shibidp ECP extension configuration: REMOTE_USER not set

[Joost van Dijk]

On Oct 17, 2012, at 2:24 AM, Mauro Minella <Mauro.Minella at microsoft.com> wrote:

> >>>>>>>>> 
> The problem is (I think) that there is no ACS URL with index 2 listed in Microsoft's Windows Azure AD metadata at
> https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml
> 
> In their example they have the following entry:
> <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://login.microsoftonline.com/login.srf" index="2" />
> http://technet.microsoft.com/en-us/library/jj205463.aspx
> 
> Adding this in should fix the problem.
> >>>>>>>>> 
>  
>  
> Unfortunately it did not work. To recap:
>  
> 


<recap deleted)

Hi Mauro,

I am sorry if I have confused you, but the metadata issue was causing the
No return endpoint available for relying party urn:federation:MicrosoftOnline
log message, not the 
javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn
message.

The first can be resolved by using static metadata (as described by Ryan), the second is an issue with your container's (Tomcat) "Remote User" authentication.
If this issue keeps haunting you - is it an option to use a different container? Do you use Apache Web Server as a front end? Apache could take care of the remote user authentication as well.

Cheers,
--
Joost
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121017/127aa5ab/attachment.html