shibidp ECP extension configuration: REMOTE_USER not set

[Mauro Minella]

Thanks Cantor but if I well understand from your comments, it's not sure that I should create a new JAAS realm in order to implement ECP on my ShibIDP, should I?

In fact, if I can avoid studying tens of pages and implementing a Java application for this purpose, I'm happy to skip it. It's really a big thing and it's out of my business right now.

So can someone help me understanding which steps/guide I should follow now, starting from  ShibIDP 2.3.8 (latest Windows version) fully working in passive mode, in order to make it able to support the active clients through ECP?

Thanks a lot

Mauro

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: lunedì 1 ottobre 2012 19.57
To: Shib Users
Subject: Re: shibidp ECP extension configuration: REMOTE_USER not set

On 10/1/12 1:03 PM, "Mauro Minella" <Mauro.Minella at microsoft.com> wrote:
>
> 
>I followed these steps:
> 
>1. I created a link between Java and login.config that I¹m successfully 
>using for IDP passive authentication, so I modified 
>%java_home%\lib\security\java.security
> as follows (line #88):

You shouldn't need to modify that file, I don't think.

>********************
>, I added the following code in
>$CATALINA_BASE/conf/server.xml withing the <Engine> node:
> 
><Realm className="org.apache.catalina.realm.JAASRealm"
>appName="ShibUserPassAuth"/>

I think when I used Tomcat years ago, that worked except that to identify the login.config file, I used a Java system property using -D on the Tomcat command line.

> 
>                <auth-constraint>
>                               <role-name>*</role-name>
>                </auth-constraint>

If you want "*" to work, I think there's an option you have to set in the context descriptor. That stopped working by default some years back.

>I guess I¹m not configuring the realm properly (for instance, I¹m not 
>setting userClassNames and roleClassNames because I did not add 
>additional  classes), but I can¹t believe I should write a new realm from scratch.
>Can¹t I simply take the same realm that the IDP successfully uses, and 
>put it in server.xml?

If you mean JAAS config, yes, but if you're having Tomcat problems, I'd try their list.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net