Authenticate via Shibboleth and LDAP

[Stephan Hackstedt]

I could solve a part of the problem, and know I can access the

https://sp.machine.com:553/Shibboleth.sso/Metadata (SP runs under port 553,
cause both SP and IdP are running on the same machine)
and
https://idp.machine.com/idp/profile/Status

Nevertheless, when setting *clientAuth="true"* in tomcats server.xml I
always got the follwing error when trying to access a protecetd ressource.
*
ssl_error_bad_cert_alert*

A configured a virtual host in Apache httpd.conf:
*
<VirtualHost _default_:553>
                    ServerName sp.machine.com:553
                    Include
D:\opt\shibboleth-sp\etc\shibboleth\apache22.config
                    DocumentRoot D:\opt\Apache2.2\htdocs
                    ErrorLog D:\opt\Apache2.2/logs/error_ssl2.log
                    CustomLog D:\opt\Apache2.2/logs/access_ssl2.log combined

                    <Location /secure>
                    AuthType shibboleth
                    ShibRequireSession On
                    require valid-user
                    </Location>

  SSLEngine on
 SSLCertificateFile "D:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"
 SSLCertificateKeyFile "D:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem"

</VirtualHost>*

Still don't get where the problem is. If i set *clientAuth="false"* the
error disappears and the shibboleth login appears as wished.

Stephan


2012/6/17 Chad La Joie <lajoie at itumi.biz>

> If you went to the status URL (I assume you filled in the proper
> hostname) then you didn't use port 8443 so the connector had nothing
> to do with it.  Making the change you did, however, will break any
> back-channel requests.
>
> On Sun, Jun 17, 2012 at 8:37 AM, Stephan Hackstedt
> <stephan.hackstedt at googlemail.com> wrote:
> > One is after follwing the IdP installtin instructin on:
> >
> > https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall
> >
> > I wasn't able to access the https://HOSTNAME/idp/profile/Status page.
> Got
> > some kind of  bad cert error.
> >
> > After I changed in apache server.xml
> >
> > <Connector port="8443"
> >            protocol="org.apache.coyote.http11.Http11Protocol"
> >
> >
> SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
> >            scheme="https"
> >            SSLEnabled="true"
> >            clientAuth="true"
> >            keystoreFile="IDP_HOME/credentials/idp.jks"
> >            keystorePass="PASSWORD" />
> >
> > to
> >
> > <Connector port="8443"
> >            protocol="org.apache.coyote.http11.Http11Protocol"
> >
> >
> SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
> >            scheme="https"
> >            SSLEnabled="true"
> >            clientAuth="false"
> >            keystoreFile="IDP_HOME/credentials/idp.jks"
> >            keystorePass="PASSWORD" />
> >
> > it worked.
> >
> > Stephan
> >
> >
> >
> > 2012/6/16 Chad La Joie <lajoie at itumi.biz>
> >>
> >> First, be sure you're using the actual Shibboleth documentation not some
> >> third party document.
> >>
> >> Second, turn on logging for the LDAP library and see what it says.
> >>
> >> On 6/16/12 11:06 AM, Stephan Hackstedt wrote:
> >> > Hi,
> >> >
> >> > I'm new to Shibboleth and trying to setup a test environment on a
> single
> >> > Windows / x64 machine.
> >> > I followed some tutorials. Now I'm at a point where I'm trying to
> access
> >> > a ressource on the SP. The redirection to the IdP loginpage works
> fine.
> >> > But I cannot login, no matter if I use the right user/pw combination
> or
> >> > not.
> >> > I'm using LDAP as storage for the user data.
> >> > I tested two different LDAP Systems (APacheDS, OpenDS) but I couldnt
> get
> >> > it to work. The same error with both.
> >> >
> >> > The connection to the LDAP service can be established successfull on
> IdP
> >> > Startup, but after redirection and typing  username and passwort at
> the
> >> > login screen Shibboleth IdP always gives the message "Credentials not
> >> > recognized".
> >> > Are there other configuration files, beside login.conf and
> >> > attribute-resolver,xmlm which I need to consider?
> >> >
> >> > It would be nice, if some has a hint for me regarding my problem, My
> >> > progress really stucks.
> >> >
> >> > conf snippets:
> >> >
> >> >
> >> > attribute-resolver.xml:
> >> > *
> >> >     <!-- Example LDAP Connector for OpenDS-->
> >> >     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
> >> >         ldapURL="ldap://127.0.0.1:12389 <http://127.0.0.1:12389>"
> >> >         baseDN="ou=people,dc=example,dc=com"
> >> >         principal="cn=Directory Manager"
> >> >         principalCredential="secret2">
> >> >         <dc:FilterTemplate>
> >> >             <![CDATA[
> >> >                 (uid=$requestContext.principalName)
> >> >             ]]>
> >> >         </dc:FilterTemplate>*
> >> >
> >> > login.config:
> >> >
> >> > *ShibUserPassAuth {
> >> >       edu.vt.middleware.ldap.jaas.LdapLoginModule required
> >> >       host="127.0.0.1"
> >> >       base="ou=people,dc=example,dc=com"
> >> >       bindDn ="cn=Directory Manager"
> >> >       bindCredential="secret2"
> >> >       port="12389"
> >> >       ssl="false"
> >> >       tls="false"
> >> >       userField="uid";
> >> > };*
> >> >
> >> > Regards,
> >> > Stephan
> >> >
> >> >
> >> > --
> >> > To unsubscribe from this list send an email to
> >> > users-unsubscribe at shibboleth.net
> >> >
> >>
> >> --
> >> Chad La Joie
> >> www.itumi.biz
> >> trusted identities, delivered
> >>
> >>
> >> --
> >> To unsubscribe from this list send an email to
> >> users-unsubscribe at shibboleth.net
> >
> >
> >
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120617/d3ea117a/attachment-0001.html