Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [shibboleth]

Open Source identity authorization and management solution, providing Single Sign On (SSO)

17
votes
4answers
15k views

Good Shibboleth tutorials out there? [closed]

I am looking into using Shibboleth for authentication of webapplications at my organisation. I am very new to this subject and would like to read through some good tutorials, hands-on-lessons or ...
9
votes
3answers
2k views

Is it possible to use Shibboleth 2 with Nginx + Passenger?

Do you know if it is possible to use Nginx with Shibboleth?
4
votes
3answers
10k views

Purpose of the x509 certificate in metadata files on the IdP side (SSO structure)

In order to implement SSO, I have been working with some IdP and a Shibboleth SP install without being able to answer this question. On the IdP side I have a few metadata files that describes some ...
4
votes
1answer
2k views

Shibboleth, IIS 7.5, Tomcat

I am trying to set up Shibboleth SP on a Server 2008 R2/ IIS 7.5 machine. IIS throws the following error when browsing to localhost: HTTP Error 500.0 - Internal Server Error Calling LoadLibraryEx on ...
4
votes
1answer
1k views

AD FS - Send AD Attributes to Shibboleth SP

I have an AD FS claims provider set up and a Shibboleth SP successfully authenticating against it. When I log into the site that's protected by Shibboleth, the index shows all of the headers. I am ...
4
votes
1answer
956 views

Shibboleth: found encrypted assertions, but no CredentialResolver was available

I've gotten a Shibboleth Server Provider (SP) up and running, and I'm using the TestShib Identity Provider (IdP) for testing. The configuration appears to be all correct, and when I requested my ...
4
votes
1answer
639 views

Intranet corporate SSO for webapps against Active Directory

I am trying to plan and implement a SSO solution in a corporate environment that serves intranet web applications running on CentOS: Corporate portal (Drupal backend) Project management (Project.NET) ...
3
votes
2answers
3k views

Using Shibboleth with ADFS doesn't work

I'm trying to familiarize myself with Shibboleth 2.5.3 and Active Directory Federation Services (tried both 2.0 and 3.0). What I'd like to achieve is having an Apache server authenticate against ADFS ...
3
votes
0answers
2k views

Shibboleth SP doesn't redirect, no IdP authentication - Error 403.14 w/ IIS 7.5

I'm trying to get a test server setup as a Shibboleth SP using IIS 7.5 and I'm stuck. I'm using the https://idp.testshib.org/idp/shibboleth IdP but it never asks for credentials or redirects to the ...
2
votes
1answer
369 views

Shibboleth - Secure whole IIS application

I've setup shibboleth SP on my server and now I want to protect my IIS folders. I followed a few tutorials and used this syntax in my shibboleth2.xml file: <RequestMapper type="Native"> &...
2
votes
2answers
492 views

Shibboleth 404 when upgrading to ASP.net CORE

I managed to get Shibboleth with SecureAuth working on an IIS server hosting a simple index.html and later a simple ASP.net MVC 4 app, both of which work great. Today, though, I tried simply making ...
2
votes
1answer
3k views

Sending AD Attributes as AD FS claims to Shibboleth SP Attributes

I have an AD FS claims provider set up and a Shibboleth SP successfully authenticating against it. I am attempting to have the Active Directory attributes sent to the SP. I followed this article to ...
2
votes
1answer
3k views

ADFS 2.0 and Shibboleth SP 2.5.3 - Unable to locate Metadata

I am attempting to use Shibboleth SP (64-bit on Windows Server 2008 R2) to authenticate with ADFS 2.0 (64-bit Windows Server 2008 R2). When I browse to the Shibboleth protected site, I get a 500 error ...
2
votes
1answer
3k views

Forward Shibboleth Environment Variables to Tomcat via Apache

I am using Shibbolethv2.3 with Apache web server and Tomcat application server. I am using Apache as a reverse proxy using mod_proxy.so. I am not able to forward the Shibboleth environment variables ...
2
votes
1answer
668 views

Apache2/Shibboleth TCP connections stuck in CLOSE_WAIT

I run an Apache2 server which uses the Shibboleth daemon (shibd) as federated authentication module. Certain server connections using Shibboleth seem to stick permanently in CLOSE_WAIT state. tcp ...
1
vote
1answer
2k views

ADFS without domain

Is it possible to run a ADFS 2.0 without connecting the server to a domain? We are using Shibboleth as claims provider, so we actually don't need active directory here. We manage to setup the ADFS (...
1
vote
1answer
1k views

