ECP extension needed for active clients

[Mauro Minella]

Thanks Nate,
I read your link carefully, which suggested to copy and edit web.xml from src/main/webapp/WEB-INF/web.xml into /opt/shibboleth-idp/conf/web.xml (which in my case is C:\Program Files (x86)\Internet2\Shib2IdP\conf, right?), however I keep getting the same error message:

REMOTE_USER not set, unable to set principal name.

In my opinion the web.xml file that I modified is not even read or I should put it in another folder, is it? I tried to change it even wrongly and nothing seems different.

Also: should I un-comment <ph:LoginHandler xsi:type="ph:RemoteUser"> section in handler.xml? I didn't do it because I'm expected to protect my path via web.xml.

Finally: as suggested on https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP I added the following excerpt to the web.xml (keeping all the rest of the file), however I'm wondering if <url-pattern> should contain "/profile/SMAL2/SOA/ECP" despite my relying party looks for "/profile/SMAL2/SOA/ECP".

<security-constraint>
                <display-name>Shibboleth IdP</display-name>
                <web-resource-collection>
                               <web-resource-name>ECP</web-resource-name>
                               <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
                               <http-method>GET</http-method>
                               <http-method>POST</http-method>
                </web-resource-collection>
                <auth-constraint>
                               <role-name>*</role-name>
                </auth-constraint>
                <user-data-constraint>
                               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
                </user-data-constraint>
</security-constraint>

<login-config>
                <auth-method>BASIC</auth-method>
                <realm-name>ShibUserPassAuth</realm-name>
</login-config>





Thank you for any help

Mauro

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: domenica 16 settembre 2012 01.46
To: Shib Users
Subject: Re: ECP extension needed for active clients

Mauro,

You'll need to enable some form of authentication that ECP can use.  Typically, that will be basic auth, but you just need something that can set REMOTE_USER.

Please refer to the following documentation and let us know if you have any problems:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP

Take care,
Nate.

On Sep 15, 2012, at 23:19 , Mauro Minella wrote:


Hi,

I federated my ShibIdp 2.3.5 with Office365.
Right now the passive logon does work, using the users' upn.

However I need the ECP extension at work in order to connect active clients (like Outlook).
I read that ECP extension is included since 2.3.3 and in fact it seems it's in my version yet.
However, when I try to connect from the active client, I catch the following error in my idp log:
01:08:44.081 - INFO [Shibboleth-Access:74] - 20120915T230844Z|157.56.252.5|shibidp.eduteamit.com:443|/profile/SAML2/SOAP/ECP|
01:08:44.394 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SAML2ECPProfileHandler:408] - REMOTE_USER not set, unable to set principal name
01:08:44.394 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429] - No return endpoint available for relying party urn:federation:MicrosoftOnline

When I set up the federation, I specified the following values:
    $domainName = "shibdomain.eduteamit.com"
    $passiveLogOnUri = "https://shibidp.eduteamit.com/idp/profile/SAML2/POST/SSO"
    $activeLogOnUri = "https://shibidp.eduteamit.com/idp/profile/SAML2/SOAP/ECP"
    $issuerUri = "https://shibidp.eduteamit.com/idp/shibboleth"
    $logOffUrl = "https://shibidp.eduteamit.com/idp/logout"
    $tokenSigningCertificate = "MIIDQDCCAiigAwIBA...=


Where should I look at now, in order to fix this issue?

Thank you,

Mauro
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120916/0dfe6337/attachment-0001.html