Forum Replies Created

Viewing 9 replies - 1 through 9 (of 9 total)
  • james,
    i moved the test.php page into wp top directory. i am redirected to the logon page, but, after the login, i get this error:

    SWITCH Attribute Viewer
    
    Attributes	Values
    No valid Shibboleth session!
    This web page is probably not protected with Shibboleth. Hint to Home Organization administrators:
    Have a look at your web server or Shibboleth configuration

    i am sending you an email with the details of the url and username/password for the tests.

    thank you very much.
    ciao,
    fabrizio

    james,
    the url of my test page is:

    https://<myURL>/secure2/test.php

    (all of the files under the virtual directory secure2 are protected via shibboleth login).
    and yes, the test page is on the WP server.

    the good news (or maybe is not a good news?) is that invoking the following url:

    https://<myURL>/Shibboleth.sso/Login?target=http%3A%2F%2F<myURL>%2Fsecure2%2Ftest.php

    i am redirected to my remote idp, then i can logon and then i am redirected (with no loop) to the test.php page, which shows:

    Shib-Application-ID	default
    Shib-Session-ID	_16fec1f0e3311190547b751214760f27
    Shib-Identity-Provider	https://<remoteIdP>/gw/metadata
    Shib-Authentication-Instant	2011-05-18T15:02:58.012Z
    Shib-Authentication-Method	urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    Shib-AuthnContext-Class	urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    CodiceFiscale	LSGFRZ76R04H223G
    cognome	LASAGNI
    nome	FABRIZIO
    HTTP_SHIB_SESSION_ID	_16fec1f0e3311190547b751214760f27
    HTTP_SHIB_SESSION_INDEX
    HTTP_SHIB_IDENTITY_PROVIDER	https://<remoteIdP>/gw/metadata
    HTTP_SHIB_AUTHENTICATION_METHOD	urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    HTTP_SHIB_AUTHENTICATION_INSTANT	2011-05-18T15:02:58.012Z
    HTTP_SHIB_AUTHNCONTEXT_CLASS	urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    HTTP_SHIB_AUTHNCONTEXT_DECL
    HTTP_SHIB_ASSERTION_COUNT
    HTTP_SHIB_APPLICATION_ID	default

    now i am a little bit confused…
    now i should be logged, but, if i invoke the WP logon page, the loop starts, but, if i invoke one of the pages under the virtual directory (/secure2) i can see the page correclty and all of the session parameters (shibboleth ones included).

    thanks again.
    ciao,
    fabrizio

    james,
    first of all thank you for your very important support!

    i put the logging to the shibboleth_session_active function and the result of the tail on the error_log file is:

    ***
    [Wed May 18 16:18:24 2011] [error] [client 172.16.2.33] shibboleth_session_active
    [Wed May 18 16:18:24 2011] [error] [client 172.16.2.33] Shib-Session-ID =
    [Wed May 18 16:18:24 2011] [error] [client 172.16.2.33] HTTP_SHIB_IDENTITY_PROVIDER =
    [Wed May 18 16:18:24 2011] [error] [client 172.16.2.33] Shib-Identity-Provider=
    [Wed May 18 16:18:26 2011] [error] [client 172.16.2.33] shibboleth_session_active
    [Wed May 18 16:18:26 2011] [error] [client 172.16.2.33] Shib-Session-ID =
    [Wed May 18 16:18:26 2011] [error] [client 172.16.2.33] HTTP_SHIB_IDENTITY_PROVIDER =
    [Wed May 18 16:18:26 2011] [error] [client 172.16.2.33] Shib-Identity-Provider=
    [Wed May 18 16:18:27 2011] [error] [client 172.16.2.33] shibboleth_session_active
    [Wed May 18 16:18:27 2011] [error] [client 172.16.2.33] Shib-Session-ID =
    [Wed May 18 16:18:27 2011] [error] [client 172.16.2.33] HTTP_SHIB_IDENTITY_PROVIDER =
    [Wed May 18 16:18:27 2011] [error] [client 172.16.2.33] Shib-Identity-Provider=
    [Wed May 18 16:18:29 2011] [error] [client 172.16.2.33] shibboleth_session_active
    [Wed May 18 16:18:29 2011] [error] [client 172.16.2.33] Shib-Session-ID =
    [Wed May 18 16:18:29 2011] [error] [client 172.16.2.33] HTTP_SHIB_IDENTITY_PROVIDER =
    [Wed May 18 16:18:29 2011] [error] [client 172.16.2.33] Shib-Identity-Provider=
    [Wed May 18 16:18:31 2011] [error] [client 172.16.2.33] shibboleth_session_active
    ***

