shibidp ECP extension configuration: REMOTE_USER not set

[Mauro Minella]

Thanks Brent,
I did one step forward, but I'm still stuck.

Starting from your suggestion
--> you need to configure a Tomcat Realm to protect the ECP profile handler endpoint (...) and you can reuse the JAAS configuration you may have configured for the UsernamePassword LoginHandler, but you do need to declare the Realm separately in Tomcat

I followed these steps:

1. I created a link between Java and login.config that I'm successfully using for IDP passive authentication, so I modified %java_home%\lib\security\java.security as follows (line #88):
--> login.config.url.1=file:C:\Program Files (x86)\Internet2\Shib2IdP/conf/login.config

2. Since login.config contains the following excerpt,
********************
ShibUserPassAuth {
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      host="SHIBDOMAIN.LOCAL"
      port="389"
      base="CN=Users,DC=shibdomain,DC=local"
      serviceCredential="abc123ABC"
      serviceUser="adreader at shibdomain.local"
      subtreeSearch = "true"
      userField="userPrincipalName,uaIdentifier";
};
********************
, I added the following code in $CATALINA_BASE/conf/server.xml  withing the <Engine> node:

<Realm className="org.apache.catalina.realm.JAASRealm" appName="ShibUserPassAuth"/>

Just for the records, I recall that this is the part I modified in  ShibIdpInstall\src\main\webapp\WEB-INF\web.xml before re-building the IDP configuration. I suppose this should bind the ECP path to the realm, shouldn't it:
*****************
<security-constraint>
                <display-name>Shibboleth IdP</display-name>
                <web-resource-collection>
                               <web-resource-name>ECP</web-resource-name>
                               <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
                               <http-method>GET</http-method>
                               <http-method>POST</http-method>
                </web-resource-collection>
                <auth-constraint>
                               <role-name>*</role-name>
                </auth-constraint>
                <user-data-constraint>
                               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
                </user-data-constraint>
</security-constraint>

<login-config>
                <auth-method>BASIC</auth-method>
                <realm-name>ShibUserPassAuth</realm-name>
</login-config>
*****************


3. I restarted Tomcat and tried authenticating with my active client (Outlook 2010): as a result, the following error is tracked in

*****************
ott 01, 2012 6:24:06 PM org.apache.catalina.realm.JAASRealm authenticate
SEVERE: Unexpected error
java.lang.SecurityException: Configuration Error:
            No such file or directory
            at com.sun.security.auth.login.ConfigFile.<init>(Unknown Source)
            at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
            at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
            at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
            at java.lang.reflect.Constructor.newInstance(Unknown Source)
            at java.lang.Class.newInstance0(Unknown Source)
            at java.lang.Class.newInstance(Unknown Source)
            at javax.security.auth.login.Configuration$3.run(Unknown Source)
            at javax.security.auth.login.Configuration$3.run(Unknown Source)
            at java.security.AccessController.doPrivileged(Native Method)
            at javax.security.auth.login.Configuration.getConfiguration(Unknown Source)
            at javax.security.auth.login.LoginContext$1.run(Unknown Source)
            at javax.security.auth.login.LoginContext$1.run(Unknown Source)
            at java.security.AccessController.doPrivileged(Native Method)
            at javax.security.auth.login.LoginContext.init(Unknown Source)
            at javax.security.auth.login.LoginContext.<init>(Unknown Source)
            at org.apache.catalina.realm.JAASRealm.authenticate(JAASRealm.java:393)
            at org.apache.catalina.realm.JAASRealm.authenticate(JAASRealm.java:334)
            at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:181)
            at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:528)
            at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
            at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
            at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
            at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
            at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
            at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
            at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
            at java.lang.Thread.run(Unknown Source)
Caused by: java.io.IOException: Configuration Error:
            No such file or directory
            at com.sun.security.auth.login.ConfigFile.init(Unknown Source)
            at com.sun.security.auth.login.ConfigFile.init(Unknown Source)
            ... 28 more
*****************

I guess I'm not configuring the realm properly (for instance, I'm not setting userClassNames and roleClassNames because I did not add additional classes), but I can't believe I should write a new realm from scratch. Can't I simply take the same realm that the IDP successfully uses, and put it in server.xml?

Thanks so much for your help,

Mauro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121001/ab00bc5c/attachment-0001.html