shibidp ECP extension configuration: REMOTE_USER not set

[Joost van Dijk]

Hi Mauro,

Not sure if you already resolved your issues, but I believe that the message in your log file:

No return endpoint available for relying party urn:federation:MicrosoftOnline

has nothing to do with your setup but is related to an issue with Office 365.
When a user connects to Microsoft's IMAP server, for example, he/she sends a username and password for authentication that is subsequently relayed to the user's IdP using the SAML ECP profile. That is, a SOAP request is sent from Microsoft's servers to your IdP's ECP endpoint (using HTTP Basic authentication), e.g.

<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
  <S:Body>
    <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_73ffcfca-e08e-4a4c-88f5-2b8022c61bf2" IssueInstant="2012-10-11T12:06:28.0084232Z" Version="2.0" AssertionConsumerServiceIndex="2">
      <saml:Issuer>urn:federation:MicrosoftOnline</saml:Issuer>
    </samlp:AuthnRequest>
  </S:Body>
</S:Envelope>

The problem is (I think) that there is no ACS URL with index 2 listed in Microsoft's Windows Azure AD metadata at
https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml

So when such a request is posted to your IDP, it has no idea what endpoint to return an authentication response to:

$ curl --data @request.xml -H 'Content-type: application/soap+xml;charset=UTF-8' -u myusername:mypassword http://idp.example.org/idp/profile/SAML2/SOAP/ECP
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"> <env:Body> <env:Fault> <faultcode>env:Client</faultcode> <faultstring>An error occurred processing the request.</faultstring> <detail/> </env:Fault> </env:Body></env:Envelope>

Hence the log entry in your dip-process.log:

13:20:02.459 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429] - No return endpoint available for relying party urn:federation:MicrosoftOnline

I'm not very familiar with Shibboleth, so maybe someone more knowledgeable on this list may be able to confirm if this makes sense…

Cheers,
--
Joost van Dijk
SURFnet



On Oct 5, 2012, at 10:43 AM, Mauro Minella <Mauro.Minella at microsoft.com> wrote:

> Before anyone replies, I can add an important piece to my last note: if I try authenticating with a NON-EXISTING user (john.smithXYZ at shibdomain.eduteamit.com), I get the same error
> WARNING: Login exception authenticating username "john.smithXYZ"
> javax.security.auth.login.LoginException: Found more than (1) DN for: john.smithXYZ
> at edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:167)
>  
> so this means that it’s NOT just a mis-configuration in login.config, and brings me back to the JAAS configuration file as I replied to Brent:
>  
> You probably didn't need to do that (create a new JAAS application in your config).  I didn't mean to take the VT LDAP example literally, it's just where they documented the user and role principal classes, etc.  I'd just use the same app name and config that is used for the Shib IdP (ShibUserPassAuth).  I think you already indicated that that was working as far as regular (non-ECP) authN goes, so no reason to add an additional thing to debug.
> 
> Actually the first thing I tried was to configure %java_home%\lib\security\java.security  to use the same login.config file that I successfully use for passive authentication. However, if I do that (or even if duplicate login.config and point to its exact copy) I get the following error in catalina log:
> SEVERE: Unexpected error
> java.lang.SecurityException: Configuration Error: Can not specify multiple entries for ShibUserPassAuth
>  
> I guess this error could be workarounded since it means that login.config is loaded twice, however before doing that I wanted to make sure that this is the right way to go.
> So I duplicated it, renamed ShibUserPassAuth to ShibUserPassAuth2, updated server.xml and restarted Tomcat.
>  
> This time, the active authentication fails as before (Outlooks shows the dialog box with username/password over and over) and the same catalina.log traces the following error
>  
> oct 04, 2012 12:23:50 AM org.apache.catalina.realm.JAASRealm authenticate
> WARNING: Login exception authenticating username "aldo.minella"
> javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121011/dc822b4f/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4301 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20121011/dc822b4f/attachment-0001.bin