arctic vault
A short premise:
I have an internal server for which I want to have an authentication in front of as a second line of defence, so to speak. I had problems implementing this on our firewall (still working with their support to maybe implement it there), but for the time being I set up a separate proxy server to do that part. I have Apache running in reverse proxy mode (which works), then added and configured mod_auth_mellon for SAML auth (the application on the internal server should also support SAML auth, thereby allowing me to have users do SSO instead of multiple login prompts).
Now, when going to the website, Apache already redirects me correctly to my Authentik frontend, which presents the login form. Problem is, when I log in there successfully (or am already authenticated), I get redirected to https://THEWEBSITE/mellon/postResponse , which - even though I have a location handler configured for mellon, results in an error ("Your browser sent a request that this server could not understand.")
Looking at the Apache logs, I found this:
Error processing authn response. Lasso error: [-1500] The provider has no known public key, SAML Response: StatusCode1="urn:oasis:names:tc:SAML:2.0:status:Success", StatusCode2="(null)", StatusMessage="(null)"
Checking the config (and asking ChatGPT), I found that this line was originally missing:
MellonIdPPublicKeyFile /etc/apache2/saml2/idp-public.crt
I then inserted Authentik's .crt file at that location, but keep getting the same error.
What I did notice - again, based on the ChatGPT output - is that the metadata.xml from Authentik didn't have any Key Info section. Adding that manually to the xml didn't help, though, the error remains the same.
What could I be missing?
N.B.: I have Authentik SAML auth working for e.g. Firewall Admin login, and believe I have adequately configured the new client setup for the webserver ...
timber frost