Principal from the IDP usernamePassword login handler versus mod_auth_kerb

[Wessel, Keith William]

Thanks, Scott. Rather than working around mod_auth_kerb, I think I'll try the JAAS approach first.

According to the example on the wiki, I can extend web.xml by copying it from my jar file or the IDP package to my $IDP_HOME/conf directory. Is that really the case? Will the IDP pay attention to a web.xml in the conf dir? I just put it in there, and it's not looking at it after a Tomcat restart... but it's always the case that I didn't make a needed customization to the example fragment to add to the extended web.xml.

Thanks,
Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, December 19, 2012 10:26 PM
To: Shib Users
Subject: Re: Principal from the IDP usernamePassword login handler versus mod_auth_kerb

On 12/19/12 4:59 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:

>Anyone else have to work around this? As far as I can tell, I can try to
>find a way to get Apache to modify REMOTE_USER before passing it to
>Tomcat, I can write some fancy logic for the principal in the IDP that
>removes the domain name if it exists, or I can give up and take the JAAS
>approach instead of mod_auth_kerb which, for all I know, might get me
>back to where I started.

I went with the JAAS approach because I had to configure that anyway, to
use my modified version of the user/pass handler.

I preferred that to having a separate configuration (and I didn't have
Apache in front anymore anyway).

> 
>If there¹s a better way to do this, either via configuration of
>mod_auth_kerb or of the IDP, please let me know!

I don't think there's anything you can do to mod_auth_kerb, so if you want
to use that, you'd have to deal with it in the resolver.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net