shibidp ECP extension configuration: REMOTE_USER not set

[Mauro Minella]

Hi all,
I submitted this question in a previous request, but since it was quite long and a little confused, I try opening a new thread.

I federated my ShibIdp 2.3.8 with Office365 as described in this guide: http://technet.microsoft.com/en-us/library/jj205463.aspx.

When I set up the federation, I specified the following values (please note that shibidp.eduteamit.com does contain a valid SSL certificate from GoDaddy):
    $domainName = "shibdomain.eduteamit.com"
    $passiveLogOnUri = "https://shibidp.eduteamit.com/idp/profile/SAML2/POST/SSO"
    $activeLogOnUri = "https://shibidp.eduteamit.com/idp/profile/SAML2/SOAP/ECP"
    $issuerUri = "https://shibidp.eduteamit.com/idp/shibboleth"
    $logOffUrl = "https://shibidp.eduteamit.com/idp/logout"
    $tokenSigningCertificate = "MIIDQDCCAiigAwIBA...=


If I go to TestShib Service Provider (https://sp.testshib.org/) and I enter https://shibidp.eduteamit.com/idp/shibboleth (which is the entityID of your IdP), everything seems working when I put a upn+password:
********************
Here are some pieces of information I can tell about you using the information Shibboleth gives me:
referer is: https://shibidp.eduteamit.com/idp/profile/SAML2/Redirect/SSO
DNT is: 1
Cache-Control is: no-cache
Shib-Session-ID is: _60887633f1e9cd15fea359f661b4c99c
Shib-Session-Index is: df51d97736053aa66153062a9affb84bda610cd91d211709a32159d4241c91e8
Shib-Identity-Provider is: https://shibidp.eduteamit.com/idp/shibboleth
Shib-Authentication-Method is: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Shib-Authentication-Instant is: 2012-09-28T23:09:02.037Z
Shib-AuthnContext-Class is: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
persistent-id is: https://shibidp.eduteamit.com/idp/shibboleth!https://sp.testshib.org/shibboleth-sp!TCu0M2sm2tRa06I+AzsNNzN2bj8=
Shib-Application-ID is: default
REMOTE_USER is: https://shibidp.eduteamit.com/idp/shibboleth!https://sp.testshib.org/shibboleth-sp!TCu0M2sm2tRa06I+AzsNNzN2bj8=
********************
Please note the last line, saying that REMOTE_USER does contain some pieces of information.


Then, since I need ECP extension for my Outlook 2010 (which is an ACTIVE CLIENT), I followed the guide on https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP to build the excerpt below, which I put just before </web-app> in C:\Program Files (x86)\Internet2\Shib2IdPInstall\src\main\webapp\WEB-INF\web.xml.

********************
<security-constraint>
                <display-name>Shibboleth IdP</display-name>
                <web-resource-collection>
                               <web-resource-name>ECP</web-resource-name>
                               <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
                               <http-method>GET</http-method>
                               <http-method>POST</http-method>
                </web-resource-collection>
                <auth-constraint>
                               <role-name>*</role-name>
                </auth-constraint>
                <user-data-constraint>
                               <transport-guarantee>CONFIDENTIAL</transport-guarantee>
                </user-data-constraint>
</security-constraint>

<login-config>
                <auth-method>BASIC</auth-method>
                <realm-name>ShibUserPassAuth</realm-name>
</login-config>
********************

Then I saved web.xml, opened a command prompt, navigated to C:\Program Files (x86)\Internet2\Shib2IdPInstall and ran INSTALL.
I then stopped/restarted apache tomcat, and finally ran the wizard on Outlook 2010, in order to configure the Office365 user (the same user who successfully connected through the WEB interface, which is a passive client).

However, when I try to connect/configure Offe365 from Outlook, I catch the following error in my idp log:

------------------------------------
01:08:44.081 - INFO [Shibboleth-Access:74] - 20120915T230844Z|157.56.252.5|shibidp.eduteamit.com:443|/profile/SAML2/SOAP/ECP|
01:08:44.394 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SAML2ECPProfileHandler:408] - REMOTE_USER not set, unable to set principal name
01:08:44.394 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429] - No return endpoint available for relying party urn:federation:MicrosoftOnline
------------------------------------

Can you please:

-          Help me understanding if the  excerpt above, which I wrote in C:\Program Files (x86)\Internet2\Shib2IdPInstall\src\main\webapp\WEB-INF\web.xml, is correct with regards to values I used for federation ($passiveLogOnUri, $activeLogOnUri, ...) described at the beginning of this message?

-          Why am I said "REMOTE_USER not set, unable to set principal name" when I use ECP, while log file generated by https://shibidp.eduteamit.com as I showed you above says "REMOTE_USER is: https://shibidp.eduteamit.com/idp/shibboleth!https://sp.testshib.org/shibboleth-sp!TCu0M2sm2tRa06I+AzsNNzN2bj8="

-          What should I do to make that ECP is properly used? What 's the best way to monitor such issues?

Thanks in advance

Mauro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120928/d6cd3469/attachment-0001.html