ECP authentication failure

[Jones, David A]

I also thought I would add that handler.xml has this profile handler
<ph:ProfileHandler xsi:type="ph:SAML2ECP" inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
                       outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
        <ph:RequestPath>/SAML2/SOAP/ECP</ph:RequestPath>
    </ph:ProfileHandler>

But the idp-process.log shows the that no profile handler is registered for /saml2/soap/ecp

09:06:35.572 - INFO [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:271] - Next refresh cycle for metadata provider 'https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml' will occur on '2013-08-01T16:06:35.198Z' ('2013-08-01T12:06:35.198-04:00' local time)
09:06:36.898 - INFO [Shibboleth-Access:74] - 20130801T130636Z|156.12.2.28|idp.kutztown.edu:80|/profile/saml2/soap/ecp|
09:06:36.914 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86] - shibboleth.HandlerManager: Looking up profile handler for request path: /saml2/soap/ecp
09:06:36.914 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:100] - shibboleth.HandlerManager: No profile handler registered for request path /saml2/soap/ecp
09:06:36.914 - WARN [edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet:92] - No profile handler configured for request at path: /saml2/soap/ecp

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Jones, David A
Sent: Thursday, August 01, 2013 3:25 PM
To: users at shibboleth.net
Subject: ECP authentication failure

Working on setting up ECP.  In testing, I am trying to connect through Outlook, but it continues to prompt me for credentials.  I get the same behavior when I go directly to https://servername/idp/profile/SAML2/SOAP/ECP through a URL.   It appears the authentication component is not working for me.

The tomcat and catalina logs look like this:
FINE:  Failed authenticate() test
Aug 01, 2013 1:15:05 PM org.apache.catalina.authenticator.AuthenticatorBase invoke
FINE: Security checking request GET /idp/profile/SAML2/SOAP/ECP
Aug 01, 2013 1:15:05 PM org.apache.catalina.realm.RealmBase findSecurityConstraints
FINE:   Checking constraint 'SecurityConstraint[user authentication]' against GET /profile/SAML2/SOAP/ECP --> false
Aug 01, 2013 1:15:05 PM org.apache.catalina.realm.RealmBase findSecurityConstraints
FINE:   Checking constraint 'SecurityConstraint[ECP]' against GET /profile/SAML2/SOAP/ECP --> true
Aug 01, 2013 1:15:05 PM org.apache.catalina.authenticator.AuthenticatorBase invoke
FINE:  Calling hasUserDataPermission()
Aug 01, 2013 1:15:05 PM org.apache.catalina.realm.RealmBase hasUserDataPermission
FINE:   User data constraint already satisfied
Aug 01, 2013 1:15:05 PM org.apache.catalina.authenticator.AuthenticatorBase invoke
FINE:  Calling authenticate()
Aug 01, 2013 1:15:05 PM org.apache.catalina.authenticator.AuthenticatorBase invoke
FINE:  Failed authenticate() test

Any ideas?

Thanks,
Dave


David A. Jones
Enterprise Systems Analyst
KU Servers & Security
Office:  610-683-4880
Cell:       610-762-4618

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130801/f617df61/attachment-0001.html