Closed asonj closed 3 years ago
It appears as though your Shib authorizer isn't recognising your secured paths to allow the headers through. Check this section of your shibboleth2.xml
:
<Host name="https://myDomain.com" authType="shibboleth" requireSession="true" redirectToS>
<Path name="auth/login/callback"/>
<Path name="user/login" requireSession="false"/>
</Host>
The <Host>
name needs just be the hostname (mydomain.com
) and not have a scheme/protocol present -- that looks to be it. You can add a scheme via scheme="https"
if you just want to match specifically; otherwise both http and https get matched (https://wiki.shibboleth.net/confluence/display/SP3/Host).
Also, path names don't need to begin with a /
but I make mine match nginx exactly. redirectToS
needs to be fixed too, which might affect parsing of the node in XML.
@davidjb Dude, you are a wizard. Removing the scheme/protocol fixed it. Thanks a ton. Can I send you a coffee or something?
Excellent - glad to know that was it. Thanks for the kind offer but just happy to help.
Description of the Issue
I am using Shibboleth SSO for user authentication on a website, NodeJS backend with a NGINX proxy. I am able to login through the IdP and it redirects back to the callback URL. The problem is I cannot create an account on the NodeJS side because the shibboleth session variables are not being passed through the headers. I know Shibboleth SP is working because I can go to https://domain.com/Shibboleth.sso/Session and see the attributes listed. I used this guide 1 and this guide 2 as a reference when setting everything up.
I have read and tried seemingly everything. I've been stuck on this issue for days and am at my wits end.
Expected behaviour
I expect using
shib_request_use_headers on; shib_request /shibauthorizer;
to copy Shibboleth attributes onto the request headers. However, no shibboleth attributes are available on the nodejs side, I believe this could be due to them being blank strings, in which case why arent they being set? I even tried manually settingproxy_set_header shib_mail $upstream_http_variable_mail
and it does not come through.Related Issues
Seems related to NGINX not passing Shibboleth session variables in header #9 where RequestMapper was the issue. I have tried many different variants of my RequestMapper with no luck.
Shibboleth Session (/Shibboleth.sso/Session)
shibboleth2.xml
NGINX Conf
shib_fastcgi_params
Relevant Shibd.log
Nginx Logs
Versions and Systems
Additional context
If I missed any details let me know and I'll be happy to provide them. I really need to solve this issue. A HUGE thanks in advance!