getUser Authenticator is returning null | Confluence 4.2.4

[Gordon, Lyndon-Michael]

Good Day,

I would like to ask for some assistance for a newbie to Shibboleth authentication integration for Confluence.  I appreciate any assistance that I receive.  Thanks

********

We are running a IDP with shibboleth-2.3.1-0 on RHEL 5.6 x86_64, and Confluence connects via it's SP on RHEL 5.2 x86_64 through the remoteUserAuthenticator.jar and configuration files.  We were operating fine with remoteAuth1.7.3 and Confluence3.4, but stepping up to remoteAuth2.1.14 and Confluence4.2.4 breaks.  I see this in the logging :

loginFailed Login failed for user null. request=com.atlassian.plugin.servlet.PluginHttpRequestWrapper at 78d59bc7, username=null, remoteHost=10.110.27.153, remoteIP=10.110.27.153, reason=NoUsername
2012-06-15 10:00:48,422 DEBUG [http-8090-1] [confluence.authentication.shibboleth.RemoteUserAuthenticator] loginFailed Login failed for user null. request=com.atlassian.plugin.servlet.PluginHttpRequestWrapper at 78d59bc7, username=null, remoteHost=10.110.27.153, remoteIP=10.110.27.153, reason=NoUsername
2012-06-15 10:00:48,426 DEBUG [http-8090-1] [confluence.authentication.shibboleth.RemoteUserAuthenticator] getUser Authenticator is returning null from call to public Principal getUser(HttpServletRequest request, HttpServletResponse response)
2012-06-15 10:00:48,426 DEBUG [http-8090-1] [confluence.authentication.shibboleth.RemoteUserAuthenticator] getUser Authenticator is returning null from call to public Principal getUser(HttpServletRequest request, HttpServletResponse response)

As far as configuration, I will remove as much extraneous verbiage to cut down on space :

[remoteUserAuthenticator.properties]

create.users=false
update.info=false
update.last.login.date=true
reload.config=false
reload.config.check.interval=5000
default.roles=confluence-users
#header.fullname=CONF_FULL_NAME
#header.email=CONF_EMAIL
#header.remote_user=REMOTE_USER
header.fullname = X-Shib-cn
header.email = X-Shib-mail
header.remote_user = X-Shib-remoteUser
username.convertcase=true
update.roles=true
convert.to.utf8=false
dynamicroles.auto_create_role=false
dynamicroles.output.tolowercase=true

[seraph-config.xml]

<security-config>
    <parameters>
        <init-param>
            <param-name>login.url</param-name>
            <param-value>/emory-login/?os_destination=${originalurl}</param-value>
        </init-param>
        <init-param>
            <param-name>link.login.url</param-name>
            <param-value>/emory-login/</param-value>
        </init-param>
        <init-param>
            <param-name>cookie.encoding</param-name>
            <param-value>cNf</param-value>
        </init-param>
        <init-param>
            <param-name>login.cookie.key</param-name>
            <param-value>seraph.confluence</param-value>
        </init-param>

        <!--only basic authentication available-->
        <init-param>
            <param-name>authentication.type</param-name>
            <param-value>os_authType</param-value>
        </init-param>

        <!-- Invalidate session on login to prevent session fixation attack -->
         <init-param>
            <param-name>invalidate.session.on.login</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- Add names for session attributes that must not be copied to a new session when the old one gets invalidated.
          Currently it is empty (i.e. all attributes will be copied). -->
        <init-param>
            <param-name>invalidate.session.exclude.list</param-name>
            <param-value></param-value>
        </init-param>
    </parameters>

    <rolemapper class="com.atlassian.confluence.security.ConfluenceRoleMapper"/>
    <controller class="com.atlassian.confluence.setup.seraph.ConfluenceSecurityController"/>
    <authenticator class="shibauth.confluence.authentication.shibboleth.RemoteUserAuthenticator"/>

    <!--
    <authenticator class="com.atlassian.confluence.user.ConfluenceAuthenticator"/>
    -->

    <services>
        <service class="com.atlassian.seraph.service.PathService">
            <init-param>
                <param-name>config.file</param-name>
                <param-value>seraph-paths.xml</param-value>
            </init-param>
        </service>
    </services>

    <elevatedsecurityguard class="com.atlassian.confluence.security.seraph.ConfluenceElevatedSecurityGuard"/>

</security-config>

[proxy_ajp.conf]

LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

ProxyPass /Shibboleth.sso !
ProxyPass /emory-login !
ProxyPass / ajp://localhost:8009/

ErrorDocument 503 /emory-login/error.html

[shib.conf]

LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so

<Location />
  AuthType shibboleth
  require shibboleth
  ShibUseHeaders On
</Location>

<Location /emory-login/shib/>
  ShibRequireSession On
  require valid-user
</Location>

# Convert Shib's environment variables into HTTP headers, so that
# they'll be passed to Tomcat
RequestHeader set X-Shib-businessCategory %{businessCategory}e
RequestHeader set X-Shib-cn %{cn}e
RequestHeader set X-Shib-departmentNumber %{departmentNumber}e
RequestHeader set X-Shib-description %{description}e
RequestHeader set X-Shib-employeeType %{employeeType}e
RequestHeader set X-Shib-givenName %{givenName}e
RequestHeader set X-Shib-mail %{mail}e
RequestHeader set X-Shib-organizationalStatus %{organizationalStatus}e
RequestHeader set X-Shib-ou %{ou}e
RequestHeader set X-Shib-postalAddress %{postalAddress}e
RequestHeader set X-Shib-sn %{sn}e
RequestHeader set X-Shib-telephoneNumber %{telephoneNumber}e
RequestHeader set X-Shib-title %{title}e
RequestHeader set X-Shib-remoteUser %{AUTHENTICATE_UID}e env=AUTHENTICATE_UID






Regards,


Lyndon-Michael Gordon

System Administrator

Emory University Technology Services (UTS)

Integration Group

(p) : 404-712-1567

(e) : Lyndon-Michael.Gordon at emory.edu<mailto:Lyndon-Michael.Gordon at emory.edu>



________________________________

This e-mail message (including any attachments) is for the sole use of
the intended recipient(s) and may contain confidential and privileged
information. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this message (including any attachments) is strictly
prohibited.

If you have received this message in error, please contact
the sender by reply e-mail message and destroy all copies of the
original message (including attachments).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120615/5efb06f3/attachment-0001.html