shibidp ECP extension configuration: REMOTE_USER not set

[Brent Putman]

On 9/28/12 7:35 PM, Mauro Minella wrote:**
>
> REMOTE_USER is:
> *https://shibidp.eduteamit.com/idp/shibboleth!https://sp.testshib.org/shibboleth-sp!TCu0M2sm2tRa06I+AzsNNzN2bj8=*
>
> ********************
>
> Please note the last line, saying that REMOTE_USER does contain some
> pieces of information.
>
>  
>

That's just because the TestShib SP is configured to populate
REMOTE_USER with another attribute.  This has nothing to do with you
getting ECP working on the IdP side.


>  
>
> Then, since I need ECP extension for my Outlook 2010 (which is an
> ACTIVE CLIENT), I followed the guide on
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP to
> build the excerpt below,
>

As that wiki page tries to make clear, the main task in configuring
authentication for ECP is to configure your web server or container with
an authentication mechanism.  It does *not* use the authentication
framework used by other profile handlers in the IdP (i.e. the
LoginHandlers).

So updating the IdP web.xml is necessary, but not sufficient.  Since you
mentioned using the Tomcat servlet container, and assuming you don't
have Apache or another web server in front of it, you need to configure
a Tomcat Realm to protect the ECP profile handler endpoint.

http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html

Since I believe you said you were using Active Directory as an LDAP
authN source, you can use either the JNDIRealm or the JAASRealm with an
LDAP JAAS module.  For the latter I believe you can reuse the JAAS
configuration you may have configured for the UsernamePassword
LoginHandler, but you do need to declare the Realm separately in
Tomcat.  Tomcat's config is not related to the IdP's configuration in
any way.


>
> 01:08:44.394 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SAML2ECPProfileHandler:408]
> - REMOTE_USER not set, unable to set principal name
>


This most certainly means you have not successfully protected the
endpoint "/idp/profile/SAML2/SOAP/ECP" with some kind of web server or
container authentication mechanism that populates REMOTE_USER.



> -          Help me understanding if the  excerpt above, which I wrote
> in C:\Program Files
> (x86)\Internet2\Shib2IdPInstall\src\main\webapp\WEB-INF\web.xml, is
> correct with regards to values I used for federation
> ($passiveLogOnUri, $activeLogOnUri, ...) described at the beginning of
> this message?
>


It may or may not be correct, depending on what web server or container
authentication mechanism you use.  But the important thing is that it is
not sufficient, you need to configure your web server or container.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120928/75ba5a6f/attachment.html