Trouble with Leaf API

[artgoldberg]

Hi guys

I'm running the Leaf API on CentOS 7.9 and using Apache 2.4 with a Shibbolith SO 3.

I've started by running without

The system still needs certificates issued by a trusted certificate authority, which is underway. For now, I'm using self-signed certificates.

To start, Leaf's running without authentication or Authorization. That worked for a while, but then I tried using authentication which failed, and cannot get back to a system that work.

The compile command:

dotnet publish -c Debug -o /var/opt/leafapi/api

I get the attached browser error.
leaf_error.pdf

Here's appsettings.json (renamed to make github happy):
appsettings_redacted.txt

And here's the relevant part of the leaf log, which, curiously, doesn't have an error:
leaf-api-20210518.log

Thanks
Arthur

[ndobb]

@artgoldberg in the browser can you open the developer console (usually Ctrl+Shift+I) when you start Leaf and take a look at the Network tab? That'll provide more info than the Leaf UI, which gives messages that are intentionally opaque.

My suspicion is that the API call is not being reverse proxied by Apache to the Leaf API. The Server was found but unexpectedly returned an error is an interpretation of the HTTP status code, but may be misleading or incorrect so let's not read into the message.

[artgoldberg]

Thanks @ndobb . Here's the Chrome developer Network view.
leaf_developer_network.pdf

And here's the http.conf (it differs from the one at https://leafdocs.rit.uw.edu/installation/installation_steps/8a_configure_apache/ because I'm using Apache 2.4.

Include conf.modules.d/*.conf

# Load the Shibboleth module.
LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so

<IfModule mime_module>
    # TypesConfig points to the file containing the list of mappings from filename extension to MIME-type.
    TypesConfig /etc/mime.types

</IfModule>

# User/Group: The name (or #number) of the user/group that runs httpd.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
User apache
Group apache

Listen 443
<VirtualHost *:443>

    # configured as recommended by https://wiki.shibboleth.net/confluence/display/SP3/Apache
    ServerName leaf.mssm.edu
    UseCanonicalName On
    ServerAlias www.leaf.mssm.edu
    DocumentRoot /data/www
    HostnameLookups Off
    ErrorLog logs/leaf_ssl_error_log
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    CustomLog logs/leaf_access_log common

    SSLEngine on
    SSLCertificateFile "/etc/pki/tls/certs/leaf.crt"
    SSLCertificateKeyFile "/etc/pki/tls/private/leaf.key"
    # SSLProtocol all -SSLv2 -SSLv3
    # SSLHonorCipherOrder on
    # SSLCipherSuite HIGH:!aNULL:!MD5:!AECDH:!ADH

    SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0

    <Location /Shibboleth.sso>
      SetHandler shib
    </Location>

    # API proxy directive, overall api doesn't require user session
    <Location /api>
        ProxyPass         http://10.9xxxx:5001/api
        ProxyPassReverse  http://10.9xxxx:5001/api

        # AG: based on http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require,
        # https://wiki.shibboleth.net/confluence/display/SP3/Apache and
        # https://www.switch.ch/aai/guides/sp/access-rules/
        AuthType shibboleth
        ShibRequestSetting requireSession false
        Require shibboleth
    </Location>

    # /api/user does require user session
    <Location /api/user>

        AuthType shibboleth
        ShibRequestSetting requireSession true
        Require valid-user
    </Location>

</VirtualHost>

If I comment out these lines

    <Location /api/user>

        AuthType shibboleth
        ShibRequestSetting requireSession true
        Require valid-user
    </Location>

then the error isn't raised. I'll leave them like that until I have shibboleth authentication working.

Thanks
A