1

I'm relatively new to Shibboleth but I can't seem to get past the issue of communicating the REMOTE_USER to my application.

My stack is shibd 2.5.3 and Apache 2.4.18 feeding into a Gunicorn server over a unix socket.

I have the following in my shibboleth2.xml:

<ApplicationDefaults entityID="https://server.uchicago.edu/shibboleth" REMOTE_USER="uid mail eppn">

And my apache configuration:

<Location /minimum>
    AuthType Shibboleth
    Require shibboleth
    ShibRequestSetting requireSession false
</Location>
...
### Shibboleth Auth Test App ###
<Directory /var/www/testing/shib_test_app/minimum_srv/>
    require valid-user
    <Files wsgi.py>
        Require all granted
    </Files>
</Directory>
ProxyPass /minimum/ unix:/var/www/testing/shib_test_app/run/minimum.socket|http://server.uchicago.edu/minimum/

A successful login yields the following in transaction.log:

2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]: New session (ID: _c7733778bc32d918c86af6ed3032b4d8) with (applicationId: default) for principal from (IdP: urn:mace:incommon:uchicago.edu) at (ClientAddress: 128.135.219.225) with (NameIdentifier: AAdzZWNyZXQxyKNPOa4xNc3jfe3SU1ECnug95BZZklugt27zSuUOLFPnF/G8zlPSTB9M5bAIXSN2WZoR9DB5mxo6w0wii7KQWJQLHtYSQM/H5dyLa+B9MOLq6ZqB7x7z9b6fjvjPpMVCxsjKhr7C7OglCHw2gqk=) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _2b139b94d61993652304709bb6a7a1e3)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]: Cached the following attributes with session (ID: _c7733778bc32d918c86af6ed3032b4d8) for (applicationId: default) {
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     entitlement (5 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     ucDepartment (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     mail (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     unscoped-affiliation (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     displayName (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     givenName (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     ucisMemberOf (57 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     cn (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     uid (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     affiliation (2 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     persistent-id (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     nickname (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     eppn (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]:     sn (1 values)
2017-11-13 11:07:09 INFO Shibboleth-TRANSACTION [1724]: }

And I get in my /Shibboleth.sso/Session: Shibboleth.sso/Session screenshot

It seems like the SP is returning attributes to me, and in shibboleth2.xml I've configured that I want uid as the primary populant for REMOTE_USER, but it's set to null in the Apache environment variables (at least as far as I can tell, it's not showing up in Django's request.META). It might be worth knowing that everything is working perfectly fine if I configure Apache to ShibUseHeaders On, but I'd rather not enable that.

Any help on where the disconnect may be?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.