Question on Login Handlers

[Brewer, Edward L]

Christopher,

Ok.. so I am about to open up an old wound again but I need some help finalizing the creation of a duplicate UserPassword login handler as mentioned below.

Here is what I have done so far and what is working and not working.

I created a duplicate entry in the handler.xml file like this

Original Userpassword:
<ph:LoginHandler xsi:type="ph:UsernamePassword" jaasConfigurationLocation="file:///opt/shibboleth/idp/current/conf/login.config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ph="urn:mace:shibboleth:2.0:idp:profile-handler"><ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod></ph:LoginHandler>

Duplicate entry
<ph:LoginHandler xsi:type="ph:UsernamePassword" jaasConfigurationLocation="file:///opt/shibboleth/idp/current/conf/login.config" authenticationServletURL="/Authn/UserVPassword" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ph="urn:mace:shibboleth:2.0:idp:profile-handler"><ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:VPasswordProtectedTransport</ph:AuthenticationMethod></ph:LoginHandler>

I then created an entry in the login.config with the name "test" that contained the LDAP information for LDAP2.

I then edited the web.xml to include this

<servlet xmlns="http://java.sun.com/xml/ns/j2ee"><servlet-name>UsernameVPasswordAuthHandler</servlet-name><servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class><init-param><param-name>jaasConfigName</param-name><param-value>test</param-value></init-param><load-on-startup>3</load-on-startup></servlet>
<servlet-mapping xmlns="http://java.sun.com/xml/ns/j2ee"><servlet-name>UsernameVPasswordAuthHandler</servlet-name><url-pattern>/Authn/UserVPassword</url-pattern></servlet-mapping>

So now I made the entry for Test Shib in my relying party to default Authentication method  urn:oasis:names:tc:SAML:2.0:ac:classes:VPasswordProtectedTransport

When I use Test Shib I am directed to  idp/Authn/UserVPassword  and the login page is displayed.  When I enter my credentials it fails... and I see in the log

08:14:07.967 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:177] - User authentication for brewerel failed
javax.security.auth.login.LoginException: No LoginModules configured for test

I have also tried changing jaasConfigurationLocation in the second entry to a different file (leaving ShibUserPassAuth for the name) and dropping the init-param and that makes it use the original file and LDAP1 to auth....

So, any suggestions.


I know that some of you are tempted to repeat your objections that were stated early.  I respect your opinions and they have not fallen on deaf ears.  I have a task at hand I would not like to fail.... So, if there is a technical reason why this will not work then I would like to know.

Thanks again,
Lee
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
Sent: Thursday, August 22, 2013 4:34 PM
To: users at shibboleth.net
Subject: Re: Question on Login Handlers

On 8/22/2013 4:18 PM, Brewer, Edward L wrote:
*One possibility would be to use two login handlers, one configured for LDAP1 (default) and one for LDAP2 (selectable with a particular *authentication method you dream up).  Then ask the new app to request that authentication method (or define a separate RelyingParty for them with *that as their default auth method).

I thought I could, but I was having a hard time figuring out how that would work.  Currently I have two login handlers configured.. one of type UserPassword and the other PreviousSession.  So, can I create another login handler like UserPassord.. with a different login config file?  How would I add it to the handler.xml?

See https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass for specifics and gotchas:

Duplicate the existing UserPassword login handler definition, and change the jassConfigurationLocation attribute to the alternate configuration file (this is the part I'm not sure about since I don't use it myself, there might be issues with this...) and change the AuthenticationMethod element content to be the alternate name you make up (since it's a URI, using https://www.vanderbilt.edu/shibboleth/authmethods/xxxxx might be a good name).  Use this name in your RelyingParty for the rogue SP in the defaultAuthMethod attribute.  The wiki page also says you might need an "init" parameter to the servlet definition in web.xml if you want your made-up auth method identified in the SAML response to the SP.


--

%%  Christopher A. Bongaarts   %%  cab at umn.edu<mailto:cab at umn.edu>          %%

%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%

%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130827/2e93e3ee/attachment.html