-origin+AJAX+requests+for+Shib-protected+resources</a><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I've tried to call out why the
various parts are needed. In this case:
<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">If the shib-protected site is using
HTTP-Redirect, it won't work because XmlHttpRequest follows
them and does not propagate the necessary headers. You need
to force HTTP-POST instead; for the Shib SP, you can do this:</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<div class="container" title="Hint: double-click to select
code">
<div class="line number1 index0 alt2"><code class="xml
plain"><</code><code class="xml keyword">SSO</code>
<code class="xml color1">entityID</code><code class="xml
plain">=</code><code class="xml string">"<a
href="https://urldefense.proofpoint.com/v2/url?u=https-3A__idp.example.edu_idp_shibboleth&d=DwMDaQ&c=sJ6xIWYx-zLMB3EPkvcnVg&r=ShjSugJjxZV-LntxbSRXig&m=btdjvuEVkCjEyLjuNzOtWvZ5YHtkArvfG5TCcn6VbtM&s=qH7ubCsy53YG94G26tX8CNBLZTbbTN-3j4qFQtRVDlE&e="
moz-do-not-send="true">https://idp.example.edu/idp/shibboleth</a>"</code>
<code class="xml color1">outgoingBindings</code><code
class="xml plain">=</code><code class="xml string">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</code><code
class="xml plain">></code></div>
<div class="line number2 index1 alt1"><code class="xml
spaces"> </code><code class="xml plain">SAML2</code></div>
<div class="line number3 index2 alt2"><code class="xml
plain"></</code><code class="xml keyword">SSO</code><code
class="xml plain">></code></div>
</div>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 8/18/2020 12:46 PM, Allan West
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:59197d40-9dc3-09eb-3012-d668db186a17@ufl.edu">
<pre class="moz-quote-pre" wrap="">I need some advice on current, working practices to allow calls from
another site into a shibboleth-protected site. We are getting CORS
errors in the browsers for AJAX calls and other methods that try to call
content from a shibboleth protected site. These services worked until
recently, and now they do not, almost certainly because of increased
security settings in browsers.
What are others doing to allow CORS calls into shibboleth protected sites?
I had a separate thread, "Shib SP to IDP missing header for CORS" based
on my problems with trouble-shooting. I learned that headers can be set
and carried from the SP to the IdP. However, but those headers will
never be passed through the IdP, nor does the IdP seem happy with the
request to authenticate / validate the connection. In Firefox Inspector
traces, the shibboleth-protected site uses a 302 redirect to the IdP to
validate, and the IdP errors on CORS, causing both SP and IdP lines to show:
CORS Missing Allow Origin
That means we need to be allowing this access in some other way, but I
haven't found a good statement of practice on what anyone is doing right
now to allow CORS calls into a shibboleth protected site.
Thanks,
Allan West
UFIT linux system administrator
<a class="moz-txt-link-abbreviated" href="mailto:allan@ufl.edu" moz-do-not-send="true">allan@ufl.edu</a>
</pre>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu" moz-do-not-send="true">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="https://urldefense.proofpoint.com/v2/url?u=http-3A__umn.edu_-7Ecab&d=DwMDaQ&c=sJ6xIWYx-zLMB3EPkvcnVg&r=ShjSugJjxZV-LntxbSRXig&m=btdjvuEVkCjEyLjuNzOtWvZ5YHtkArvfG5TCcn6VbtM&s=GMbuIB-4Jrbej91KT5UE9C3jlG0NtBb3-YEYoIZoJCQ&e=" moz-do-not-send="true">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
</blockquote>
<br>
</body>
</html>