shibidp ECP extension configuration: REMOTE_USER not set

[Brent Putman]

On 10/1/12 1:03 PM, Mauro Minella wrote:
>
> Thanks Brent,
>
> I did one step forward, but I'm still stuck.
>
>  
>
> Starting from your suggestion
>
> -->you need to configure a Tomcat Realm to protect the ECP profile
> handler endpoint (...) and you can reuse the JAAS configuration you
> may have configured for the UsernamePassword LoginHandler, but you do
> need to declare the Realm separately in Tomcat
>
>  
>
> I followed these steps:
>
>  
>
> 1. I created a link between Java and login.config that I'm
> successfully using for IDP passive authentication, so I modified
> %java_home%\lib\security\java.security as follows (line #88):
>
> --> login.config.url.1=file:C:\Program Files
> (x86)\Internet2\Shib2IdP/conf/login.config
>



As Scott said, it's probably easier to just do this via a system
property to the JVM ( java.security.auth.login.config), but adding that
java.security property is equivalent, I believe.




>  
>
> <Realm className="org.apache.catalina.realm.JAASRealm"
> appName="ShibUserPassAuth"/>
>


I believe you may also need to tell it the class that should be used for
the user principal.  Perhaps if you don't it just defaults to the first
(and probably only) one present, but you can add it for good measure. 
The Shib UsernamePassword LoginHandler populates that with principal:
edu.internet2.middleware.shibboleth.idp.authn.UsernamePrincipal.  You do
that via the 'userClassNames' attribute on the realm.


>  
>
>  
>
>
> *****************
>
> ott 01, 2012 6:24:06 PM org.apache.catalina.realm.JAASRealm authenticate
>
> SEVERE: Unexpected error
>
> java.lang.SecurityException: Configuration Error:
>
>             No such file or directory
>
>             at com.sun.security.auth.login.ConfigFile.<init>(Unknown
> Source)
>
>  
>


Well, that error is pretty clear.  Whatever you've attempted to
configure as the JAAS config file (as you said, in java.security via
login.config.url.1) is not there, or is not readable by the process, or
something similar.  Perhaps it doesn't like the space in the path. Also,
double-check the valid file: URL syntax in Java for a Windows path.  I'm
not a Windows guy, but I know that the required file URL format on
Windows often trips people up.




> *****************
>
>  
>
> I guess I'm not configuring the realm properly (for instance, I'm not
> setting userClassNames and roleClassNames because I did not add
> additional classes),
>

No, that error has nothing to do with Tomcat, etc, it's clearly a JVM
level error from the JAAS framework.




> but I can't believe I should write a new realm from scratch. Can't I
> simply take the same realm that the IDP successfully uses, and put it
> in server.xml?
>


You are confusing terminology there (JAAS module vs Tomcat realm), but
either way, no, you don't need to write any Java code to make this
work.  What you have is a simple misconfiguration at this point, it's
not successfully reading the JAAS config file.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121001/0584d921/attachment.html