<html><head>
<meta name="Generator" content="Novell Groupwise Client (Version 14.2.2 Build: 128215)">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head>
<body style="font: 10pt/normal Segoe UI; font-size-adjust: none; font-stretch: normal;"><div class="GroupWiseMessageBody" id="GroupWiseSection_1666794776000_Samsamoddin.Rajaei@bsb-muenchen.de_310B730118D300009562736233336463_"><div>Nate,</div><div><br></div><div>thank you for your hints. They helped me to move forward </div><div>T<span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'>he following Apache configuration<o:p></o:p></span></div><div><div><p class="MsoNormal"><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'><LocationMatch "/(eg|gtn)/"><br> <If "%{QUERY_STRING} =~ /auth_method=Shibboleth/"><br> AuthType shibboleth<br> Require shibboleth<br> ShibRequestSetting requireSession true<br> ShibUseHeaders On<br> </If><br>< /LocationMatch><o:p></o:p></span></p></div><div><p class="MsoNormal"><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'>is now able of sending desired Apache variabels to SP and I can see them in our Vufind application but only on the page with "?auth_method=Shibboleth". In other pages of the application (all under <URL>/eg or <URL>/gtn) they aren't available. I want only the page "<URL>/eg/?auth_method=Shibboleth" (and "<URL>/gtn/?auth_method=Shibboleth") to be restricted, but I want other pages to have access to the Apache variables too. Is it possible? How?</span></span></p><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'></span><div><p class="MsoNormal"><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'>If I add <o:p></o:p></span></p></div><div><p class="MsoNormal"><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'><Else><br> AuthType shibboleth<br> Require shibboleth<br>< /Else><o:p></o:p></span></p></div><div><p class="MsoNormal"><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'>to the configuration, then all pages are restricted and I will be redirected to IDP when I try to visit any appliaction page.</span></p><p class="MsoNormal"><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'><o:p>Regards Sam</o:p></span></p><p class="MsoNormal"><span style='font-family: "Segoe UI",sans-serif; font-size: 10pt;'><o:p>BTW I know that using of "ShibUseHeaders On" is not recommanded, but I want to get the whole system running and then solve this problem. At the moment without this parameter the variables are not sent.</o:p><br></span></p></div></span><p class="MsoNormal"><br></p></div></div><div class="GroupWiseMessageBody" id="GroupWiseSection_1666794775000_Samsamoddin.Rajaei@bsb-muenchen.de_310B730118D300009562736233336463_"><span class="GroupwiseReplyHeader">>>> Nate Klingenstein <ndk@sudonym.me> 19.10.2022 21:05 >>><br></span><div>
<div dir="auto"><div>Sam,</div><div dir="auto"><br></div><div dir="auto">We would have to know a lot more about your configuration to tell you for sure, but given that the attributes are being set but not populated, the most likely explanation by far is that you don't have the page itself protected by Shibboleth. Cookies will always be sent by the browser, but attributes will not be provided to unprotected resources.</div><div dir="auto"><br></div><div dir="auto">This can be done either in the httpd configuration or in shibboleth2.xml, but it's generally cleaner to do it in the httpd configuration.</div><div dir="auto"><br></div><div dir="auto">You can verify my hunch by placing a phpinfo page in a directory with a /secure URL path and accessing it, or more preferably, look at the configuration for /secure that the installer generated in /etc/httpd/conf.d/shib.conf and port it appropriately to protect the URL path for your page.</div><div dir="auto"><br></div><div dir="auto">Hope this helps,</div><div dir="auto">Nate<br><br><div class="gmail_quote" dir="auto"><div class="gmail_attr" dir="ltr">On Wed, Oct 19, 2022, 3:39 AM Samsamoddin Rajaei <<a href="mailto:Samsamoddin.Rajaei@bsb-muenchen.de">Samsamoddin.Rajaei@bsb-muenchen.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<div style="font: 10pt/normal Segoe UI; font-size-adjust: none; font-stretch: normal;"><div id="m_5347252660786715265GroupWiseSection_1666172035000_Samsamoddin.Rajaei@bsb-muenchen.de_310B730118D300009562736233336463_"><div>Hello everybody,</div><div><br></div><div>I am trying to connect our Vufind application with Shibboleth SP and can not get SP to forward environement variables back to Vufind. <br>When in Vufind application I click the login link, I will be forwarded to the configured federation and then to our test-idp. After entering my credentials I will be forwarded back to my configured "sessionHook"-Page, where I output the phpinfo.</div><div><br></div><div>In SP transaction log file I see following entries: <br>New session (ID: _804ca556ed17194f42e849338182672f) with (applicationId: historicumtest) for principal from (IdP: ...) at (ClientAddress: ...) with (NameIdentifier: none) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _96593f1b531e459c466f3cf6702acb80) <br>Cached the following attributes with session (ID: _804ca556ed17194f42e849338182672f) for (applicationId: historicumtest) {<br> uid (1 values) <br> targeted-id (1 values) <br> affiliation (1 values) <br> entitlement (1 values) <br>}<br>In phpinfo I can see different Shibboleth cookies among others the session cookie with the same id as in log file ( _shibsession_nnn=ID). But I don't see any of shibboleth statndard apache environement variables, like Shib-Application-ID and Shib-Identity-Provider nor anything of uid, targeted-id, affiliation and entitlement.<br>How can I get uid, targeted-id ,... forwarded to my "sessionHook"-Page?<br> </div><div>Thank you for any hint.</div><div>Sam</div><div>Bavarian State library - Munich<br></div></div></div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" target="_blank" rel="noreferrer noreferrer">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div></div>
</div></div></div></body></html>