Questions tagged [shibboleth]

Open Source identity authorization and management solution, providing Single Sign On (SSO)

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

What's wrong with my Shibboleth PathRegex config

I'm using Shibboleth SP 3.2.3 on Windows Server 2019 with IIS. It has been in production for quite a long time and working fine. I noticed at some point that it was protecting a path that shouldn't be ...
user avatar
0 votes
0 answers
29 views

Shibboleth SP single site to multiple site

I currently have Shib SP (v3) running to protect a website lets call it site1.example.com. Lets say example.com uses an IDP called example1_auth and it is up and running as expected. I have other ...
user avatar
  • 3,683
0 votes
1 answer
101 views

tomcat9 shibboleth+mod_jk authentication forbidden

I have a Spring Boot application running currently under Tomcat 8.5 that has a shibboleth-based SSO integrated. Shibboleth and tomcat are connected using apache2 mod_shib and mod_jk, using default ...
user avatar
  • 489
1 vote
0 answers
81 views

Wildfly Elytron container managed authentication with federated SAML2 IDP

I'm trying to set up container-managed authentication with Wildfly 24 and would like to use an existing (federated) Shibboleth IDP. I haven't found docs detailing that use case, so I opted for the ...
user avatar
  • 9,165
1 vote
0 answers
30 views

Integrating GitHub Org with SAML shibboleth & post actions

I am at the beginner level of GitHub cloud administration and looking for answers to the below-listed questions after I enable SAML integration (Shibboleth) for my Github cloud Organisation. Before ...
user avatar
  • 11
0 votes
0 answers
231 views

HTTP ERROR 403 You don't have authorization to view this page. (Apache 2.4/Shibboleth 3.1/Tomcat 7)

I'm setting up a new server running CentOS 7 with Apache 2.4/Shibboleth 3.1/Tomcat 7 and using proxy_ajp to connect apache to tomcat. I'm getting 403 from the site running on it. I've searched for ...
user avatar
0 votes
1 answer
144 views

Shibboleth in sub-path URL

I am trying to install a Shibboleth Service Provider behind a reverse proxy, that handles SSL offloading and redirects all /shibboleth/ URLs to the VM that hosts Shibboleth SP with Apache. Here are ...
user avatar
  • 305
0 votes
1 answer
270 views

issue with shibboleth SP in docker container behind proxy

I am trying to get a shibboleth set up working in a docker container behind a proxy. Currently I am able to get redirected to the shibboleth idp page where I can enter my login details and shibboleth ...
user avatar
  • 111
0 votes
1 answer
663 views

Apache "require valid-user" is valid across multiple auth types

Our Apache uses both mod_shib_24 (SAML-SP) and mod_auth_openidc (OIDC-RP), which both are connected to a Shibboleth IdP (acts as both SAML-IDP and OIDC-OP). Furthermore we have 2 protected locations, ...
user avatar
  • 1
0 votes
1 answer
350 views

shibd daemon 'timeout' on systemctl start

I have a server that uses the shibboleth2 shibd daemon to allow remote authentication to a database. The daemon reads a very large federation metadata file on starting/reloading (circa 34MB). This ...
user avatar
  • 87
1 vote
0 answers
49 views

Upgrading Ubuntu 14.04 hosts to support Shibboleth SP 3

I've inherited a few Ubuntu 14.04 hosts which are configured with Shibboleth auth through Apache. They run rails/apache. The installed packages(1) on these hosts is libapache2-mod-shib2 along with a ...
user avatar
  • 3,434
1 vote
0 answers
46 views

Shibboleth: add IDP and SP entityID to attribute value

I have an attribute value (identifier) that looks like following: 5678 I would like to add entityID of both IDP and the recipient SP to get the (targeted) attribute value: idp-entity-id!sp-entity-id!...
user avatar
  • 123
1 vote
1 answer
661 views

Shibboleth SP 2 and ADFS sha1 to sha256

With shibboleth SP 2, I need to configure ADFS (as IdP) in advance tab SHA-1 algorithm to work fine. If I configure in ADFS SHA-256 hash algorithm, I get an error in ADFS event log, that SP reponses ...
user avatar
1 vote
1 answer
415 views

Reverse Proxy for Shibboleth not sending request POST

I am trying to send the POST request that is sent from Authenticating shibboleth back to my web server, but I am only getting a GET request. When this GET request is proxied to my web server's ...
user avatar
  • 11
1 vote
1 answer
254 views

Shibboleth return url does not work over subdirectory?

