search

Uninett / mod_auth_mellon

An Apache module with a simple SAML 2.0 service provider
207 stars 182 forks source link

Wrong Address in SubjectConfirmationData.Current #210

Closed b4ldr closed 5 years ago

b4ldr commented 5 years ago

Just tried using this module today with shibboleth idp version and triggered the following error

[Fri Jun 21 19:24:18.422147 2019] [:error] [pid 2826] [client 127.0.0.1:42088] Wrong Address in SubjectConfirmationData.Current address is "::1", but should have been "0:0:0:0:0:0:0:1".

Im not sure if this is an error with you module, shibboleth or, more probably, designed behavior and triggered by my strange configuration (see below). however it seems that shibboleth and mod_auth_mellon both store the ipv6 address in different compressed formats and this causes a mismatch. I also triggered this when accessing both via different IP versions by changing localhost to 127.0.0.1 for only the apache01 ssh session in the description below

[Fri Jun 21 19:24:18.422147 2019] [:error] [pid 2826] [client 127.0.0.1:42088] Wrong Address in SubjectConfirmationData.Current address is "127.0.0.1", but should have been "0:0:0:0:0:0:0:1".

For my config i have two virtual machines.

  1. shibboleth running on port 8443 and 8080
  2. apache wiht mod_authz_mellon on port 8081 I access theses machines using ssh with the following ssh -L8443:localhost:8443 -L8080:localhost:8080 shibboleth01 ssh -L8081:localhost:8081 apache01

i also have entries for shibboleth01 and apache01 in /etc/hosts

changing to the following fixed my problems ssh -L8443:127.0.0.1:8443 -L8080:127.0.0.1:8080 shibboleth01 ssh -L8081:127.0.0.1:8081 apache01

please feel free to close this as invalid but happy to do more trouble shooting if its usefull

olavmrk commented 5 years ago

Closing this issue as part of archiving this project. See the announcement for details:

https://github.com/Uninett/mod_auth_mellon/blob/info/README.md