ECP authentication failure

[Jones, David A]

We are using Tomcat for authentication.  I'm not sure that it is correctly configured to allow ECP.   I added this to web.xml.  I am not very familiar with Tomcat authentication.
<security-constraint> 
            <display-name>Shibboleth IdP</display-name> 
            <web-resource-collection> 
                <web-resource-name>user authentication</web-resource-name> 
                <url-pattern>/Authn/RemoteUser</url-pattern> 
                <http-method>GET</http-method> 
                <http-method>POST</http-method> 
            </web-resource-collection> 
            <auth-constraint> 
                <role-name>user</role-name> 
            </auth-constraint>  
            <user-data-constraint> 
                <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
            </user-data-constraint>  
        </security-constraint>		
		
		<security-role> 
            <role-name>user</role-name> 
        </security-role>		
		
		<security-constraint>        
			<display-name>Shibboleth ECP</display-name>        
			<web-resource-collection>            
				<web-resource-name>ECP</web-resource-name>            
				<url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>            
				<http-method>GET</http-method>            
				<http-method>POST</http-method>        
			</web-resource-collection>     
			<auth-constraint> 
			<role-name>*</role-name>
			</auth-constraint> 
			<user-data-constraint>            
			<transport-guarantee>CONFIDENTIAL</transport-guarantee>        
			</user-data-constraint>    
		</security-constraint>


login-config>
			<auth-method>BASIC</auth-method>
			<realm-name>ShibUserPassAuth</realm-name>
</login-config>

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin P. Foote
Sent: Thursday, August 01, 2013 3:50 PM
To: Shib Users
Subject: Re: ECP authentication failure


On Thu, 1 Aug 2013, Paul Hethmon wrote:

> Are you just hitting case-sensitivity? Those aren't the same paths regardless of the letters involved.
>

Have you correctly configured actual login for Apache, Tomcat, Jetty or what ever
container(s) you have involved for ... the correct path?

You mentioned login is not working .. so where is your login config messed up? This should be in container logs.. tomcat/jetty/apache somewhere before you get to the actual ECP endpoint

------
thanks
  kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net