Support multiple IdPs in Shibboleth SP based on URL path

When URL path is /client1 the user should be directed to IdP of this client. When URL path is /client2 the user should be directed to IdP of that client etc. How do I configure this with Shibboleth ...
1
vote
1answer
3k views

Only one Shibboleth SP on reverse proxy for different sites

I am wondering if it is possible to only have one Shibboleth Service Provider (SP) if you pass requests to all your sites through one reverse proxy (with SSL offloading, etc.). So, let's say I have ...
1
vote
1answer
483 views

Advantage Integrating Shibboleth With ADFS

Can someone explain what the advantage of integrating Shibboleth with Microsoft ADFS is? I have been researching both products and it seems like they have similar offerings. There are many articles ...
1
vote
2answers
1k views

Custom Web Form for Shibboleth login

I recently deployed a server and website that authenticates with my university's Shibboleth authentication system. Functionally, it works great. Aesthetically, there is much When you go to the ...
1
vote
1answer
62 views

Shibboleth return url does not work over subdirectory?

We are trying to install Shibboleth for the first time and we got everything working perfectly when applying single sign for a website over a top level domain, but not under a sub directory. Here is ...
1
vote
2answers
187 views

Moving SSL cert to the edge breaks Shibboleth

We are converting a system we inherited: two web servers running IIS and Shibboleth, behind a load balancing server running HAPROXY. SSL certs are installed on each web server, and HAPROXY is ...
1
vote
2answers
704 views

Configuring Shibboleth SAML 2.0 with ADFS 3.0 with Fedration Errors

I'm trying to configure ADFS 3.0 and SAML 2.0. Currently, I get this error whenever I restart shibd and httpd. 2016-11-07 12:49:08 ERROR XMLTooling.ParserPool : error on line 1, column 2702, message: ...
1
vote
1answer
563 views

Shibd not receiving proper POST request

I'm attempting to use mod_shib to provide with SSO for an application that is running in a tomcat container. There's an Apache server, running as a reverse proxy, in front of the Tomcat container. I ...
1
vote
1answer
513 views

Is there a way to configure shibboleth on tomcat without having to use httpd apache?

I have working setup of shibboleth configured via httpd apache and then pass it on to tomcat. Now is it possible to get rid of httpd portion alone and have tomcat handle shibboleth authentication by ...
1
vote
1answer
5k views

Logging X-Forwarded-For IP in Shibboleth's Audit Logs

This is a follow up from my earlier question on capturing the X-Forwarded-For IP address in across multiple proxies. Now, I'm looking to capture the Client's IP in the application's (Shibboleth's IdP) ...
1
vote
0answers
10 views

Upgrading Ubuntu 14.04 hosts to support Shibboleth SP 3

I've inherited a few Ubuntu 14.04 hosts which are configured with Shibboleth auth through Apache. They run rails/apache. The installed packages(1) on these hosts is libapache2-mod-shib2 along with a ...
1
vote
0answers
438 views

Shibboleth not setting REMOTE_USER

I'm relatively new to Shibboleth but I can't seem to get past the issue of communicating the REMOTE_USER to my application. My stack is shibd 2.5.3 and Apache 2.4.18 feeding into a Gunicorn server ...
1
vote
1answer
205 views

Does Shibboleth IdP 3 automatically echo relay state by default?

Maybe this is a dumb question, but I can't find any anything about this in the documentation or elsewhere. According to the SAML spec, I know that the IdP is supposed to echo back the relay state ...
1
vote
0answers
406 views

Install Shibboleth on IIS with multiple sites

I'm installing shibboleth2, version 2.6.0.1 64 bit on a Windows 2008 Server. I've installed it at the server level and I have multiple sites hosted and are currently running. I've had one install ...
1
vote
1answer
511 views

How to Uninstall Shibbolet 2.5 from Windows 10 and Windows Server 2012

I'm attempting to uninstall shibboleth-sp-2.5.6.0-win64.msi from my Windows 10 PC.(I have the same problem on Windows Server 2012). It gets stuck with the following message: Please wait while the ...
1
vote
0answers
77 views

protect IIS site with Shibboleth SP on certain IP

I host a webserver and want customers to authenticate using their ADFS server. I cannot reach their server, they reach mine and theirs. This basically works. I now wonder if it's possible to setup ...
1
vote
0answers
797 views

ShibRequestSetting REMOTE_ADDR setting and Apache RequestHeader

I have Apache/Shibboleth serving requests to a reverse proxy and directly to web clients. When a request comes through the proxy I extract the original IP address and attempt to send it to shibboleth. ...
1
vote
1answer
2k views

