ECP extension needed for active clients

[Nate Klingenstein]

Mauro,

> I read your link carefully, which suggested to copy and edit web.xml  
> from src/main/webapp/WEB-INF/web.xml into /opt/shibboleth-idp/conf/ 
> web.xml (which in my case is C:\Program Files  
> (x86)\Internet2\Shib2IdP\conf, right?), however I keep getting the  
> same error message:

This won't work.  web.xml is a file that is built into the .war file  
itself, which is created when Shibboleth is installed.  It will not be  
read from /opt/shibboleth-idp/conf/ (or C:\Program Files  
(x86)\Internet2\Shib2IdP\conf), as you guessed.

You'll need to modify the copy in the distribution that you downloaded  
(e.g. /opt/shibboleth-identityprovider-2.3.8/src/main/webapp/WEB-INF/ 
web.xml, translated into Windows) and then rebuild and redeploy  
the .war file by running the installation script(install.bat) again.

Be careful to choose the option to not overwrite your configuration  
files.  You might want to back up the /opt/shibboleth-idp/ directory  
just to be safe.

Then, restart your servlet container.

> Also: should I un-comment <ph:LoginHandler xsi:type="ph:RemoteUser">  
> section in handler.xml? I didn’t do it because I’m expected to  
> protect my path via web.xml.

I believe you don't need to.  Those LoginHandlers are used by the web  
browser protocol flows.

> Finally: as suggested on https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP 
>  I added the following excerpt to the web.xml (keeping all the rest  
> of the file), however I’m wondering if <url-pattern> should contain  
> "/profile/SMAL2/SOA/ECP" despite my relying party looks for "/ 
> profile/SMAL2/SOA/ECP".

I can't quite figure out what you're asking here, I'm afraid.

Take care,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120916/38e3e0f6/attachment.html