shibidp ECP extension configuration: REMOTE_USER not set

[Brent Putman]

On 10/2/12 6:45 PM, Mauro Minella wrote:
>
>  
>
> 2. I defined a NEW JAAS configuration file C:\Program Files
> (x86)\Internet2\CaptiveTomcat 6.0\conf (which is
> C:\PROGRA~2\INTERN~2\CAPTIV~1.0\conf\login.config using 8.3 syntax) as
> follows:
>
> *****************
>
> vt-ldap {
>

You probably didn't need to do that (create a new JAAS application in
your config).  I didn't mean to take the VT LDAP example literally, it's
just where they documented the user and role principal classes, etc. 
I'd just use the same app name and config that is used for the Shib IdP
(ShibUserPassAuth).  I think you already indicated that that was working
as far as regular (non-ECP) authN goes, so no reason to add an
additional thing to debug.


>  
>
> 3. In order to set the java.security.auth.login.config property to the
> location of my JAAS file above, I added the line
>
>                  login.config.url.1=file:C:/PROGRA~2/INTERN~2/CAPTIV~1.0/conf/login.config
>
> into %java_home%\lib\security\java.security.
>
> Please note that this path is correct now, in fact ONLY if I change
> that name with a non-existing one, I get the following error when the
> active client tries to authenticate:
>
>                  SEVERE: Unexpected error  
> java.lang.SecurityException: Configuration Error: No such file or
> directory
>

Ok, sounds like the Windows path with spaces was a problem there.


>  
>
>  
>
>  
>
> 5. I restarted Tomcat and tried authenticating with my active client
> (Outlook 2010): as a result, the following error is tracked in BOTH
> CATALINA AND IDP LOG FILES:
>
> *****************
>
> WARNING: Login exception authenticating username "aldo.minella"
>
> javax.security.auth.login.LoginException: [LDAP: error code 32 -
> 0000208D: NameErr: DSID-031001E5, problem 2001 (NO_OBJECT), data 0,
> best match of:
>
>                 ''
>
> NUL]
>

Yeah, that's an actual LDAP  error coming from the JAAS module, so
sounds like things are almost working, since it's successfully invoking
the module in the Tomcat JAASRealm.  You can google around for error
code 32 with respect to AD, but I suspect that if you revert to the
ShibUserPassAuth app name and config, that ought to resolve (assuming
that was working before).  I note that the ShibUserPassAuth config you
originally posted is slightly different than the vt-ldap config here.




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121003/8edcf867/attachment.html