R: shibidp ECP extension configuration: REMOTE_USER not set

[Mauro Minella]

>>>>>>>>>
The problem is (I think) that there is no ACS URL with index 2 listed in Microsoft's Windows Azure AD metadata at
https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml

In their example they have the following entry:

<AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://login.microsoftonline.com/login.srf"<https://login.microsoftonline.com/login.srf> index="2" />
http://technet.microsoft.com/en-us/library/jj205463.aspx

Adding this in should fix the problem.
>>>>>>>>>


Unfortunately it did not work. To recap:

1. In order to put the vt-ldap jar in the Tomcat server classpath, I copied C:\Program Files (x86)\Internet2\Shib2IdPInstall\lib\vt-ldap-3.3.6.jar into C:\Program Files (x86)\Internet2\CaptiveTomcat 6.0\lib

2. I duplicated $IDP_BASE\conf\login.conf (working well in PASSIVE authentication) into C:\Program Files (x86)\Internet2\CaptiveTomcat 6.0\conf (which is C:\PROGRA~2\INTERN~2\CAPTIV~1.0\conf\login.config using 8.3 syntax) as follows:
*****************
ShibUserPassAuth2 {
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      host="SHIBIDP.SHIBDOMAIN.LOCAL"
      port="389"
      base="CN=Users,DC=shibdomain,DC=local"
      serviceCredential="eduteam1!"
      serviceUser="adreader at shibdomain.local"
      subtreeSearch = "true"
      userField="userPrincipalName";
};
*****************
Please note that I had to change ShibUserPassAuth to ShibUserPassAuth2 otherwise I get an error when Tomcat starts

3. In order to set the java.security.auth.login.config property to the location of my JAAS file above, I added the line
                 login.config.url.1=file:C:/PROGRA~2/INTERN~2/CAPTIV~1.0/conf/login.config
into %java_home%\lib\security\java.security.
Please note that this path is correct now, in fact ONLY if I change that name with a non-existing one, I get the following error when the active client tries to authenticate:
                 SEVERE: Unexpected error   java.lang.SecurityException: Configuration Error: No such file or directory

4. I added the realm declaration to the Tomcat server.xml file  $CATALINA_BASE/conf/server.xml  within the <Engine> node, replacing the existing section <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>:
<Realm className="org.apache.catalina.realm.JAASRealm"
             appName="ShibUserPassAuth2"
             userClassNames="edu.vt.middleware.ldap.jaas.LdapPrincipal"
             roleClassNames="edu.vt.middleware.ldap.jaas.LdapRole"/>



4. In order to use my LDAP roles, this is the part I added in  ShibIdpInstall\src\main\webapp\WEB-INF\web.xml before re-building the IDP configuration. I suppose this should bind the ECP path to the realm, shouldn't it:
*****************
<security-constraint>
                <display-name>Shibboleth IdP</display-name>
                <web-resource-collection>
                               <web-resource-name>ECP</web-resource-name>
                               <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
                               <http-method>GET</http-method>
                               <http-method>POST</http-method>
                </web-resource-collection>
                <auth-constraint>
                               <role-name>*</role-name>
                </auth-constraint>
                <user-data-constraint>
                               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
                </user-data-constraint>
</security-constraint>

<login-config>
                <auth-method>BASIC</auth-method>
                <realm-name>vt-ldap</realm-name>
</login-config>
*****************

5. Finally I ran INSTALL.BAT in C:\Program Files (x86)\Internet2\Shib2IdPInstall, restarted Apache Tomcat and tried to authenticate with Outlook 2010. This is the result in catalina.log (nothing is traced in idp-process.log):
ott 17, 2012 2:07:06 AM org.apache.catalina.realm.JAASRealm authenticate
WARNING: Login exception authenticating username "andrea.neri"
javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn
                at edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:138)
                at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
                at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
                at java.lang.reflect.Method.invoke(Unknown Source)
                at javax.security.auth.login.LoginContext.invoke(Unknown Source)
                at javax.security.auth.login.LoginContext.access$000(Unknown Source)
                at javax.security.auth.login.LoginContext$4.run(Unknown Source)
                at javax.security.auth.login.LoginContext$4.run(Unknown Source)
                at java.security.AccessController.doPrivileged(Native Method)
                at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
                at javax.security.auth.login.LoginContext.login(Unknown Source)
                at org.apache.catalina.realm.JAASRealm.authenticate(JAASRealm.java:409)
                at org.apache.catalina.realm.JAASRealm.authenticate(JAASRealm.java:334)
                at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:181)
                at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:528)
                at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
                at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
                at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
                at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
                at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
                at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
                at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
                at java.lang.Thread.run(Unknown Source)

as said, the same user can use passive (WEB) authentication

Thanks for continue support

Mauro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121017/a2102160/attachment-0001.html