<div dir="ltr">Hello All, <div><br></div><div>I am still looking for some suggestions on this.<div><br></div><div>Thanks,</div><div>Asif</div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 7, 2021 at 2:07 PM <<a href="mailto:vadud3@gmail.com">vadud3@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><br>On Wed, Jul 7, 2021 at 5:37 AM Peter Schober <<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>> wrote:<br>><br>> * <a href="mailto:vadud3@gmail.com" target="_blank">vadud3@gmail.com</a> <<a href="mailto:vadud3@gmail.com" target="_blank">vadud3@gmail.com</a>> [2021-07-06 23:19]:<br>> > We’ve tried following the following two links / options, but couldn’t<br>> > get it working:<br>> ><br>> > <a href="https://wiki.cac.washington.edu/pages/viewpage.action?pageId=61703128" target="_blank">https://wiki.cac.washington.edu/pages/viewpage.action?pageId=61703128</a><br>> ><br>> > <a href="https://wiki.cac.washington.edu/pages/viewpage.action?pageId=28939166" target="_blank">https://wiki.cac.washington.edu/pages/viewpage.action?pageId=28939166</a><br>> [...]<br>> > We are looking to see if we are going down the right path. Which<br>> > option should we be trying to complete? Should we be trying to do<br>> > this under 1 entityID or use separate entityIDs for each site that we<br>> > have?<br>><br>> 1. Contrary to popular belief "couldn't get it working" is not a<br>> technical error description that would enable anyone to help you solve<br>> your problem.<br>><br>> 2. Those instructions are not from the official software documentation<br>> (which doesn't mean they're bad) and expecting people to read 3rd<br>> party documentation only to help you fix a problem you haven't even<br>> described is asking a bit much, IMO.<br>><br>> 3. Only you can know whether one entityID will suffice for your use<br>> case or not. Of course you also don't mention anything about the<br>> number or kind of services so it's impossible for anyone else to say.<br>> Follwing Occam's razor a single one should suffice unless you *know*<br>> your use case requires multiple.<br>> (If the IDPs need to be able to differentiate those logical SPs in<br>> order to apply differing policies then you'll likely need multiple<br>> entityIDs for the logical SPs. If you can get away without that avoid<br>> it, of course.)<br>><br>> -peter<br>> --<br>> For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br><br>I have a cluster of jira application nodes behind a set of proxy servers running apache 2.4. These proxy servers<br>are also setup as SP providers<br><br>Here is the current relevant config (sanitized)<br><br>node1-vhost.conf<br>=============<br><Location /jira><br> <If "%{REQUEST_URI} =~ m#^/(jira/server-info|jira/s/).*#"><br> Satisfy Any<br> </If><br> <If "%{REQUEST_URI} =~ m#^/jira/rest/collectors/.*#"><br> RequestHeader set X-Atlassian-Token nocheck<br> </If><br> Order allow,deny<br> Allow from all<br> AuthType Shibboleth<br> Header set X-Forwarded-Proto "https"<br> ShibUseHeaders On<br> ShibRequestSetting requireSession true<br> <b>ShibRequestSetting applicationId node1</b><br> <RequireAny><br> Require shib-attr AuthType "standard, x509, securePlus2, securePlus3, piv"<br> Require shib-attr AppAuth true<br> Require shib-attr idp <a href="https://sts.example.net/76c-94d-4a2-bb7a-2354a/" target="_blank">https://sts.example.net/76c-94d-4a2-bb7a-2354a/</a><br> </RequireAny><br></Location><br><br>discovery file shibboleth-ds.conf<br>=========================<br><IfModule mod_alias.c><br> <Location /shibboleth-ds><br> Allow from all<br> <IfModule mod_shib.c><br> AuthType shibboleth<br> ShibRequestSetting requireSession false<br> require shibboleth<br> </IfModule><br> </Location><br> Alias /shibboleth-ds/idpselect_config.js /etc/shibboleth-ds/idpselect_config.js<br> Alias /shibboleth-ds/idpselect.js /etc/shibboleth-ds/idpselect.js<br> Alias /shibboleth-ds/idpselect.css /etc/shibboleth-ds/idpselect.css<br> Alias /shibboleth-ds/index.html /etc/shibboleth-ds/index.html<br> Alias /shibboleth-ds/blank.gif /etc/shibboleth-ds/blank.gif<br></IfModule><br><br>shibboleth2.xml (note: <a href="http://server.example.org" target="_blank">server.example.org</a> is cluster front end)<br>===============================================<br> <ApplicationDefaults id="default" entityID="<a href="https://server.example.org" target="_blank">https://server.example.org</a>"<br> REMOTE_USER="nameid eppn uid persistent-id targeted-id" signing="true" encryption="true"><br><br> <Sessions lifetime="28800" timeout="1800" relayState="ss:mem"<br> checkAddress="false" consistentAddress="false" handlerSSL="true" cookieProps="https"><br> <SSO discoveryProtocol="SAMLDS" discoveryURL="<a href="https://server.example.org/shibboleth-ds/index.html" target="_blank">https://server.example.org/shibboleth-ds/index.html</a>"><br> SAML2 SAML1<br> </SSO><br> <Logout>SAML2 Local</Logout><br> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br> ......<br> </Sessions><br> <<b>ApplicationOverride id="node1" entityID="<a href="https://node1.example.org" target="_blank">https://node1.example.org</a>"</b>/><br> <ApplicationOverride id="node2" entityID="<a href="https://node2.example.org" target="_blank">https://node2.example.org</a>"/><br> <ApplicationOverride id="node3" entityID="<a href="https://node3.example.org" target="_blank">https://node3.example.org</a>"/><br> </ApplicationDefaults><br><br>I can get to <a href="https://server.example.org/jira" target="_blank">https://server.example.org/jira</a> and authentication works fine.<br>saml request for server<br><br><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="<a href="https://server.example.org/Shibboleth.sso/SAML2/POST" target="_blank">https://server.example.org/Shibboleth.sso/SAML2/POST</a>" Destination="<a href="https://ssotest.example.org/adfs/ls/" target="_blank">https://ssotest.example.org/adfs/ls/</a>" ID="_8b4283a72909133856ada1a3c3e61118" IssueInstant="2021-07-07T17:25:34Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><br> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://server.example.org" target="_blank">https://server.example.org</a></saml:Issuer><br> <samlp:NameIDPolicy AllowCreate="1"/><br></samlp:AuthnRequest><div><br>But I am failing when I try to connect to <a href="https://node1.example.org/jira" target="_blank">https://node1.example.org/jira</a>. It gives me an (I think from IdP) error saying an error orrcured and provides some parameters in error </div><div>details like Activity ID, Relying party, User agent string, etc.</div><div><br>saml request for node1<br><br><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="<a href="https://node1.example.org/Shibboleth.sso/SAML2/POST" target="_blank">https://node1.example.org/Shibboleth.sso/SAML2/POST</a>" Destination="<a href="https://ssotest.example.org/adfs/ls/" target="_blank">https://ssotest.example.org/adfs/ls/</a>" ID="_a672076156126c72dfe845759e79a7e7" IssueInstant="2021-07-07T17:10:41Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><br> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://server.example.org" target="_blank">https://server.example.org</a></saml:Issuer><br> <samlp:NameIDPolicy AllowCreate="1"/><br></samlp:AuthnRequest><br><br>Looking for some help to troubleshoot this. <br><br>-- <br>Asif Iqbal<br>PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu" target="_blank">pgp.mit.edu</a><br>A: Because it messes up the order in which people normally read text.<br>Q: Why is top-posting such a bad thing?</div></div>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Asif Iqbal<br>PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu" target="_blank">pgp.mit.edu</a><br>A: Because it messes up the order in which people normally read text.<br>Q: Why is top-posting such a bad thing?<br><br></div>