ECP extension needed for active clients

[Mauro Minella]

Hi Cantor,
you are very right, sorry for my misunderstanding:
- if I use passive authentication, SSO (not ECP) request is logged and the user is authenticated
- if I use ACTIVE authentication after changing/compiling web.xml as shown below and after restarting tomcat, Outlook keeps asking username/pwd over and over again. AND NO ADDITIONAL ROWS ARE GENERATED IN THE LOG FILE 

Please consider that I pointed the client to the right (I guess) endpoint (https://shibidp.eduteamit.com/idp/profile/SAML2/SOAP/ECP) several days ago, and I never changed it after that time.

Here is the added part of web.xml, which I built as described on https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP. It seems there is a little room for different configuration, maybe I should change something under tomcat?

<security-constraint>
  <display-name>Shibboleth IdP</display-name>
  <web-resource-collection>
       <web-resource-name>ECP</web-resource-name>
       <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
  </web-resource-collection>

  <auth-constraint>
    <role-name>*</role-name> 
  </auth-constraint>

  <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>

</security-constraint>

<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>ShibUserPassAuth</realm-name>
</login-config>

Thanks

Mauro


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: domenica 16 settembre 2012 19.29
To: Shib Users
Subject: Re: ECP extension needed for active clients

On 9/16/12 1:22 PM, "Mauro Minella" <Mauro.Minella at microsoft.com> wrote:

> 
>The strange thing, to me, is that after the re-deployment, the log file 
>reports
>19:02:37.436 - INFO [Shibboleth-Access:74] -
>20120916T170237Z|87.24.1.141|shibidp.eduteamit.com:443|/profile/SAML2/P
>20120916T170237Z|OST
>/SSO|
>Rather than
>
>18:56:20.874 - INFO [Shibboleth-Access:74] -
>20120916T165620Z|157.56.248.53|shibidp.eduteamit.com:443|/profile/SAML2
>20120916T165620Z|/SO
>AP/ECP|
>which I receive before my deployment.

That isn't why, you're not even doing ECP here. That's standard SSO via POST. It can't have changed because of anything you did for ECP since nothing even used it. Authentication for the POST binding would be handled however you handled it before.

Perhaps you pointed an ECP client at the wrong endpoint.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net