0

I am trying to install a Shibboleth Service Provider behind a reverse proxy, that handles SSL offloading and redirects all /shibboleth/ URLs to the VM that hosts Shibboleth SP with Apache. Here are some URL examples:

site.domain.com > go to website
site.domain.com/shibboleth/protectedURL1 > go to Shibboleth SP, first protected path
site.domain.com/shibboleth/protectedURL2 > go to Shibboleth SP, second protected path

In shibboleth2.xml I see that all handlers URLs are relative:

<Sessions lifetime="28800" timeout="3600" checkAddress="true"
   handlerURL="/Shibboleth.sso" handlerSSL="false" ....

and examining SAML calls I see that Shibboleth URLs are missing the /shibboleth/ part:

https://site.domain.com/Shibboleth.sso/SAML2/POST

That link is indeed not working, but if I manually add /shibboleth/ : https://site.domain.com/shibboleth/Shibboleth.sso/SAML2/POST it works.

Where I can configure shibboleth URLs, adding /shibboleth/?

J.B.
  • 315
  • 8
  • 23

1 Answers1

0

I had to modify handlerURL in Sessions section of shibboleth2.xml, then reconfigure Apache adding /shibboleth/ to all locations. I found a clue digging in Shibboleth documentation: https://wiki.shibboleth.net/confluence/display/SP3/Sessions#Sessions-AdvancedConfiguration

Here is my final Sessions section:

<Sessions lifetime="28800" timeout="3600" checkAddress="false" handlerURL="/shibboleth/Shibboleth.sso" handlerSSL="false" exportLocation="/GetAssertion" idpHistory="false" idpHistoryDays="7">
J.B.
  • 315
  • 8
  • 23