我在Drupal 8和IIS(版本8.5)中使用shibboleth身份验证(模块:shib_auth 8.x-1 .x-dev)时遇到问题,在IDP中登录后,我重定向到Drupal,但未登录。使用SAML浏览器扩展,我看到了https://example.com/SAML2/POST的POST调用,该调用打开了一个带有调试信息的drupal登录页面,在其中我可以在Server数组变量中找到用户名和电子邮件,但是模块部分未设置shib_auth变量。我检查/Shibboleth.sso/Session,发现具有正确属性的正确打开的会话。我在报告中没有任何错误,数据库中存在用户(shib_authmap表),并且没有新用户。我认为问题出在shib_auth模块配置中,但是我在drupal站点中找不到任何日志文件或错误。
这是我的配置:
我的IIS webcofig:
<rule name="Ignore Shibboleth" stopProcessing="true">
<match url="Shibboleth\.sso" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
<action type="None" />
</rule>
我的shibboleth2.xml:
<Host scheme="https" name="mysite.com" requireSession="true" authType="shibboleth">
<Path name="secure" authType="shibboleth" requireSession="true"/>
<Path name="shib_login/user" authType="shibboleth" requireSession="true" />
</Host>
...
<ApplicationDefaults entityID="mysite.com"
REMOTE_USER="eppn persistent-id targeted-id username email firstname lastname"
...
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true" cookieProps="https"
handlerURL="/Shibboleth.sso">
...
<SSO entityID="https://MYIDP.com">
SAML2 SAML1
</SSO>
<SessionInitiator type="Chaining" Location="/Login" isDefault="true"
relayState="cookie" entityID="https://MYIDP.com">
<SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/>
</SessionInitiator>
<LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
<LogoutInitiator type="SAML2" template="bindingTemplate.html"/>
<LogoutInitiator type="Local"/>
</LogoutInitiator>
...
我对Drupal网站的.htaccess:
<Location / >
AuthType shibboleth
ShibRequireSession on
ShibUseHeaders on
require shibboleth
</Location>
调试shib_auth信息:
$_SERVER:
Array (
[HTTP_REMOTEUSER] => value of REMOTEUSER
[HTTP_USERNAME] => value of USERNAME
[HTTP_LASTNAME] => value of LASTNAME
[HTTP_FIRSTNAME] => value of FIRSTNAME
[HTTP_EMAIL] => value of EMAIL
...
)
模块配置:
Array
(
[_core] => Array
(
[default_config_hash] =>
)
[debug_prefix_path] => /user/
[enable_debug_mode] => 1
[force_https_on_login] => 1
[logout_error_message] =>
[server_variable_email] => HTTP_EMAIL -> not valorized
[server_variable_username] => HTTP_USERNAME -> not valorized
[shibboleth_account_linking_text] => Link this account with another identity
[shibboleth_login_handler_url] => /Shibboleth.sso/Login
[shibboleth_login_link_text] => Shibboleth Login
[shibboleth_logout_handler_url] => /Shibboleth.sso/Logout
[url_redirect_login] => /
[url_redirect_logout] => /
)
非常感谢您的任何建议或回应
我已解决此问题,我安装了匿名重定向模块,并在“重定向URL替代”中插入“ / shib_login”。此解决方法允许Shibboleth调用shib_login页面并设置shib_auth变量。