shibidp ECP extension configuration: REMOTE_USER not set

[Cantor, Scott]

On 10/1/12 1:03 PM, "Mauro Minella" <Mauro.Minella at microsoft.com> wrote:
>
> 
>I followed these steps:
> 
>1. I created a link between Java and login.config that I¹m successfully
>using for IDP passive authentication, so I modified
>%java_home%\lib\security\java.security
> as follows (line #88):

You shouldn't need to modify that file, I don't think.

>********************
>, I added the following code in
>$CATALINA_BASE/conf/server.xml withing the <Engine> node:
> 
><Realm className="org.apache.catalina.realm.JAASRealm"
>appName="ShibUserPassAuth"/>

I think when I used Tomcat years ago, that worked except that to identify
the login.config file, I used a Java system property using -D on the
Tomcat command line.

> 
>                <auth-constraint>
>                               <role-name>*</role-name>
>                </auth-constraint>

If you want "*" to work, I think there's an option you have to set in the
context descriptor. That stopped working by default some years back.

>I guess I¹m not configuring the realm properly (for instance, I¹m not
>setting userClassNames and roleClassNames because I did not add additional
> classes), but I can¹t believe I should write a new realm from scratch.
>Can¹t I simply take the same realm that the IDP successfully uses, and
>put it in server.xml?

If you mean JAAS config, yes, but if you're having Tomcat problems, I'd
try their list.

-- Scott