We are trying to install Shibboleth for the first time and we got everything working perfectly when applying single sign for a website over a top level domain, but not under a sub directory. Here is ...
user avatar
  • 7,073
0 votes
1 answer
236 views

Install shibboleth timeout in centos

I am trying to install Shibboleth via ansible in a centos-7 machine which is hosted in AWS. But am getting "Operation too slow. Less than 1000 bytes/sec transferred the last 30 seconds" error for ...
user avatar
  • 103
0 votes
1 answer
1k views

Shibboleth IdP won't start with Jetty 9.3

I've been following this guide to install Shibboleth Identity Provider 3.3.2 on Jetty 9.3.22 (Ubuntu Server 16.04 with Oracle JDK 8u151). At https://my.server.ip/idp I get a 503 error (Service ...
user avatar
  • 198
1 vote
2 answers
584 views

Moving SSL cert to the edge breaks Shibboleth

We are converting a system we inherited: two web servers running IIS and Shibboleth, behind a load balancing server running HAPROXY. SSL certs are installed on each web server, and HAPROXY is ...
user avatar
1 vote
0 answers
1k views

Shibboleth not setting REMOTE_USER

I'm relatively new to Shibboleth but I can't seem to get past the issue of communicating the REMOTE_USER to my application. My stack is shibd 2.5.3 and Apache 2.4.18 feeding into a Gunicorn server ...
user avatar
2 votes
2 answers
1k views

Shibboleth 404 when upgrading to ASP.net CORE

I managed to get Shibboleth with SecureAuth working on an IIS server hosting a simple index.html and later a simple ASP.net MVC 4 app, both of which work great. Today, though, I tried simply making ...
user avatar
1 vote
1 answer
382 views

Does Shibboleth IdP 3 automatically echo relay state by default?

Maybe this is a dumb question, but I can't find any anything about this in the documentation or elsewhere. According to the SAML spec, I know that the IdP is supposed to echo back the relay state ...
user avatar
0 votes
1 answer
76 views

Redirect website login to different IDP

My organization has a Shibboleth/IDP service set up. Now that I am getting involved, I am first setting up my own basic IDP on a test server to learn the ropes. In order to test functionality, I want ...
user avatar
0 votes
1 answer
653 views

Shibboleth SPNEGOAuthnConfiguration in CentOS server

I have requirement were the user's were already joined to domain logged in using the same credential from ldap server, they don't want to enter it again to login into shibboleth SSO, so I searched ...
user avatar
1 vote
0 answers
666 views

Install Shibboleth on IIS with multiple sites

I'm installing shibboleth2, version 2.6.0.1 64 bit on a Windows 2008 Server. I've installed it at the server level and I have multiple sites hosted and are currently running. I've had one install ...
user avatar
2 votes
1 answer
2k views

Shibboleth Could not locate Java.exe Please check the value for JAVA_HOME [closed]

I am trying to install Shibboleth for development on my local copy of windows 10. I am on the first step and stuck. After downloading the shibboleth identity provider I am not able to install as I ...
user avatar
  • 141
2 votes
2 answers
1k views

Configuring Shibboleth SAML 2.0 with ADFS 3.0 with Fedration Errors

I'm trying to configure ADFS 3.0 and SAML 2.0. Currently, I get this error whenever I restart shibd and httpd. 2016-11-07 12:49:08 ERROR XMLTooling.ParserPool : error on line 1, column 2702, message: ...
user avatar
1 vote
1 answer
4k views

Skipping unmapped SAML 2.0 attribute, even though name and nameFormat match

SP running Shibboleth 2.5.6. For one particular IdP, I have these attribute mappings: <Attribute name="role" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" id="role" /...
user avatar
  • 1,077
1 vote
1 answer
1k views

Shibd not receiving proper POST request

I'm attempting to use mod_shib to provide with SSO for an application that is running in a tomcat container. There's an Apache server, running as a reverse proxy, in front of the Tomcat container. I ...
user avatar
  • 173
0 votes
0 answers
555 views

Why my websockets application deployed on tomcat is not getting the shibboleth headers?

My stack looks like this: Apache httpd server 2.4.12: with mod_shibd, mod_proxy_http & mod_proxy_wstunnel Shibboleth 2.5 Apache Tomcat 7.0.54 Our scenario looks like this: --------- -...
user avatar
  • 101
0 votes
1 answer
494 views

Scandinavian characters get messed up in Shibboleth SP header attributes

I have Shibboleth SP 2.5 with Apache 2.4 in front of Domino 9.0.1 server on Windows server 2008 R2. This is the beginning of the incoming SAML message from Shibboleth SP debug log: <?xml version="...
user avatar
1 vote
1 answer
983 views

How to Uninstall Shibbolet 2.5 from Windows 10 and Windows Server 2012

I'm attempting to uninstall shibboleth-sp-2.5.6.0-win64.msi from my Windows 10 PC.(I have the same problem on Windows Server 2012). It gets stuck with the following message: Please wait while the ...
user avatar
1 vote
1 answer
2k views

Support multiple IdPs in Shibboleth SP based on URL path

When URL path is /client1 the user should be directed to IdP of this client. When URL path is /client2 the user should be directed to IdP of that client etc. How do I configure this with Shibboleth ...
user avatar
0 votes
1 answer
3k views

