Trouble configuring Shibboleth #533

artgoldberg · 2022-06-23T18:59:55Z

artgoldberg
Jun 23, 2022

Hi Folks

I'm configuring a new instance of Leaf (3.11) on Centos with Apache. I started with just Apache and the Leaf API, which works. (In appsettings.json authentication and authorization are UNSECURED.)

Now I need to configure Shibboleth. First, I need to get the SP's metadata, so I can send it to the IdP folks. To do that, Shibboleth needs to work. The Shibboleth documentation says run

wget --no-check-certificate https://localhost/Shibboleth.sso/Status

which doesn't work:

The Shibboleth logs say nothing, and the Apache logs simply say 404.

127.0.0.1 - - [23/Jun/2022:14:43:02 -0400] "GET /Shibboleth.sso/Status HTTP/1.1" 404 219 "-" "Wget/1.14 (linux-gnu)" 590 4727

Although I've done this before, it doesn't get easier, so I'd love your help please. These systems don't do a good job of reporting errors.

I attach my httpd.conf.

Regards
Arthur

Include conf.modules.d/*.conf

# Load the headers module.
# LoadModule headers_module modules/mod_headers.so

# Load the Shibboleth module.
LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so

<IfModule mime_module>
    # TypesConfig points to the file containing the list of mappings from filename extension to MIME-type.
    TypesConfig /etc/mime.types

</IfModule>

# User/Group: The name (or #number) of the user/group that runs httpd.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
User apache
Group apache

# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# Do not add a slash at the end of the directory path.  If you point
# ServerRoot at a non-local disk, be sure to specify a local disk on the
# Mutex directive, if file-based mutexes are used.  If you wish to share the
# same ServerRoot for multiple httpd daemons, you will need to change at
# least PidFile.
#
ServerRoot "/etc/httpd"

# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog "logs/error_log"

#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel warn

<IfModule log_config_module>
    #
    # The following directives define some format nicknames for use with
    # a CustomLog directive (see below).
    #
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
      # You need to enable mod_logio.c to use %I and %O
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>

    #
    # The location and format of the access logfile (Common Logfile Format).
    # If you do not define any access logfiles within a <VirtualHost>
    # container, they will be logged here.  Contrariwise, if you *do*
    # define per-<VirtualHost> access logfiles, transactions will be
    # logged therein and *not* in this file.
    #
    #CustomLog "logs/access_log" common

    #
    # If you prefer a logfile with access, agent, and referer information
    # (Combined Logfile Format) you can use the following directive.
    #
    CustomLog "logs/access_log" combined
</IfModule>

Listen 443
<VirtualHost *:443>

    # configured as recommended by https://wiki.shibboleth.net/confluence/display/SP3/Apache
    ServerName omop-leaf-temp.hpc.mssm.edu
    UseCanonicalName On
    ServerAlias www.omop-leaf-temp.hpc.mssm.edu
    DocumentRoot /data/www
    HostnameLookups Off
    ErrorLog logs/leaf_ssl_error_log
    CustomLog logs/leaf_access_log combinedio

    SSLEngine on
    # a key/cert pair with a cert signed by a trusted CA
    SSLCertificateFile "/etc/pki/tls/certs/omop-leaf-temp_hpc_mssm_edu_ssl.cer"
    SSLCertificateKeyFile "/etc/pki/tls/private/omop-leaf-temp_hpc_mssm_edu_ssl.key"
    SSLCertificateChainFile "/etc/pki/tls/certs/MSSMIntermediate.cer"
    # Strong encryption, specified by https://httpd.apache.org/docs/trunk/ssl/ssl_howto.html
    SSLProtocol         all -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder on
    SSLCompression      off
    SSLSessionTickets   off
    SSLCipherSuite      ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

    SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0

    <Location /Shibboleth.sso>
      SetHandler shib
    </Location>

    # enforce session on all pages
#    <Location />
#        AuthType shibboleth
#        ShibRequestSetting requireSession true
#        require valid-user
#    </Location>

    # API proxy directive, overall api doesn't require user session
    <Location /api>
        ProxyPass         http://10.95.46.203:5001/api
        ProxyPassReverse  http://10.95.46.203:5001/api

        # AG: based on http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require,
        # https://wiki.shibboleth.net/confluence/display/SP3/Apache and
        # https://www.switch.ch/aai/guides/sp/access-rules/
#        AuthType shibboleth
#        ShibRequestSetting requireSession false
#        Require shibboleth
    </Location>

    # /api/user does require user session
#    <Location /api/user>
#
#        ShibUseHeaders On
#        AuthType shibboleth
#        ShibRequestSetting requireSession true
#        Require valid-user
#    </Location>

    # As per advice in https://docs.microfocus.com/SM/9.60/Hybrid/Content/security/concepts/support_of_http_strict_transport_security_protocol.htm
    # Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

</VirtualHost>

Answered by artgoldberg

Jun 27, 2022

Argh. The problem was that these lines were commented out in httpd.conf:

<Location /Shibboleth.sso>
  SetHandler shib
</Location>

They were correct in the repo but not in the httpd.conf used by Apache. Argh.

