Shibboleth security and ./?a=ASSETID image links


(Douglas (@finnatic at @waikato)) #1

Has anyone ever encountered some issues with images not loading via ./?a=ASSETID image links when a site is secured using Shibboleth?

Shibboleth is fairly standard, so I’m hoping we’re not alone in the Matrix community using it, although our setup involves a reverse proxy as well (with shibboleth security on both the frontend system and the backend system) which again, hopefully isn’t too uncommon.

We’re working through the transition to Shibboleth currently, and with one site I’m seeing some odd behaviour where a page doesn’t load two out of four images in a browser when the Shibboleth security is in place on the proxying front end server. Revert it to the old security method, and all four images load. I’m puzzled as to why front end server setup is impacting on what Matrix is able to relay back.

The two images that don’t load are being loaded in the browser using ?a=ASSETID links, as they don’t have a webpath (they’re stored outside the site in a separate folder for site assets, as per a practice Squiz NZ gave us in the past) - however the ?a=ASSETID links work when Shibboleth isn’t enabled, making me think that Shibboleth’s usage is impacting on the browser’s request for the image.


(Bart Banda) #2

Sounds like there are some permission things in play perhaps. What response headers do you get for the 2 images that don’t load? 404 or 403 or something else?

Do those images have any different permission settings in play to the other images?

And do they load on the exact same base URL as the other working images?


(Douglas (@finnatic at @waikato)) #3

I’m fairly sure at this point after eliminating a possible trailing slash behaviour scenario that the problem was self inflicted with some shibboleth config that was partially setup and still working, but not 100% complete and missing a few lines.

Adding the missing config lines seems to have resolved the issue.