AuthType shibboleth configured without corresponding module

I am trying to set up a shibboleth configuration but have now hit an error I do not know how to deal with: When accessing a site, which I configured to be protected by shibboleth, I receive a 500 ...
user avatar
  • 407
2 votes
1 answer
695 views

Shibboleth - Secure whole IIS application

I've setup shibboleth SP on my server and now I want to protect my IIS folders. I followed a few tutorials and used this syntax in my shibboleth2.xml file: <RequestMapper type="Native"> &...
user avatar
1 vote
1 answer
4k views

Only one Shibboleth SP on reverse proxy for different sites

I am wondering if it is possible to only have one Shibboleth Service Provider (SP) if you pass requests to all your sites through one reverse proxy (with SSL offloading, etc.). So, let's say I have ...
user avatar
  • 407
0 votes
2 answers
880 views

ADFS and Shibboleth: Controlling behavior of Windows authentication

We are doing SSO using ADFS and Shibboleth SP. In a perfect world, Windows authentication would always work, i.e., the user accesses https://shibboleth/Login?target=somewhere, is redirected to https:/...
user avatar
0 votes
2 answers
1k views

Shibboleth 3 - SAML response for Attribute

I have configured Shibboleth 3 to give the SAML response containing the following Attribute Statement <saml2:AttributeStatement> <saml2:Attribute ...
user avatar
3 votes
2 answers
3k views

Using Shibboleth with ADFS doesn't work

I'm trying to familiarize myself with Shibboleth 2.5.3 and Active Directory Federation Services (tried both 2.0 and 3.0). What I'd like to achieve is having an Apache server authenticate against ADFS ...
user avatar
4 votes
1 answer
2k views

AD FS - Send AD Attributes to Shibboleth SP

I have an AD FS claims provider set up and a Shibboleth SP successfully authenticating against it. When I log into the site that's protected by Shibboleth, the index shows all of the headers. I am ...
user avatar
1 vote
0 answers
111 views

protect IIS site with Shibboleth SP on certain IP

I host a webserver and want customers to authenticate using their ADFS server. I cannot reach their server, they reach mine and theirs. This basically works. I now wonder if it's possible to setup ...
user avatar
3 votes
1 answer
3k views

Sending AD Attributes as AD FS claims to Shibboleth SP Attributes

I have an AD FS claims provider set up and a Shibboleth SP successfully authenticating against it. I am attempting to have the Active Directory attributes sent to the SP. I followed this article to ...
user avatar
1 vote
1 answer
3k views

ADFS without domain

Is it possible to run a ADFS 2.0 without connecting the server to a domain? We are using Shibboleth as claims provider, so we actually don't need active directory here. We manage to setup the ADFS (...
user avatar
0 votes
1 answer
2k views

Shibboleth SP - Signing and Encryption Key

I have a Shibboleth SP installed on Server 2012 R2. I tried to submit the metadata to be imported into the IDP and was told that without having the signing or encryption key, they won't be able to ...
user avatar
3 votes
1 answer
4k views

ADFS 2.0 and Shibboleth SP 2.5.3 - Unable to locate Metadata

I am attempting to use Shibboleth SP (64-bit on Windows Server 2008 R2) to authenticate with ADFS 2.0 (64-bit Windows Server 2008 R2). When I browse to the Shibboleth protected site, I get a 500 error ...
user avatar
1 vote
0 answers
1k views

ShibRequestSetting REMOTE_ADDR setting and Apache RequestHeader

I have Apache/Shibboleth serving requests to a reverse proxy and directly to web clients. When a request comes through the proxy I extract the original IP address and attempt to send it to shibboleth. ...
user avatar
0 votes
2 answers
2k views

Switching between multiple authentication types on same URL

I have a secure SSO site that uses Shibboleth authentication and SAML identity provider. I need to allow a Google Search Appliance crawler to come index the URL's. I have a requirement to change on ...
user avatar
1 vote
1 answer
3k views

Shibboleth does pass attribute to server variable in PHP

I am building a SAML based federated authentication mechanism in which the IdP is ADFS 2.0 and the SP is Shibboleth running on Linux. I am able to do the following: Attempt to access a protected ...
user avatar
  • 21
0 votes
1 answer
628 views

Shibboleth/Nginx run on non-standard port

Our team runs all our Nginx installations on 8443 instead of 443 for the obvious reason that you don't need to be root to listen on the port, and so the process can be started and stopped with lower ...
user avatar
1 vote
1 answer
4k views

Shibboleth - opensaml::FatalProfileException

I have configured and installed shibboleth Idp and sp on a Ubuntu machine locally. The Idp is configured with LDAP. I am trying to access the secure.html file which hosted in Apache and secured by ...
user avatar
  • 11
0 votes
1 answer
599 views

Why shibboleth IdP idp-metadata.xml recommends 8443 for SOAP?

After the install.sh of 2.4.0 Shibboleth Identity Server, the idp-metadata.xml file is created. Why is that? Is not enough secure to use the standard HTTPS/443 port? <ArtifactResolutionService ...
user avatar
  • 1