IdPEnableECP question

[Craig Cook]

Thanks, my apologies for getting off topic.

While I'm researching my error I was curious to see if anything specific stands out while trying to get my ECP going.

Server.xml   ---realm entry

<Realm className="org.apache.catalina.realm.JNDIRealm" 
       debug="99"
       connectionURL="ldap://xxxxx.xxxxxx.com:389"
       authentication="simple"
       referrals="follow"
       connectionName="shibauth at xxxx.xxxxx.com"
       connectionPassword="passwordThe at tcc!4" 
       userSearch="(sAMAccountName={0})"
       userBase="DC=xxxxxxx,DC=xxxxxxxx,DC=xxxxxxxx" 
       userSubtree="true"
       allRolesMode = "authOnly" />





Catalina Out
INE: The variable [enc] has value [ISO-8859-1]
Dec 04, 2013 2:33:14 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [uriBC] has value [/]
Dec 04, 2013 2:33:14 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [semicolon] has value [-1]
Dec 04, 2013 2:33:14 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [enc] has value [ISO-8859-1]
Dec 04, 2013 2:33:16 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [uriBC] has value [/idp/profile/SAML2/SOAP/ECP]
Dec 04, 2013 2:33:16 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [semicolon] has value [-1]
Dec 04, 2013 2:33:16 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [enc] has value [ISO-8859-1]
Dec 04, 2013 2:33:16 PM org.apache.catalina.authenticator.AuthenticatorBase invoke
FINE: Security checking request POST /idp/profile/SAML2/SOAP/ECP
Dec 04, 2013 2:33:16 PM org.apache.catalina.realm.RealmBase findSecurityConstraints
FINE:   Checking constraint 'SecurityConstraint[Logging Area]' against POST /profile/SAML2/SOAP/ECP --> true
Dec 04, 2013 2:33:16 PM org.apache.catalina.authenticator.AuthenticatorBase invoke
FINE:  Calling hasUserDataPermission()
Dec 04, 2013 2:33:16 PM org.apache.catalina.realm.RealmBase hasUserDataPermission
FINE:   User data constraint has no restrictions
Dec 04, 2013 2:33:16 PM org.apache.catalina.authenticator.AuthenticatorBase invoke
FINE:  Calling authenticate()
Dec 04, 2013 2:33:16 PM org.apache.catalina.authenticator.AuthenticatorBase invoke
FINE:  Failed authenticate() test
Dec 04, 2013 2:33:19 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [uriBC] has value [/]
Dec 04, 2013 2:33:19 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [semicolon] has value [-1]
Dec 04, 2013 2:33:19 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [enc] has value [ISO-8859-1]
Dec 04, 2013 2:33:19 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [uriBC] has value [/]
Dec 04, 2013 2:33:19 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [semicolon] has value [-1]
Dec 04, 2013 2:33:19 PM org.apache.catalina.connector.CoyoteAdapter parsePathParameters
FINE: The variable [enc] has value [ISO-8859-1]




Web.xml  --- security constraint
<security-constraint>
    <web-resource-collection>
          <web-resource-name>Logging Area</web-resource-name>
          <description>
              Authentication for registered users. 
          </description>
          <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
          <http-method>GET</http-method>
          <http-method>POST</http-method>
    </web-resource-collection>
        <auth-constraint>
            <role-name>*</role-name>
        </auth-constraint>
    </security-constraint>
   <security-role>
      <role-name>*</role-name>
   </security-role>
    <login-config>
          <auth-method>BASIC</auth-method>
        <realm-name>ShibUserPassAuth</realm-name>
</login-config>



Login.config



ShibUserPassAuth {

// Example LDAP authentication
// See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass

     edu.vt.middleware.ldap.jaas.LdapLoginModule required

         ldapUrl="ldap://xxxx.xxxx.xxx:389"
         baseDn="DC=xxxx,DC=xxxxxxx,DC=xxx"
         bindDn="CN=shibauth,OU=IT,DC=xxxxxxx,DC=xxxxxxx,DC=xxxxxxx"
         bindCredential="password"
         ssl="false"
         tls="false"
         userFilter="(sAMAccountName={0})"
         subtreeSearch="true";








-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, December 02, 2013 8:55 AM
To: Shib Users
Subject: Re: IdPEnableECP question

On 12/2/13, 1:17 AM, "dsc123" <craig.cook at tulsacc.edu> wrote:
>Looking through the MS O365 intergration white paper there is a short 
>part about enabling ECP in the doc pasted below, it has you define a 
>JNDIRealm in the server.xml

You can do basic authentication with a container or web server in many ways. That is not in scope of our list or documentation, it's on you how to manage that. If you don't know your container, you will need to change that, or use their support list for help.

>However when enabling the basic authentication for ECP, it references 
>shibuserpassauth in the  <login-config> which I have no definition for 
>in server.xml

server.xml is a Tomcat configuration file, and has nothing to do with Shibboleth. "ShibUserPassAuth" or whatever is the default JAAS configuration stanza in the example JAAS config provided for use with the UsernamePassword handler, which has no support for basic authentication whatsoever.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net