<div dir="ltr"><div>Hi Eve,</div><div><br></div><div>Thank you for your response. Yes, if you could, please send me a sanitized version of your shibboleth2.xml</div><div><br></div><div>I've tried making the couple config changes that you've mentioned, but I keep seeing the same <b>access denied</b> message in the error log.</div><div><br></div><div><u>Module configuration</u></div><div><b>Shibboleth login handler URL:</b></div><div><a href="https://stage.qdr.org/Shibboleth.sso/Login">https://stage.qdr.org/Shibboleth.sso/Login</a></div><div><b>Shibboleth logout handler URL:</b></div><div><a href="https://stage.qdr.org/Shibboleth.sso/Logout">https://stage.qdr.org/Shibboleth.sso/Logout</a></div><div><br></div><div>All other settings are default.</div><div><br></div><div>Thanks,</div><div>Alex</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 26, 2016 at 2:35 PM, Eve Edelson <span dir="ltr"><<a href="mailto:ecedelson@lbl.gov" target="_blank">ecedelson@lbl.gov</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hello Alex,</div><div>I am comparing your shibboleth2.xml with ours.</div><div>So far I see a few differences, but I'm not sure if they are the meaningful ones:</div><div><br></div><div>Yours is missing this section:</div><div><br></div><div><div><RequestMapper type="Native"></div><div> <RequestMap applicationId="default"></div><div> <Host name="your domain name"></div><div> <Path name="eta-intranet"></div><div><Path name="installation" authType="shibboleth" requireSession="false" /></div><div> </Path></div><div> </Host></div><div> </RequestMap></div><div></RequestMapper></div></div><div><br></div><div>and this line is missing uid</div><div><br></div><div><div><ApplicationDefaults entityID="<a href="https://your" target="_blank">https://your</a> domain name/" REMOTE_USER="<u><b>uid</b></u> eppn persistent-id targeted-id"></div></div><div><br></div><div>Also the Sessions session has some attributes that ours is actually missing.</div><div><br></div><div>If you want I can send you a sanitized version of what we're using.</div><div><br></div><div><br></div><div>I'll keep looking at this, but my attention is fragmented right now ;]</div><div><br></div><div>Could you mention how you configured the shib_auth module?</div><div>It's probably correct, I just wondered.</div><div><br></div><div>=====</div><div><br></div><br><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Sun, Sep 25, 2016 at 10:36 PM, Alexander Ivanov <span dir="ltr"><<a href="mailto:alex@calmforce.com" target="_blank">alex@calmforce.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div class="h5"><div dir="ltr"><div>Hi everyone,</div><div><br></div><div>I'm the lead developer for the QDR site (<a href="https://qdr.syr.edu/" target="_blank">https://qdr.syr.edu/</a>), which is running Drupal 7. We are developing an integration with a Shibboleth IdP. On our Stage site I have installed and enabled shib_auth module ver 7.x-4.3. In that same environment, we've set up the Shibboleth IdP and SP.</div><div><br></div><div>I ran into some issues when I attempted to configure the Shib SP (version 2.5.6). I contacted the Shibboleth mailing list, and I was informed that the configuration examples provided in the wiki for shib_auth module (<a href="https://wiki.aai.niif.hu/index.php?title=DrupalShibbolethReadmeDev" target="_blank">https://wiki.aai.niif.hu/inde<wbr>x.php?title=DrupalShibbolethRe<wbr>admeDev</a>) are outdated. The configuration examples for shibboleth2.xml must correspond to an earlier version of the Shibboleth SP. Related Shibboleth mailing list thread:</div><div><div><a href="http://shibboleth.1660669.n2.nabble.com/Error-Unable-to-locate-a-SAML-2-0-ACS-endpoint-to-use-for-response-td7628164.html" target="_blank">http://shibboleth.1660669.n2.n<wbr>abble.com/Error-Unable-to-loca<wbr>te-a-SAML-2-0-ACS-endpoint-to-<wbr>use-for-response-td7628164.<wbr>html</a></div></div><div><br></div><div>Currently our IdP and SP are functional such that when I go to the Drupal login page and click on Shibboleth Login link, I am taken to our IdP authentication page. Once I login there, I am successfully redirected back to the Drupal site. When I check the status of the SSO Session I see that a session is created and attribute values are passed for the IdP-authenticated user. However, despite the successful SSO session, the auto-login into Drupal fails. I am not logged into the site, and in the error log I just see an <b>access denied</b> message. </div><div><br></div><div>I am attaching our shibboleth2.xml config file. I think that I may be missing something in the SP configuration. I tried to make the best of the wiki example, but I think this may need to be configured a bit differently for Shibboleth SP version > 2.4. Please let me know if this is the case.</div><div><br></div><div>I appreciate any advice you may have for making our Shibboleth IdP integration work. Thank you in advance for your help.</div><div><br></div><div>My Best,<br>Alex<br></div><div><br></div></div>
<br></div></div>______________________________<wbr>_________________<br>
shib_auth mailing list<br>
<a href="mailto:shib_auth@listserv.niif.hu" target="_blank">shib_auth@listserv.niif.hu</a><br>
<a href="https://listserv.niif.hu/mailman/listinfo/shib_auth" target="_blank" rel="noreferrer">https://listserv.niif.hu/mailm<wbr>an/listinfo/shib_auth</a><br>
<br></blockquote></div><br></div></div>
</blockquote></div><br></div>