	$ wget --no-check-certificate  https://localhost/Shibboleth.sso/Metadata
	--2022-06-27 17:31:15--  https://localhost/Shibboleth.sso/Metadata
	Resolving localhost (localhost)... 127.0.0.1
	Connecting to localhost (localhost)|127.0.0.1|:443... connected.
	    WARNING: certificate common name ‘omop-leaf-temp.hpc.mssm.edu’ doesn't match requested host name ‘localhost’.
	HTTP request sent, awaiting response... 200 OK
	Length: 7502 (7.3K) [application/samlmetadata+xml]
	Saving to: ‘Metada…

View full answer

ndobb · 2022-06-23T19:16:04Z

ndobb
Jun 23, 2022
Maintainer

@mh2727 any suggestions?

0 replies

artgoldberg · 2022-06-23T20:49:06Z

artgoldberg
Jun 23, 2022
Author

FYI, as recommended at UW,

sudo shibd -t

checks out:

$ sudo shibd -t
2022-06-23 16:48:08 CRIT XMLTooling.Config : libcurl lacks OpenSSL-specific options, this will greatly limit functionality
overall configuration is loadable, check console or log for non-fatal problems

5 replies

artgoldberg Jun 23, 2022
Author

Apache checks out too:

$ sudo apachectl configtest
Syntax OK

mh2727 Jun 23, 2022

Hi @artgoldberg.

Looking at the error, it seems to be having an issue with the certname: the cert is for the url defined in your apache config, not localhost.

Can you try checking https://omop-leaf-temp.hpc.mssm.edu/Shibboleth.sso/Status? (This url is from your Apache config).

--
Mehadi Hassan

artgoldberg Jun 27, 2022
Author

Thanks for the suggestion @mh2727 .

In Chrome I get:

which makes sense since Apache says 404 Not found.

wget on the server says:

as the Shibboleth documentation predicts.

My intuition is that Apache isn't properly configured, and simply isn't routing requests to Shibboleth. Unfortunately, given the design of Apache's configuration system, solving this problem involves exploring a high-dimensional space.

Arthur

mh2727 Jun 27, 2022

@artgoldberg,

Is there a reason why the shib settings is commented out in the apache definition? Have you tried with those settings enabled or are they meant to be commented out?

   # enforce session on all pages
#    <Location />
#        AuthType shibboleth
#        ShibRequestSetting requireSession true
#        require valid-user
#    </Location>

    # API proxy directive, overall api doesn't require user session
    <Location /api>
        ProxyPass         http://10.95.46.203:5001/api
        ProxyPassReverse  http://10.95.46.203:5001/api

        # AG: based on http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require,
        # https://wiki.shibboleth.net/confluence/display/SP3/Apache and
        # https://www.switch.ch/aai/guides/sp/access-rules/
#        AuthType shibboleth
#        ShibRequestSetting requireSession false
#        Require shibboleth
    </Location>

    # /api/user does require user session
#    <Location /api/user>
#
#        ShibUseHeaders On
#        AuthType shibboleth
#        ShibRequestSetting requireSession true
#        Require valid-user
#    </Location>

artgoldberg Jun 27, 2022
Author

Hi @mh2727 . Yes, some sections are intentionally disabled, because the Identity Provider isn't configured yet. But you're warm.

Thanks
Arthur

artgoldberg · 2022-06-27T21:33:05Z

artgoldberg
Jun 27, 2022
Author

Argh. The problem was that these lines were commented out in httpd.conf:

<Location /Shibboleth.sso>
  SetHandler shib
</Location>

They were correct in the repo but not in the httpd.conf used by Apache. Argh.

	$ wget --no-check-certificate  https://localhost/Shibboleth.sso/Metadata
	--2022-06-27 17:31:15--  https://localhost/Shibboleth.sso/Metadata
	Resolving localhost (localhost)... 127.0.0.1
	Connecting to localhost (localhost)|127.0.0.1|:443... connected.
	    WARNING: certificate common name ‘omop-leaf-temp.hpc.mssm.edu’ doesn't match requested host name ‘localhost’.
	HTTP request sent, awaiting response... 200 OK
	Length: 7502 (7.3K) [application/samlmetadata+xml]
	Saving to: ‘Metadata’

	100%[===============================================================================================>] 7,502       --.-K/s   in 0s

Arthur

1 reply

mh2727 Jun 27, 2022

@artgoldberg.

Glad you figured it out 😄 .

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Trouble configuring Shibboleth #533

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 6 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

Trouble configuring Shibboleth #533

artgoldberg Jun 23, 2022

Replies: 3 comments · 6 replies

ndobb Jun 23, 2022 Maintainer

artgoldberg Jun 23, 2022 Author

artgoldberg Jun 23, 2022 Author

mh2727 Jun 23, 2022

artgoldberg Jun 27, 2022 Author

mh2727 Jun 27, 2022

artgoldberg Jun 27, 2022 Author

artgoldberg Jun 27, 2022 Author

mh2727 Jun 27, 2022

artgoldberg
Jun 23, 2022

Replies: 3 comments 6 replies

ndobb
Jun 23, 2022
Maintainer

artgoldberg
Jun 23, 2022
Author

artgoldberg Jun 23, 2022
Author

artgoldberg Jun 27, 2022
Author

artgoldberg Jun 27, 2022
Author

artgoldberg
Jun 27, 2022
Author