<div dir="ltr"><p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><span style="color:black">Hi, I'm
running into a loop problem with Shibboleth over SSL. But it</span></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><span style="color:black">doesn't
appear to be any of the usual issues that people run into.</span></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><span style="color:black">Basically,
it looks like the /Shibboleth.sso/SAML2/POST request is not</span></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><span style="color:black">sending a
cookie in the response and therefore not setting a cookie in the</span></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><span style="color:black">browser
and so I get stuck in an authentication loop.<br></span><span style="color:rgb(0,0,0);font-size:14.6667px">I am using Azure AD with Shibboleth SP.</span><span style="color:black"><br></span></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">All requests are going over SSL.</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">We are also using our own authentication and login
(<a href="http://example.com/login">example.com/login</a>), users with azure account will go to <a href="http://example.com/shib">example.com/shib</a> to
authenticate, so maybe this is the problem?</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">Sadly the web app is running inside our domain so it is not
exposed to public.</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">Thanks:)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">-Gregor</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">Shibd.log:</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:37 DEBUG Shibboleth.Listener [1]:
dispatching message (default::getHeaders::Application)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:37 DEBUG Shibboleth.Listener [2]:
dispatching message (default::getHeaders::Application)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:37 DEBUG Shibboleth.Listener [3]:
dispatching message (default::getHeaders::Application)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:37 DEBUG Shibboleth.Listener [5]:
dispatching message (default::getHeaders::Application)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:37 DEBUG Shibboleth.Listener [4]:
dispatching message (default::getHeaders::Application)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG Shibboleth.Listener [4] [default]:
dispatching message (default/Login::run::SAML2SI)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG XMLTooling.StorageService [4]
[default]: inserted record (8432a103eddf078bb86a437c876f883de8ddfa0b8d52cff4736eecf686888287)
in context (RelayState) with expiration (1659092082)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG
OpenSAML.MessageEncoder.SAML2Redirect [4] [default]: validating input</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG
OpenSAML.MessageEncoder.SAML2Redirect [4] [default]: marshalling, deflating,
base64-encoding the message</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG
OpenSAML.MessageEncoder.SAML2Redirect [4] [default]: marshalled message:</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL=<a href="https://example.com/Shibboleth.sso/SAML2/POST" style="color:rgb(5,99,193)">https://example.com/Shibboleth.sso/SAML2/POST</a>
Destination=<a href="https://login.microsoftonline.com/0a084bbe-8d88-4a38-a716-f33ffea70258/saml2" style="color:rgb(5,99,193)">https://login.microsoftonline.com/0a084bbe-8d88-4a38-a716-f33ffea70258/saml2</a>
ID="_d4649ee0db0ab0852c266aff1b60023f"
IssueInstant="2022-07-29T10:44:42Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://example.com/shibboleth%3c/saml:Issuer%3e%3csamlp:NameIDPolicy" style="color:rgb(5,99,193)">https://example.com/shibboleth</saml:Issuer><samlp:NameIDPolicy</a>
AllowCreate="1"/></samlp:AuthnRequest></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG
OpenSAML.MessageEncoder.SAML2Redirect [4] [default]: message encoded, sending
redirect to client</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG Shibboleth.Listener [4] [default]:
dispatching message (default/Login::run::SAML2SI)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG XMLTooling.StorageService [4]
[default]: inserted record (e6339e249e425f618ddf153b37e8f1e9083a84bff246c473622d3235accdcacb)
in context (RelayState) with expiration (1659092082)</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG
OpenSAML.MessageEncoder.SAML2Redirect [4] [default]: validating input</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG
OpenSAML.MessageEncoder.SAML2Redirect [4] [default]: marshalling, deflating,
base64-encoding the message</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG
OpenSAML.MessageEncoder.SAML2Redirect [4] [default]: marshalled message:</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL=<a href="https://tmp.imagine.si/Shibboleth.sso/SAML2/POST" style="color:rgb(5,99,193)">https://<span style="color:windowtext;text-decoration-line:none"> </span>example.com
/Shibboleth.sso/SAML2/POST</a> Destination=<a href="https://login.microsoftonline.com/0a084bbe-8d88-4a38-a716-f33ffea70258/saml2" style="color:rgb(5,99,193)">https://login.microsoftonline.com/0a084bbe-8d88-4a38-a716-f33ffea70258/saml2</a>
ID="_ecd8905ac76e344e04e39907005140af"
IssueInstant="2022-07-29T10:44:42Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://tmp.imagine.si/shibboleth%3c/saml:Issuer%3e%3csamlp:NameIDPolicy" style="color:rgb(5,99,193)">https://<span style="color:windowtext;text-decoration-line:none"> </span>example.com
/shibboleth</saml:Issuer><samlp:NameIDPolicy</a>
AllowCreate="1"/></samlp:AuthnRequest></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">2022-07-29 10:44:42 DEBUG OpenSAML.MessageEncoder.SAML2Redirect
[4] [default]: message encoded, sending redirect to client</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">Apache config:</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><VirtualHost *:80></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> DocumentRoot
"${APACHE_DOCUMENT_ROOT}/ProjektiWeb/imWeb.ERP/public/"</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> ServerName <a href="http://example.com">example.com</a></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> RewriteEngine On</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> ErrorLog ${APACHE_LOG_DIR}/error.log</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> CustomLog ${APACHE_LOG_DIR}/access.log
combined</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> <Location /shib></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> AuthType shibboleth</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> ShibRequestSetting
requireSession 1</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> require valid-user</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </Location></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> <Location /Shibboleth.sso></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> AuthType shibboleth</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> ShibRequestSetting
requireSession 1</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> require valid-user</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"></Location></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"></VirtualHost></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<pre style="margin:0cm 0cm 0.0001pt;font-size:10pt;font-family:"Courier New""><span style="color:black">shibboleth2.xml file (parts that i changed):</span></pre>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><ApplicationDefaults entityID=<a href="https://example.com/shibboleth" style="color:rgb(5,99,193)">https://example.com/shibboleth</a></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
REMOTE_USER="eppn subject-id pairwise-id persistent-id"</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
<Sessions lifetime="28800" timeout="3600"
relayState="ss:mem"</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
consistentAddress="true" handlerURL="/Shibboleth.sso"</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
checkAddress="false" handlerSSL="true"
cookieProps="https"></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
<SSO entityID=<a href="https://sts.windows.net/yyyyyy-8d88-4a38-a716-xxxxxxxx/" style="color:rgb(5,99,193)">https://sts.windows.net/yyyyyy-8d88-4a38-a716-xxxxxxxx/</a></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
discoveryProtocol="SAMLDS" discoveryURL=<a href="https://ds.example.org/DS/WAYF" style="color:rgb(5,99,193)">https://ds.example.org/DS/WAYF</a>></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
SAML2</p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif">
</SSO></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"><MetadataProvider type="XML"
validate="false" path="partner-metadata.xml"/></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"></ApplicationDefaults></p>
<p class="MsoNormal" style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif"> </p></div>