cPanel Rewrite Inherit Problem

Symptoms

If you add or update a plugin that makes changes to your .htaccess file for you, your Shibboleth login suddenly stops working. Instead of going to the IdP to login, you get a 404 Not Found page from your site or from WordPress. This usually happens on our cPanel hosting platform, but it could appear on other servers.

Details of the Problem

Our cPanel servers declare a virtual-host-level RewriteRule for the Shibboleth SP handler that appears on all sites under the URL /Shibboleth.sso. This rule should be evaluated before your .htaccess files so the login process can use that URL to manage your login sessions.

If WordPress is answering the /Shibboleth.sso URL instead letting it pass through to the Shibboleth process, that usually means one of the plugins has added a line to your .htaccess with this directive:

RewriteOptions Inherit

That tells Apache to evaluate the .htaccess rules before the ones found in our virtual host config. WordPress then grabs every URL that comes through. It doesn't know what to do with /Shibboleth.sso so it usually returns the 404 page.

Fix

Look for that directive in your .htaccess file. Wherever you find it, comment it out or remove it. The site should start working correctly after you save the updated .htaccess file.

To comment out a directive in .htaccess, just put a '#' character in front of the line. Like this:

# RewriteOptions Inherit