    that means that, as you mentioned, the function does not show the headers needed!
    which are the other functions that needs logging? i am trying to do that, but i have to confess that i am not very confident in that… i do hope i will be able.
    thank you.
    ciao,
    fabrizio

    hello james,
    here there the answers to your questions:
    1. my wp version is 3.0.2 and i do not have special configs (no multi-site)
    2. yes the ‘session initiation url’ (which points to “https://<myURL>/Shibboleth.sso/Login&#8221;) is set properly, in fact, when i choose to logon with shibboleth i am redirected to the shibboleth login url set as mentioned above; also the username is set and points to “CodiceFiscale”, in fact (from my test page) i see:
    ***
    CodiceFiscale LSGFRZ76R04H223G
    ***
    if you believe that it can be of help, i can give you a username and the url for the test page and the shib login page, so you can test what happens yourself. let me know. in this case i would prefer to give you link, username and password via email.
    3. when the loop occurs, the 2 urls shown are:
    https://<myURL>/Shibboleth.sso/Login?target=http%3A%2F%2F<myURL>%2Fwp-login.php%3Faction%3Dshibboleth
    and
    https://<myRemoteIdp>/gw/AssertionConsumerProxy/SAML1?ssoProxying=reggioemilia
    4. the .htaccess file contains:
    ***

    # BEGIN WordPress

    # END WordPress

    # BEGIN Shibboleth
    AuthType Shibboleth
    Require Shibboleth
    # END Shibboleth
    ***
    let me know, please.
    thank you.
    ciao,
    fabrizio

    hello jkhongusc,
    thank you for your reply.
    i have a test php page which shows all of the http headers and the result is:
    ***
    HTTP_SHIB_IDENTITY_PROVIDER https://federatest.lepida.it/gw/metadata
    Shib-Application-ID default
    Shib-Authentication-Instant 2011-05-18T05:58:46.883Z
    Shib-Authentication-Method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    Shib-AuthnContext-Class urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
    Shib-Identity-Provider https://federatest.lepida.it/gw/metadata
    Shib-Session-ID _26d49f597a3d3040506564bd7a80a46d
    ***
    so i am already getting the shib-session-id and http_shib_identity_provider, so what shall i check into to solve my loop problem?
    thank you very much.
    ciao,
    fabrizio

    hello,
    i am experiencing the same loop problem. i tried your workaround, but nothing changes.
    can you help me, please?
    thank you.
    ciao,
    fabrizio

    hello,
    i have the same problem as you, i tried your workaround, but nothing changes. can you help me, please?
    thank you.
    ciao,
    fabrizio

    hello,
    i use that plugin on a RH EL 5.6 and i have the same problem.
    i also tried the work around shown here: https://www.ads-software.com/support/topic/function-shibboleth_session_active-possible-bug?replies=1
    but nothing changes. any help, please?
    thank you.
    ciao,
    fabrizio

    hello,
    can you tell me how you configured the plugin, please?
    i did it, but i am in a sort of loop after authentication (a new session is asked in loop and i can not logon).
    did you had the same problem?
    which is yr OS?
    thank you.
    ciao,
    fabrizio

Viewing 9 replies - 1 through 9 (of 9 total)