Shibboleth not setting REMOTE_USER

Question

I'm relatively new to Shibboleth but I can't seem to get past the issue of communicating the REMOTE_USER to my application.

My stack is shibd 2.5.3 and Apache 2.4.18 feeding into a Gunicorn server over a unix socket.

I have the following in my shibboleth2.xml:

<ApplicationDefaults entityID="https://server.uchicago.edu/shibboleth" REMOTE_USER="uid mail eppn">

And my apache configuration:

<Location /minimum>
    AuthType Shibboleth
    Require shibboleth
    ShibRequestSetting requireSession false
</Location>
...
### Shibboleth Auth Test App ###
<Directory /var/www/testing/shib_test_app/minimum_srv/>
    require valid-user
    <Files wsgi.py>
        Require all granted
    </Files>
</Directory>
ProxyPass /minimum/ unix:/var/www/testing/shib_test_app/run/minimum.socket|http://server.uchicago.edu/minimum/

A successful login yields the following in transaction.log:

2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]: New session (ID: _c7733778bc32d918c86af6ed3032b4d8) with (applicationId: default) for principal from (IdP: urn:mace:incommon:uchicago.edu) at (ClientAddress: 128.135.219.225) with (NameIdentifier: AAdzZWNyZXQxyKNPOa4xNc3jfe3SU1ECnug95BZZklugt27zSuUOLFPnF/G8zlPSTB9M5bAIXSN2WZoR9DB5mxo6w0wii7KQWJQLHtYSQM/H5dyLa+B9MOLq6ZqB7x7z9b6fjvjPpMVCxsjKhr7C7OglCHw2gqk=) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _2b139b94d61993652304709bb6a7a1e3)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]: Cached the following attributes with session (ID: _c7733778bc32d918c86af6ed3032b4d8) for (applicationId: default) {
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     entitlement (5 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     ucDepartment (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     mail (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     unscoped-affiliation (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     displayName (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     givenName (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     ucisMemberOf (57 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     cn (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     uid (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     affiliation (2 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     persistent-id (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     nickname (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     eppn (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     sn (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]: }

And I get in my /Shibboleth.sso/Session: Shibboleth.sso/Session screenshot

It seems like the SP is returning attributes to me, and in shibboleth2.xml I've configured that I want uid as the primary populant for REMOTE_USER, but it's set to null in the Apache environment variables (at least as far as I can tell, it's not showing up in Django's request.META). It might be worth knowing that everything is working perfectly fine if I configure Apache to ShibUseHeaders On, but I'd rather not enable that.

Any help on where the disconnect may be?

Shibboleth not setting REMOTE_USER

0 Answers0