Closed danielc103 closed 4 years ago
I have the same issue. Also looking for assistance.
@danielc103 What does your fastcgi_params
file look like? Given the response you're seeing from shibresponder
(which corresponds to line 365 in the source, it appears as though something's up with the request before it reaches this point (eg incorrect FastCGI request environment).
If you try loading other /Shibboleth.sso/*
URLs, like /Shibboleth.sso/Login
do you see the same 500 error and response?
You can also try overriding the server name, scheme and port via shell-level environment variables (details) -- worth a try to see if that makes a difference for you as a temporary solution.
I'm not setting any extra/different fastcgi_params
in nginx block.
I am getting the same 500 error and response on my all /Shibboleth.sso/*
calls. The login will originally take me to my login page, but then returns after login to 500 error.
[debug] 24#0: *1 http script copy: "QUERY_STRING"
[debug] 24#0: *1 fastcgi param: "QUERY_STRING: "
[debug] 24#0: *1 http script copy: "REQUEST_METHOD"
[debug] 24#0: *1 http script var: "POST"
[debug] 24#0: *1 fastcgi param: "REQUEST_METHOD: POST"
[debug] 24#0: *1 http script copy: "CONTENT_TYPE"
[debug] 24#0: *1 http script var: "application/x-www-form-urlencoded"
[debug] 24#0: *1 fastcgi param: "CONTENT_TYPE: application/x-www-form-urlencoded"
[debug] 24#0: *1 http script copy: "CONTENT_LENGTH"
[debug] 24#0: *1 http script var: "12955"
[debug] 24#0: *1 fastcgi param: "CONTENT_LENGTH: 12955"
[debug] 24#0: *1 http script copy: "SCRIPT_NAME"
[debug] 24#0: *1 http script var: "/Shibboleth.sso/SAML2/POST"
[debug] 24#0: *1 fastcgi param: "SCRIPT_NAME: /Shibboleth.sso/SAML2/POST"
[debug] 24#0: *1 http script copy: "REQUEST_URI"
[debug] 24#0: *1 http script var: "/Shibboleth.sso/SAML2/POST"
[debug] 24#0: *1 fastcgi param: "REQUEST_URI: /Shibboleth.sso/SAML2/POST"
[debug] 24#0: *1 http script copy: "DOCUMENT_URI"
[debug] 24#0: *1 http script var: "/Shibboleth.sso/SAML2/POST"
[debug] 24#0: *1 fastcgi param: "DOCUMENT_URI: /Shibboleth.sso/SAML2/POST"
[debug] 24#0: *1 http script copy: "DOCUMENT_ROOT"
[debug] 24#0: *1 http script var: "/etc/nginx/html"
[debug] 24#0: *1 fastcgi param: "DOCUMENT_ROOT: /etc/nginx/html"
[debug] 24#0: *1 http script copy: "SERVER_PROTOCOL"
[debug] 24#0: *1 http script var: "HTTP/1.1"
[debug] 24#0: *1 fastcgi param: "SERVER_PROTOCOL: HTTP/1.1"
[debug] 24#0: *1 http script copy: "REQUEST_SCHEME"
[debug] 24#0: *1 http script var: "https"
[debug] 24#0: *1 fastcgi param: "REQUEST_SCHEME: https"
[debug] 24#0: *1 http script copy: "HTTPS"
[debug] 24#0: *1 http script var: "on"
[debug] 24#0: *1 fastcgi param: "HTTPS: on"
[debug] 24#0: *1 http script copy: "GATEWAY_INTERFACE"
[debug] 24#0: *1 http script copy: "CGI/1.1"
[debug] 24#0: *1 fastcgi param: "GATEWAY_INTERFACE: CGI/1.1"
[debug] 24#0: *1 http script copy: "SERVER_SOFTWARE"