Shibboleth does pass attribute to server variable in PHP

I am building a SAML based federated authentication mechanism in which the IdP is ADFS 2.0 and the SP is Shibboleth running on Linux. I am able to do the following: Attempt to access a protected ...
1
vote
1answer
74 views

.htaccess AuthType not what I expected

I'm working on a new project at work in PhP, and have come across something I'm unfamiliar with/can't find any help with. In the .htaccess file for the directory I see AuthType UWNetID require valid-...
1
vote
0answers
481 views

Shibboleth Authentication to AD failed with error “file not found”

I am new to Shibboleth and try to configure authentication between ADFS and Shibboleth. The users are stored in AD. I've already connected ADFS and Shibboleth and able to see the login page, after ...
0
votes
2answers
1k views

Upgrade Shibboleth to newest version on Ubuntu

I have an Ubuntu (12.04.4 LTS) web server running Shibboleth 2.4.3 I think Shibboleth was installed using apt-get dpkg --get-selections | grep shib libapache2-mod-shib2 install libshibsp5 ...
0
votes
1answer
146 views

Install shibboleth timeout in centos

I am trying to install Shibboleth via ansible in a centos-7 machine which is hosted in AWS. But am getting "Operation too slow. Less than 1000 bytes/sec transferred the last 30 seconds" error for ...
0
votes
1answer
846 views

Shibboleth Could not locate Java.exe Please check the value for JAVA_HOME [closed]

I am trying to install Shibboleth for development on my local copy of windows 10. I am on the first step and stuck. After downloading the shibboleth identity provider I am not able to install as I ...
0
votes
1answer
2k views

Skipping unmapped SAML 2.0 attribute, even though name and nameFormat matchf

SP running Shibboleth 2.5.6. For one particular IdP, I have these attribute mappings: <Attribute name="role" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" id="role" /...
0
votes
1answer
1k views

Shibboleth - opensaml::FatalProfileException

I have configured and installed shibboleth Idp and sp on a Ubuntu machine locally. The Idp is configured with LDAP. I am trying to access the secure.html file which hosted in Apache and secured by ...
0
votes
2answers
964 views

Enable Shibboleth for Single SSL Virtual host on server with many vhosts

We have a RHEL 5.5 server in production with a few NameBasedVirtual hosts listening on port 80. We have also have two (possibly mis-configured) SSL virtual hosts which use different Sockets as ...
0
votes
1answer
162 views

Shibboleth SP 2 and ADFS sha1 to sha256

With shibboleth SP 2, I need to configure ADFS (as IdP) in advance tab SHA-1 algorithm to work fine. If I configure in ADFS SHA-256 hash algorithm, I get an error in ADFS event log, that SP reponses ...
0
votes
1answer
56 views

Redirect website login to different IDP

My organization has a Shibboleth/IDP service set up. Now that I am getting involved, I am first setting up my own basic IDP on a test server to learn the ropes. In order to test functionality, I want ...
0
votes
1answer
586 views

Shibboleth SPNEGOAuthnConfiguration in CentOS server

I have requirement were the user's were already joined to domain logged in using the same credential from ldap server, they don't want to enter it again to login into shibboleth SSO, so I searched ...
0
votes
2answers
898 views

Shibboleth 3 - SAML response for Attribute

I have configured Shibboleth 3 to give the SAML response containing the following Attribute Statement <saml2:AttributeStatement> <saml2:Attribute ...
0
votes
1answer
526 views

Why shibboleth IdP idp-metadata.xml recommends 8443 for SOAP?

After the install.sh of 2.4.0 Shibboleth Identity Server, the idp-metadata.xml file is created. Why is that? Is not enough secure to use the standard HTTPS/443 port? <ArtifactResolutionService ...
0
votes
1answer
668 views

apache, shibboleth, load balancing alias, ssl

Good morning folks Could you give me a bit of help with the following problem ? I have a dns load balancing mechanism and an alias (hostAlias) which may point to host01, or host02 I want to ...
0
votes
1answer
420 views

Setting up Shibboleth to secure part of a website

I've installed the Shibboleth module for apache on Ubuntu 10.04 using aptitude to install libapache2-mod-shib2 as per https://groups.google.com/group/shibboleth-users/browse_thread/thread/...
0
votes
0answers
12 views

Shibboleth: add IDP and SP entityID to attribute value

I have an attribute value (identifier) that looks like following: 5678 I would like to add entityID of both IDP and the recipient SP to get the (targeted) attribute value: idp-entity-id!sp-entity-id!...