shibidp ECP extension configuration: REMOTE_USER not set

[Mauro Minella]

>>>> the Shib LoginHandler isn't running in this case for container managed authN.  You can try just leaving this out until you get your JAAS config file issue sorted out.  Should it turn out that you do need to add the user principal class names, it's going to be the one populated by the VT LDAP JAAS module, and fortunately looks like they have an actual Tomcat Realm example already http://code.google.com/p/vt-middleware/wiki/vtldapJAAS#Tomcat_Realm

Thanks so much Brent, I'm getting closer (I hope) following your reading, but I'm still in trouble. To recap the latest scenario:

1. In order to put the vt-ldap jar in the Tomcat server classpath, I copied C:\Program Files (x86)\Internet2\Shib2IdPInstall\lib\vt-ldap-3.3.6.jar into C:\Program Files (x86)\Internet2\CaptiveTomcat 6.0\lib

2. I defined a NEW JAAS configuration file C:\Program Files (x86)\Internet2\CaptiveTomcat 6.0\conf (which is C:\PROGRA~2\INTERN~2\CAPTIV~1.0\conf\login.config using 8.3 syntax) as follows:
*****************
vt-ldap {
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
     ldapUrl="ldap://SHIBDOMAIN.LOCAL:389"
     baseDN="CN=Users,DC=shibdomain,DC=local"
     tls="true"
     serviceCredential="abc123ABC"
     serviceUser="adreader at shibdomain.local"
     subtreeSearch = "true"
     userField="userPrincipalName";
};
*****************

3. In order to set the java.security.auth.login.config property to the location of my JAAS file above, I added the line
                 login.config.url.1=file:C:/PROGRA~2/INTERN~2/CAPTIV~1.0/conf/login.config
into %java_home%\lib\security\java.security.
Please note that this path is correct now, in fact ONLY if I change that name with a non-existing one, I get the following error when the active client tries to authenticate:
                 SEVERE: Unexpected error   java.lang.SecurityException: Configuration Error: No such file or directory

4. I added the realm declaration to the Tomcat server.xml file  $CATALINA_BASE/conf/server.xml  within the <Engine> node:
<Realm className="org.apache.catalina.realm.JAASRealm"
             appName="vt-ldap"
             userClassNames="edu.vt.middleware.ldap.jaas.LdapPrincipal"
             roleClassNames="edu.vt.middleware.ldap.jaas.LdapRole"/>



4. In order to use my LDAP roles, this is the part I added in  ShibIdpInstall\src\main\webapp\WEB-INF\web.xml before re-building the IDP configuration. I suppose this should bind the ECP path to the realm, shouldn't it:
*****************
<security-constraint>
                <display-name>Shibboleth IdP</display-name>
                <web-resource-collection>
                               <web-resource-name>ECP</web-resource-name>
                               <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
                               <http-method>GET</http-method>
                               <http-method>POST</http-method>
                </web-resource-collection>
                <auth-constraint>
                               <role-name>*</role-name>
                </auth-constraint>
                <user-data-constraint>
                               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
                </user-data-constraint>
</security-constraint>

<login-config>
                <auth-method>BASIC</auth-method>
                <realm-name>vt-ldap</realm-name>
</login-config>
*****************

5. I restarted Tomcat and tried authenticating with my active client (Outlook 2010): as a result, the following error is tracked in BOTH CATALINA AND IDP LOG FILES:
*****************
WARNING: Login exception authenticating username "aldo.minella"
javax.security.auth.login.LoginException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031001E5, problem 2001 (NO_OBJECT), data 0, best match of:
                ''
NUL]
at edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:167)
                at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
                at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
                at java.lang.reflect.Method.invoke(Unknown Source)
                at javax.security.auth.login.LoginContext.invoke(Unknown Source)
                at javax.security.auth.login.LoginContext.access$000(Unknown Source)
                at javax.security.auth.login.LoginContext$4.run(Unknown Source)
                at javax.security.auth.login.LoginContext$4.run(Unknown Source)
                at java.security.AccessController.doPrivileged(Native Method)
                at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
                at javax.security.auth.login.LoginContext.login(Unknown Source)
                at org.apache.catalina.realm.JAASRealm.authenticate(JAASRealm.java:409)
                at org.apache.catalina.realm.JAASRealm.authenticate(JAASRealm.java:334)
                at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:181)
                at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:528)
                at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
                at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
                at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
                at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
                at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
                at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
                at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
                at java.lang.Thread.run(Unknown Source)

*****************


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: martedì 2 ottobre 2012 03.25
To: users at shibboleth.net
Subject: Re: shibidp ECP extension configuration: REMOTE_USER not set


On 10/1/12 9:16 PM, Brent Putman wrote:


I believe you may also need to tell it the class that should be used for the user principal.  Perhaps if you don't it just defaults to the first (and probably only) one present, but you can add it for good measure.  The Shib UsernamePassword LoginHandler populates that with principal: edu.internet2.middleware.shibboleth.idp.authn.UsernamePrincipal.  You do that via the 'userClassNames' attribute on the realm.

Sorry, that's not right.  I forgot, the Shib LoginHandler isn't running in this case for container managed authN.  You can try just leaving this out until you get your JAAS config file issue sorted out.  Should it turn out that you do need to add the user principal class names, it's going to be the one populated by the VT LDAP JAAS module, and fortunately looks like they have an actual Tomcat Realm example already:


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121002/3c68420e/attachment-0001.html