<div dir="ltr">Pez,<div><br></div><div>I don't see anything immediately wrong with the configuration there. The trailing slash shouldn't matter. Do you have any overriding directives(like Directory blocks or .htaccess files) elsewhere in Apache's configuration?</div><div><br></div><div>It's going to take some digging, but I think this is almost certainly an Apache configuration issue.</div><div><br></div><div>Hope this helps, and I can understand why you're scratching your heads,</div><div>Nate</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 25, 2022 at 2:02 PM Chris Lopez <<a href="mailto:pez@gwu.edu">pez@gwu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Nate,<div><br></div><div>Yes it is an Apache 403 error.</div><div><br></div><div>I followed the documentation online as well as the examples that came with shibboleth for Apache 2.4</div><div><br></div><div>These are the configurations inside the apache virtualhost configs. </div><div><br></div><div>NOTE 1: I attempted configurations with and without a trailing slash after the /secure Location.</div><div>NOTE 2: I have X'd out the entity id</div><div><br></div><div><div style="color:rgb(212,212,212);background-color:rgb(30,30,30);font-family:Menlo,Monaco,"Courier New",monospace;font-size:12px;line-height:18px;white-space:pre-wrap"><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span><br></span></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span><Location /Shibboleth.sso></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>Require all granted</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>SetHandler shib</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span></Location></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0);min-height:13px"><span style="font-variant-ligatures:no-common-ligatures"></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span><Location /secure/></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>AuthType shibboleth</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>ShibRequestSetting requireSession 1</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>ShibRequestSetting entityID <a href="https://sts.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/" target="_blank">https://sts.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx/</a></span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>require shib-session</span></p><p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Menlo;color:rgb(33,255,6);background-color:rgb(0,0,0)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span></Location></span></p>
</div></div><div><br></div><div>Thanks</div><div>Chris</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 25, 2022 at 3:51 PM Nate Klingenstein <<a href="mailto:ndk@sudonym.me" target="_blank">ndk@sudonym.me</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Chris,<div><br></div><div>Making the assumption that you're getting the 403 from Apache, the authorization directives changed radically between versions 2.2 and 2.4. Check the Apache settings that you have protecting that location to make sure they match the OOTB configuration shipped with 3.3.</div><div><br></div><div>If that all looks normal, we'll need more details.</div><div><br></div><div>Take care,</div><div>Nate</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jan 25, 2022 at 1:43 PM Chris Lopez via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">I was previously setup in a environment with coldfusion 11, apache 2.2 and Shibboleth SP 2.0, and we had the environment working perfectly.<div><br></div><div>We have recently setup a new environment with coldfusion 2018, apache 2.4 and Shibboleth SP 3.0. We have all of our configurations (both shibboleth, and apache) in place as they should be. When attempting to test, the user gets routed to authenticate (as it should), and the authentication process is successful (as it should). After authentication, it routes to /secure where it then shows a 403 Forbidden message. </div><div><br></div><div>I noticed that it adds a slash at the end (/secure/), and thought that might be a problem, however, I don't believe that is the issue as (#1) the old environment behaves the same way and (#2) I added trailing slashes in the Location /secure/ settings as well. This had no effect, leading me to believe that isn't the issue. </div><div><br></div><div>I have verified by going to /Shibboleth.sso/Sessions, checking transaction and shib logs, as well as using Chrome Developer Tools > Network > cookies, that a session indeed has been created, however the /secure Location is still throwing a 403 Forbidden.</div><div><br></div><div>Our Identity guy and myself are banging our heads against the wall on this one... Please Help !!</div><div><br></div><div>Thanks</div><div>Pez</div></div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>
</blockquote></div>
</blockquote></div>