Authentication Failure
Ogunleye, Philip
Philip.Ogunleye at snapon.com
Fri Jan 11 12:29:19 EST 2013
Hi Kevin,
I've amended my handler.xml to have the following:
<ph:LoginHandler xsi:type="ph:RemoteUser">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecif
ied</ph:AuthenticationMethod> </ph:LoginHandler>
<!-- Login handler that delegates the act of authentication to an
external system. -->
<!-- This login handler and the RemoteUser login handler will be merged
in the next major release. -->
<!-- <ph:LoginHandler xsi:type="ph:ExternalAuthn">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecif
ied</ph:AuthenticationMethod> <ph:QueryParam name="foo" value="bar" />
</ph:LoginHandler> -->
<!-- Username/password login handler -->
<ph:LoginHandler xsi:type="ph:UsernamePassword"
jaasConfigurationLocation="file://C:\Users\HK3585\Documents\Shibboleth\I
DP/conf/login.config">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Password
ProtectedTransport</ph:AuthenticationMethod> </ph:LoginHandler>
<!-- Removal of this login handler will disable SSO support, that is it
will require the user to authenticate on every request. -->
<ph:LoginHandler xsi:type="ph:PreviousSession">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Previous
Session</ph:AuthenticationMethod> </ph:LoginHandler>
<!-- IP Address authorisation -->
<ph:LoginHandler xsi:type="ph:IPAddress" defaultDeny="true"
username="ip-user">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Internet
Protocol</ph:AuthenticationMethod> <ph:IPEntry>172.23.0.5</ph:IPEntry>
</ph:LoginHandler>
As machine 172.23.0.5 is the ipaddress of my machine.
I attempt to logon expecting it to return a success response but I get a
authorisation failed response with the output below in the log files.
17:19:07.447 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:180] -
shibboleth.HandlerManager service loaded new configuration
17:19:26.611 - INFO [Shibboleth-Access:74] -
20130111T171926Z|172.23.11.119|readw7philipo:8443|/profile/SAML2/POST/SS
O|
17:19:26.656 - ERROR
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:618]
- No user identified by login handler.
17:19:26.661 - ERROR
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:563]
- Authentication failed with the error:
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException:
No user identified by login handler.
at
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.valid
ateSuccessfulAuthentication(AuthenticationEngine.java:619)
[shibboleth-identityprovider-2.3.8.jar:na]
at
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.compl
eteAuthentication(AuthenticationEngine.java:537)
[shibboleth-identityprovider-2.3.8.jar:na]
at
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.servi
ce(AuthenticationEngine.java:225)
[shibboleth-identityprovider-2.3.8.jar:na]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
[servlet-api.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:290) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatc
her.java:646) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationDispatcher.processRequest(Applicatio
nDispatcher.java:436) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDisp
atcher.java:374) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispat
cher.java:302) [catalina.jar:6.0.29]
at
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.forwa
rdRequest(AuthenticationEngine.java:196)
[shibboleth-identityprovider-2.3.8.jar:na]
at
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.retur
nToAuthenticationEngine(AuthenticationEngine.java:150)
[shibboleth-identityprovider-2.3.8.jar:na]
at
edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthSer
vlet.service(RemoteUserAuthServlet.java:80)
[shibboleth-identityprovider-2.3.8.jar:na]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
[servlet-api.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:290) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCa
cheFilter.java:50) [shibboleth-identityprovider-2.3.8.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:235) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilte
r(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.8.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:235) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doF
ilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.7.jar:na]
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:235) [catalina.jar:6.0.29]
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValv
e.java:233) [catalina.jar:6.0.29]
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValv
e.java:191) [catalina.jar:6.0.29]
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java
:127) [catalina.jar:6.0.29]
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java
:102) [catalina.jar:6.0.29]
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.
java:109) [catalina.jar:6.0.29]
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:2
98) [catalina.jar:6.0.29]
at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:85
7) [tomcat-coyote.jar:6.0.29]
at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(
Http11Protocol.java:588) [tomcat-coyote.jar:6.0.29]
at
org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
[tomcat-coyote.jar:6.0.29]
at java.lang.Thread.run(Unknown Source) [na:1.7.0_09]
17:19:26.663 - INFO [Shibboleth-Access:74] -
20130111T171926Z|172.23.11.119|readw7philipo:8443|/profile/SAML2/POST/SS
O|
17:19:26.709 - INFO [Shibboleth-Audit:989] -
20130111T171926Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|2D116131
17DD0B|https://testsaml.com/SAML|urn:mace:shibboleth:2.0:profiles:saml2:
sso|https://readw7PhilipO/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bin
dings:HTTP-POST|_c5210de19cebf8a06c642c3d359d13a7||||||
Is my handler.xml incorrect?
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
On Behalf Of Kevin P. Foote
Sent: 11 January 2013 16:17
To: Shib Users
Subject: Re: Authentication Failure
On Fri, 11 Jan 2013, Ogunleye, Philip wrote:
-> I am currently trying to decipher how my Identity Provider is
-> authenticating as I do not believe it has a valid connection to my
-> LDAP server.
->
If your suspect of your LDAP connection first thing to do is turn up the
logging on your ldap stack. Also helps to have access to the other end
of your LDAP connection as well.. if that is possible.
conf/logging.xml
<!-- Logs LDAP related messages -->
<logger name="edu.vt.middleware.ldap">
<level value="DEBUG"/>
</logger>
------
thanks
kevin.foote
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
More information about the users
mailing list