ECP extension needed for active clients

Sun Sep 16 13:22:16 EDT 2012

Thanks Nate: I could move another step on.

But I'm stopped again, and this time it looks harder to understand the issue from the idp analisys. Because the log does not contain any error.

In fact, Outlook keeps asking the user (sara.white at shibdomain.eduteamit.com) to enter her password (abc123ABC), while if I use OWA (https://outlook.com/shibdomain.eduteamit.com,  Outlook WEB Access, i.e. PASSIVE auth) it works.

The strange thing is that before re-deploying the application, I got the following error:
18:56:20.874 - INFO [Shibboleth-Access:74] - 20120916T165620Z|157.56.248.53|shibidp.eduteamit.com:443|/profile/SAML2/SOAP/ECP|
18:56:21.109 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SAML2ECPProfileHandler:408] - REMOTE_USER not set, unable to set principal name
18:56:21.140 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429] - No return endpoint available for relying party urn:federation:MicrosoftOnline

While now I get this one (which is not an error of course):
19:02:37.436 - INFO [Shibboleth-Access:74] - 20120916T170237Z|87.24.1.141|shibidp.eduteamit.com:443|/profile/SAML2/POST/SSO|
19:02:47.643 - INFO [Shibboleth-Access:74] - 20120916T170247Z|87.24.1.141|shibidp.eduteamit.com:443|/profile/SAML2/POST/SSO|
19:02:47.815 - INFO [Shibboleth-Audit:970] - 20120916T170247Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_77389858-920b-41c3-b318-550bcdb34a75|urn:federation:MicrosoftOnline|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibidp.eduteamit.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_d32500a0da2f8164cc9f18a5b8d1e783|sara.white@shibdomain.eduteamit.com|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|transientId,eduPersonScopedAffiliation,UserId,eduPersonTargetedID.old,ImmutableID,eduPersonTargetedID,|PxDWmpYbEk2IyCrs+7r8pw==|_2a376f76f375aec078bbd8864851977c,|

Looking at the last log line, it contains the pieces of information that my relying party expects (upn [sara.white at shibdomain.eduteamit.com] + immutableID [PxDWmpYbEk2IyCrs+7r8pw==]). BTW: the immutableID should have the string "@shibdomain.eduteamit.com" appended after second "=", however the passive authentication does work, so this shouldn't be the problem.

The strange thing, to me, is that after the re-deployment, the log file reports
19:02:37.436 - INFO [Shibboleth-Access:74] - 20120916T170237Z|87.24.1.141|shibidp.eduteamit.com:443|/profile/SAML2/POST/SSO|
Rather than
18:56:20.874 - INFO [Shibboleth-Access:74] - 20120916T165620Z|157.56.248.53|shibidp.eduteamit.com:443|/profile/SAML2/SOAP/ECP|
which I receive before my deployment.

Thank you for sharing any other idea, as always

Mauro

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: domenica 16 settembre 2012 18.16
To: Shib Users
Subject: Re: ECP extension needed for active clients

Mauro,

I read your link carefully, which suggested to copy and edit web.xml from src/main/webapp/WEB-INF/web.xml into /opt/shibboleth-idp/conf/web.xml (which in my case is C:\Program Files (x86)\Internet2\Shib2IdP\conf, right?), however I keep getting the same error message:

This won't work.  web.xml is a file that is built into the .war file itself, which is created when Shibboleth is installed.  It will not be read from /opt/shibboleth-idp/conf/ (or C:\Program Files (x86)\Internet2\Shib2IdP\conf), as you guessed.

You'll need to modify the copy in the distribution that you downloaded (e.g. /opt/shibboleth-identityprovider-2.3.8/src/main/webapp/WEB-INF/web.xml, translated into Windows) and then rebuild and redeploy the .war file by running the installation script(install.bat) again.

Be careful to choose the option to not overwrite your configuration files.  You might want to back up the /opt/shibboleth-idp/ directory just to be safe.

Then, restart your servlet container.

Also: should I un-comment <ph:LoginHandler xsi:type="ph:RemoteUser"> section in handler.xml? I didn't do it because I'm expected to protect my path via web.xml.

I believe you don't need to.  Those LoginHandlers are used by the web browser protocol flows.

Finally: as suggested on https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP I added the following excerpt to the web.xml (keeping all the rest of the file), however I'm wondering if <url-pattern> should contain "/profile/SMAL2/SOA/ECP" despite my relying party looks for "/profile/SMAL2/SOA/ECP".

I can't quite figure out what you're asking here, I'm afraid.

Take care,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120916/6a23071f/attachment-0001.html 