[debug] 24#0: *1 http script copy: "nginx/"
[debug] 24#0: *1 http script var: "1.16.0"
[debug] 24#0: *1 fastcgi param: "SERVER_SOFTWARE: nginx/1.16.0"
[debug] 24#0: *1 http script copy: "REMOTE_ADDR"
[debug] 24#0: *1 http script var: "10.130.4.1"
[debug] 24#0: *1 fastcgi param: "REMOTE_ADDR: 10.130.4.1"
[debug] 24#0: *1 http script copy: "REMOTE_PORT"
[debug] 24#0: *1 http script var: "48920"
[debug] 24#0: *1 fastcgi param: "REMOTE_PORT: 48920"
[debug] 24#0: *1 http script copy: "SERVER_ADDR"
[debug] 24#0: *1 http script var: "10.129.11.34"
[debug] 24#0: *1 fastcgi param: "SERVER_ADDR: 10.129.11.34"
[debug] 24#0: *1 http script copy: "SERVER_PORT"
[debug] 24#0: *1 http script var: "8443"
[debug] 24#0: *1 fastcgi param: "SERVER_PORT: 8443"
[debug] 24#0: *1 http script copy: "SERVER_NAME"
[debug] 24#0: *1 http script var: "testdevguide.edu"
[debug] 24#0: *1 fastcgi param: "SERVER_NAME: testdevguide.edu"
[debug] 24#0: *1 http script copy: "REDIRECT_STATUS"
[debug] 24#0: *1 http script copy: "200"
[debug] 24#0: *1 fastcgi param: "REDIRECT_STATUS: 200"
[debug] 24#0: *1 fastcgi param: "HTTP_USER_AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0"
[debug] 24#0: *1 fastcgi param: "HTTP_ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
[debug] 24#0: *1 fastcgi param: "HTTP_ACCEPT_LANGUAGE: en-US,en;q=0.5"
[debug] 24#0: *1 fastcgi param: "HTTP_ACCEPT_ENCODING: gzip, deflate, br"
[debug] 24#0: *1 fastcgi param: "HTTP_CONTENT_TYPE: application/x-www-form-urlencoded"
[debug] 24#0: *1 fastcgi param: "HTTP_CONTENT_LENGTH: 12955"
[debug] 24#0: *1 fastcgi param: "HTTP_REFERER: https://shib.edu/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fexqjez4kJDWamY4KmSa7wCZEyyf3a1Y6AesscYZYWrizRDBOmX03Ghsd2BzsHsl4GGzSkjlXIOMUteFS9hvWyXBN6LxZQW%2BbF%2FBB9nSvFJlaWpwlY9o6KEkpNk6L4i36IxK80P%2BJQ07vW%2BUuyQo2dDuSy%2BqhrN9A1JZEI7m%2BZp4y0VCngWXUSljMQknMIqAB%2FE4iEejYcSH45Hgw06G2MJSo%2BPaJSQM%2BnEviHthVPQHbBCx4eCJeNl5%2BY3SUunt35jKkwjZbVFkvdOkR7B4nNMJSDo9wGbHYnuF%2F%2B9Y%2Fs2cpP8jjD%2BEp%2FSq8NTesPuuYbnITK3Epzera%2FM%2Bt8AdJKRPaHqy%2FL6U9As%3D&RelayState=https%3A%2F%2Ftestdevguide.edu%3A8443%2Fsecure%2F "
[debug] 24#0: *1 fastcgi param: "HTTP_COOKIE: _ga=GA1.2.1399869529.1558006746; 641aa2fc9369a48a37f43f2c5cddba1e=275677e718c4f473a3bc994d92485e40"
[debug] 24#0: *1 fastcgi param: "HTTP_UPGRADE_INSECURE_REQUESTS: 1"
[debug] 24#0: *1 fastcgi param: "HTTP_HOST: testdevguide.edu"
[debug] 24#0: *1 fastcgi param: "HTTP_X_FORWARDED_HOST: testdevguide.edu"
[debug] 24#0: *1 fastcgi param: "HTTP_X_FORWARDED_PORT: 443"
[debug] 24#0: *1 fastcgi param: "HTTP_X_FORWARDED_PROTO: https"
[debug] 24#0: *1 fastcgi param: "HTTP_FORWARDED: for=10.18.248.34;host=testdevguide.edu;proto=https;proto-version="
[debug] 24#0: *1 fastcgi param: "HTTP_X_FORWARDED_FOR: 10.18.248.34"
Tried overriding server name with env variables. Got the same response.
