ECP authentication failure

[Jones, David A]

Paul, I am not sure why the logs show /saml2/soap/ecp in lowercase.  I went through the XML and Office365 trust settings, but everything I found was uppercase.

Kevin, I looked in the handler.xml.  We are using xsi:type="ph:UsernamePassword" and xsi:type="ph:PreviousSession", but the xsi:type="ph:RemoteUser" is commented out.  Is this what you are referring to when you say the RemoteUserLogInHandler?  

In the server.xml, we are using Realm className="org.apache.catalina.realm.JNDIRealm" for authentication against Active Directory.  What is the last bit in the wiki page regarding the Tomcat Auth Realm?

Thank you both for your suggestions,
Dave

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin P. Foote
Sent: Thursday, August 01, 2013 4:31 PM
To: Shib Users 
Subject: RE: ECP authentication failure


On Thu, 1 Aug 2013, Kevin P. Foote wrote:

> On Thu, 1 Aug 2013, Jones, David A wrote:
>
>> We are using Tomcat for authentication.  I'm not sure that it is correctly configured to allow ECP.   I added this to web.xml.  I am not very familiar with Tomcat authentication.
>
> OK so your web.xml is ok.. probably.
>
> Is there a JAASRealm defind in your Tomcats server.xml file? This is 
> where the login would be actually verified?

Never mind.. the JAAS stuff. What are you using as your "normal"
LoginHandler ?

If your using the RemoteUserLoginHandler .. then the JAASRealm stuff is probably not for you. :)

If you already have Tomcat doing the authentication you should just need to configure the last little bit of the cut/paste from the wiki page to match what you are currently using for your Tomcat Auth Realm.

------
thanks
  kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net