<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML con formato previo Car";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLconformatoprevioCar
{mso-style-name:"HTML con formato previo Car";
mso-style-priority:99;
mso-style-link:"HTML con formato previo";
font-family:Consolas;
mso-fareast-language:ES;}
span.EstiloCorreo21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ES" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><br>
Already have checked that, SELinux is disables.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">[root@XXXXXXX httpd]# getenforce<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Disabled<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks for the suggestion.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Anyones, only stucks requests to SAML endpoints
</span><span style="font-size:10.0pt">/Shibboleth.sso/SAML2/POST</span><span style="mso-fareast-language:EN-US">) .<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">If I try Metadata or Status, it Works. Also if I do a request to a wrong endpoint
</span><span style="font-size:10.0pt">/Shibboleth.sso/SAML2/PO , it replies with an shibd error, so communication with shibd is working I guess.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt">Regarrds</span><span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>De:</b> Steven Premeau <steven.premeau@maine.edu> <br>
<b>Enviado el:</b> lunes, 9 de junio de 2025 15:22<br>
<b>Para:</b> Shib Users <users@shibboleth.net><br>
<b>CC:</b> Ignacio Amoeiro Bosch <ignacio.amoeiro@extern.ssib.es><br>
<b>Asunto:</b> Re: Apache Shibboleth SP Stuck at /Shibboleth.sso/SAML2/POST after IDP login<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellpadding="0" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="background:white;padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%">
<tbody>
<tr>
<td width="1%" style="width:1.0%;background:#FF3838;padding:5.25pt 1.5pt 5.25pt 1.5pt">
</td>
<td width="100%" style="width:100.0%;background:#FFE3E4;padding:5.25pt 3.75pt 5.0pt 11.25pt">
<p><span style="color:black">Aquest e-mail prové d'un remitent extern al IB-Salut. No faci clic en enllaços ni obri arxius adjunts, si no confia en l'emissor.<o:p></o:p></span></p>
<p><span style="color:black">Este e-mail proviene de un remitente externo al IB-Salut. No haga clic en enlaces ni abra archivos adjuntos, si no confía en el remitente.<o:p></o:p></span></p>
<p><span style="color:black"> <o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt">Is SELinux set to 'enforcing' on the system?<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">By default SELinux will prevent the communication between httpd and shibd on an "out of the box" RHEL system.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">See <a href="https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fshibboleth.atlassian.net%2fwiki%2fspaces%2fSP3%2fpages%2f2065335559%2fSELinux&umid=9ddcde70-64fb-48cb-bb5b-db396d87ffd1&rct=1749475316&auth=a519943a12ceb2e36c49780f98de389ccf711159-2bed8409031eff6bc516665d0fda3aa4550c70d9" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335559/SELinux</a>
for more information.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">If it is enforcing, and you do not want to disable enforcement, you can follow the link on the page above or you can google "selinux mod_shib-to-shibd" for (unsupported) examples of what might be required
to allow the communication between the two processes.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">Steve.<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt">On Mon, Jun 9, 2025 at 3:15 AM Ignacio Amoeiro Bosch via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal"><span style="font-size:10.0pt">Hi,<br>
<br>
I forgot to say, on server-status page all requests to /Shibboleth.sso/SAML2/POST are in W state (Sending Repply)<br>
<br>
Regards<br>
<br>
-----Mensaje original-----<br>
De: users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> En nombre de Ignacio Amoeiro Bosch via users<br>
Enviado el: lunes, 9 de junio de 2025 8:32<br>
Para: Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
CC: Ignacio Amoeiro Bosch <<a href="mailto:ignacio.amoeiro@extern.ssib.es" target="_blank">ignacio.amoeiro@extern.ssib.es</a>><br>
Asunto: Apache Shibboleth SP Stuck at /Shibboleth.sso/SAML2/POST after IDP login<br>
<br>
Aquest e-mail prové d'un remitent extern al IB-Salut. No faci clic en enllaços ni obri arxius adjunts, si no confia en l'emissor.<br>
Este e-mail proviene de un remitente externo al IB-Salut. No haga clic en enlaces ni abra archivos adjuntos, si no confía en el remitente.<br>
Hi Team,<br>
<br>
After migrating from RH8 to RH9, we've come across something weird on a Shibboleth SP on Apache.<br>
<br>
When we go to a protected resource ( /secure for example) we are being redirected to the IDP, and after login in, browser is stuck at /Shibboleth.sso/SAML2/POST without any error, it keeps there endless till browser timeout.<br>
<br>
This happens after migrating from Redhat8 to Redhat 9.5 ( I have other servers with 9.5 + SP working fine)<br>
<br>
Things I have tried:<br>
<br>
- Shibboleth SP clean install (rpm removed + depedencies, deleted /etc/shibboleth, and reinstalled from rockylinux9 repo).<br>
- Apache HTTPD clean install (rpm removed, deleted /etc/httpd, and reinstalled)<br>
<br>
<br>
Firewall is disabled<br>
Antivirus disabled<br>
<br>
As I said, the http request is not getting answered so, I can't see any error on apache logs or shibd logs.<br>
<br>
Apache httpd process are 100% CPU after I do the first request to /Shibboleth.sso/SAML2/POST endpoint.<br>
<br>
Every other public pages are working fine.<br>
<br>
I tried to set some loggers in apache or shibd to debug, but can't see anything relevant.<br>
<br>
And the worst, i don't see any error on apache logs or shibd logs.<br>
<br>
Any idea?<br>
<br>
Thanks.<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fshibboleth.atlassian.net%2fwiki%2fx%2fZYEpPw&umid=7e0aa5fa-9b7b-4ccf-8274-33175af8f15c&rct=1749450716&auth=a519943a12ceb2e36c49780f98de389ccf711159-7297fa116f9e2d20ae4856c4157299ace4b8c8e5" target="_blank">
https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fshibboleth.atlassian.net%2fwiki%2fx%2fZYEpPw&umid=7e0aa5fa-9b7b-4ccf-8274-33175af8f15c&rct=1749450716&auth=a519943a12ceb2e36c49780f98de389ccf711159-7297fa116f9e2d20ae4856c4157299ace4b8c8e5</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fshibboleth.atlassian.net%2fwiki%2fx%2fZYEpPw&umid=9ddcde70-64fb-48cb-bb5b-db396d87ffd1&rct=1749475316&auth=a519943a12ceb2e36c49780f98de389ccf711159-58cae741228479e83cb61ef498fe6c6cc74bb20c" target="_blank">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></span></p>
</blockquote>
</div>
</div>
</body>
</html>