Authenticate via Shibboleth and LDAP

[Stephan Hackstedt]

Hi Chard,

thanks for the quick response.
I started from scratch again and followed you advices to use the official
documentation.
At the end I got it to work properly. Now I can protect a ressource and
access it the shib acces page.
Nevertheless while following the instruction some issues came up.
One is after follwing the IdP installtin instructin on:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall

I wasn't able to access the
https://HOSTNAME/idp/profile/Status<https://hostname/idp/profile/Status>
page.
Got some kind of  bad cert error.

After I changed in apache server.xml

<Connector port="8443"
           protocol="org.apache.coyote.http11.Http11Protocol"
           SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
           scheme="https"
           SSLEnabled="true"
           clientAuth="*true*"
           keystoreFile="IDP_HOME/credentials/idp.jks"
           keystorePass="PASSWORD" />

to

<Connector port="8443"
           protocol="org.apache.coyote.http11.Http11Protocol"
           SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
           scheme="https"
           SSLEnabled="true"
           clientAuth="*false*"
           keystoreFile="IDP_HOME/credentials/idp.jks"
           keystorePass="PASSWORD" />

it worked.

Stephan


2012/6/16 Chad La Joie <lajoie at itumi.biz>

> First, be sure you're using the actual Shibboleth documentation not some
> third party document.
>
> Second, turn on logging for the LDAP library and see what it says.
>
> On 6/16/12 11:06 AM, Stephan Hackstedt wrote:
> > Hi,
> >
> > I'm new to Shibboleth and trying to setup a test environment on a single
> > Windows / x64 machine.
> > I followed some tutorials. Now I'm at a point where I'm trying to access
> > a ressource on the SP. The redirection to the IdP loginpage works fine.
> > But I cannot login, no matter if I use the right user/pw combination or
> not.
> > I'm using LDAP as storage for the user data.
> > I tested two different LDAP Systems (APacheDS, OpenDS) but I couldnt get
> > it to work. The same error with both.
> >
> > The connection to the LDAP service can be established successfull on IdP
> > Startup, but after redirection and typing  username and passwort at the
> > login screen Shibboleth IdP always gives the message "Credentials not
> > recognized".
> > Are there other configuration files, beside login.conf and
> > attribute-resolver,xmlm which I need to consider?
> >
> > It would be nice, if some has a hint for me regarding my problem, My
> > progress really stucks.
> >
> > conf snippets:
> >
> >
> > attribute-resolver.xml:
> > *
> >     <!-- Example LDAP Connector for OpenDS-->
> >     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
> >         ldapURL="ldap://127.0.0.1:12389 <http://127.0.0.1:12389>"
> >         baseDN="ou=people,dc=example,dc=com"
> >         principal="cn=Directory Manager"
> >         principalCredential="secret2">
> >         <dc:FilterTemplate>
> >             <![CDATA[
> >                 (uid=$requestContext.principalName)
> >             ]]>
> >         </dc:FilterTemplate>*
> >
> > login.config:
> >
> > *ShibUserPassAuth {
> >       edu.vt.middleware.ldap.jaas.LdapLoginModule required
> >       host="127.0.0.1"
> >       base="ou=people,dc=example,dc=com"
> >       bindDn ="cn=Directory Manager"
> >       bindCredential="secret2"
> >       port="12389"
> >       ssl="false"
> >       tls="false"
> >       userField="uid";
> > };*
> >
> > Regards,
> > Stephan
> >
> >
> > --
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> >
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120617/f1c0d7bb/attachment.html