Shibboleth return url does not work over subdirectory?

Question

We are trying to install Shibboleth for the first time and we got everything working perfectly when applying single sign for a website over a top level domain, but not under a sub directory.

Here is our Apache virtual host config file which works perfectly:

  <VirtualHost *:443>

    ... some other settings
    <Location />
        AuthType shibboleth
        Require shibboleth
        ShibRequireSession On
        Order allow,deny
        Allow from all
    </Location>

</VirtualHost>

With this configuration, we can do this:

SCENARIO A

Go to https://myawesomewebsite.com/secure in my web browser
My web browser redirects me to my single sign on service at https://somesinglesignon.com/authenticate
I type in my username and password at https://somesinglesignon.com/authenticate and press submit
The server sends me back to https://myawesomewebsite.com/secure

Everything above worked perfectly.

Now I'm going to modify my virtual host file such that <Location /> becomes <Location /secure>. So my virtualhost file looks like this now:

<VirtualHost *:443>

    ... some other settings
    <Location /secure>
        AuthType shibboleth
        Require shibboleth
        ShibRequireSession On
        Order allow,deny
        Allow from all
    </Location>

</VirtualHost>

Now when I try to repeat the steps 1 to 4, instead I get this:

SCENARIO B

Go to https://myawesomewebsite.com/secure in my web browser
My web browser redirects me to my single sign on service at https://somesinglesignon.com/authenticate
I type in my username and password at https://somesinglesignon.com/authenticate and press submit
The server sends me back to https://myawesomewebsite.com/Shibboleth.sso/SAML2/POST

Why is step 4 Scenario A different from step 4 in Scenario B? How do I make A.4 the same as B.4?

score 1 · Accepted Answer · answered Apr 09 '18 at 19:30

Try the following:

    <Location />
            AuthType shibboleth
            require shibboleth

            Order allow,deny
            Allow from all
    </Location>

    <Location /secure>
            AuthType shibboleth
            ShibRequireSession On
            ShibUseHeaders On
            require valid-user
    </Location>

#<Location /secure>
#    AuthType shibboleth
#    Require shibboleth
#    ShibRequireSession On
#    Order allow,deny
#    Allow from all
#</Location>

I found this to be helpful: http://shibboleth.1660669.n2.nabble.com/Protect-single-sub-directory-Moodle-with-SP-reverse-proxy-td6590009.html

Shibboleth return url does not work over subdirectory?

1 Answers1