$ printenv | grep SHIB
SHIBSP_SERVER_PORT=8443
SHIBSP_SERVER_NAME=testdevguide.edu
SHIBBOLETH_RESPONDER_PATH=/Shibboleth.sso
SHIBSP_SERVER_SCHEME=https
Check your handlerURL
in your shibboleth config:
handlerURL="https://testdevguide.edu/Shibboleth.sso"
This is set as using port 443 but you're using port 8443 so the responder is bailing on incoming requests because their port doesn't what it is configured to handle. Try setting it like so:
handlerURL="https://testdevguide.edu:8443/Shibboleth.sso"
(or set it as relative /Shibboleth.sso
since your hostname/port are the same as this absolute URL)
Also, ensure that you fully restart shibd
, shibauthorizer
and shibresponder
whenever you make a change to your shib configuration; they each hold the config in memory so need to be restarted as a group.
I think this is where the problem lies then.
I'm deploying in OpenShift and can not expose that port directly. It must come in through a route(ingress). In this case it is https://testdevguide.edu
and must be port 443. Then a HA Proxy redirects that traffic to my service inside the cluster, port 8443
on my pod. So when my Shibboleth ACS redirects to the generated url from the <Host>
tag it would fail with the added port number.
I found that you could hard code the handlerURL
and the ACS generated from that hit the correct route. I thought all was well. So the next question would be how to redirect through the HA Proxy (if possible).
All services get restarted on each code change, I'm just redeploying entire image in OpenShift.
In that case, you can tell the FastCGI applications that 443 is the port that requests are coming in on (even though Nginx is listening 8443) via:
fastcgi_param SERVER_PORT 443;
You could set that in your fastcgi_params
file so it applies globally or just to the individual location
blocks.
Make sure your shib configuration's <RequestMapper>
configuration uses the same port 443 and you should be good to go. The FastCGI apps will operate as if none the wiser about the use of 8443 to host Nginx.
That worked - for the most part! I'm getting a weird 301 response hitting the /secure
location, it's immediately redirecting to port 8443
port for some odd reason. Once I remove that, it goes through and Shib flow works. It looks like this is an OpenShift issue at the moment as it's not hitting nginx at all with the 301
.
Thanks a ton for helping out @davidjb !
@danielc103 Goodo, glad to know your config is sorted. I added a few corresponding notes about these types of symptoms to the project docs.
Description the bug
Error : FastCGI Shibboleth responder should only be used for Shibboleth protocol requests. Receiving above error on port 8443 with SSL configured. This instance sits inside OpenShift.
Expected behaviour
No fastcgi error
Setup & Logs
please note on earlier issue I fat fingered fake values to protect info, I apologize. I was more careful this time around
shibboleth2.xml
logs
Versions and Systems
Additional context
Port 8443 just allows access and not take me to the login screen unless ssl is configured and port 8080 takes me to the login screen but throws the "FastCGI Shibboleth responder should only be used for Shibboleth protocol requests."
I needed to add an absolute handlerURL because I can not expose ports on Openshift routes and Shibboleth config generates the ACS from scheme+vhost+port. This would fail was there is no way to reach this generated redirect. However once I hard coded the handlerURL the ACS gets through.
I assumed the issue at this point was that the handerlURL was https so it was expecting a secure connection, and after reading the issues regarding the above mentioned Shibboleth error, I changed the port to 8443 and implemented SSL on that port to no avail.
I've read through issues
22
25
38
And combed through the mailing list for some mention of cloud deployment and proxy issues that might have resolution. If they are there I've failed miserably at finding them.
If you need more logs or questions on what I've tried (I think everything!) Please ask. Any help is greatly appreciated.