shibidp ECP extension configuration: REMOTE_USER not set

[Mauro Minella]

You probably didn't need to do that (create a new JAAS application in your config).  I didn't mean to take the VT LDAP example literally, it's just where they documented the user and role principal classes, etc.  I'd just use the same app name and config that is used for the Shib IdP (ShibUserPassAuth).  I think you already indicated that that was working as far as regular (non-ECP) authN goes, so no reason to add an additional thing to debug.

Actually the first thing I tried was to configure %java_home%\lib\security\java.security  to use the same login.config file that I successfully use for passive authentication. However, if I do that (or even if duplicate login.config and point to its exact copy) I get the following error in catalina log:
SEVERE: Unexpected error
java.lang.SecurityException: Configuration Error: Can not specify multiple entries for ShibUserPassAuth

I guess this error could be workarounded since it means that login.config is loaded twice, however before doing that I wanted to make sure that this is the right way to go.
So I duplicated it, renamed ShibUserPassAuth to ShibUserPassAuth2, updated server.xml and restarted Tomcat.

This time, the active authentication fails as before (Outlooks shows the dialog box with username/password over and over) and the same catalina.log traces the following error

oct 04, 2012 12:23:50 AM org.apache.catalina.realm.JAASRealm authenticate
WARNING: Login exception authenticating username "aldo.minella"
javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121003/c91a97c0/attachment.html