Authentication Failure

Mon Jan 14 05:24:18 EST 2013

Hi,

It looks like my LDAP issues are still the root cause.  I have the
following output from my log file:

09:55:29.283 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePassword
LoginServlet:150] - Redirecting to login page /login.jsp
09:55:42.924 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePassword
LoginServlet:170] - Attempting to authenticate user hk3585
09:55:48.195 - DEBUG
[edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePassword
LoginServlet:197] - User authentication for hk3585 failed
java.lang.SecurityException: Configuration Error:
	No such file or directory
	at com.sun.security.auth.login.ConfigFile.<init>(Unknown Source)
~[na:1.7.0_09]
	at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
Method) ~[na:1.7.0_09]
	at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown
Source) ~[na:1.7.0_09]
	at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown
Source) ~[na:1.7.0_09]
	at java.lang.reflect.Constructor.newInstance(Unknown Source)
~[na:1.7.0_09]
	at java.lang.Class.newInstance0(Unknown Source) ~[na:1.7.0_09]
	at java.lang.Class.newInstance(Unknown Source) ~[na:1.7.0_09]
	at javax.security.auth.login.Configuration$3.run(Unknown Source)
~[na:1.7.0_09]
	at javax.security.auth.login.Configuration$3.run(Unknown Source)
~[na:1.7.0_09]
	at java.security.AccessController.doPrivileged(Native Method)
~[na:1.7.0_09]
	at
javax.security.auth.login.Configuration.getConfiguration(Unknown Source)
~[na:1.7.0_09]
	at javax.security.auth.login.LoginContext$1.run(Unknown Source)
~[na:1.7.0_09]
	at javax.security.auth.login.LoginContext$1.run(Unknown Source)
~[na:1.7.0_09]
	at java.security.AccessController.doPrivileged(Native Method)
~[na:1.7.0_09]
	at javax.security.auth.login.LoginContext.init(Unknown Source)
~[na:1.7.0_09]
	at javax.security.auth.login.LoginContext.<init>(Unknown Source)
~[na:1.7.0_09]
	at
edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordL
oginServlet.authenticateUser(UsernamePasswordLoginServlet.java:174)
[shibboleth-identityprovider-2.3.8.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordL
oginServlet.service(UsernamePasswordLoginServlet.java:123)
[shibboleth-identityprovider-2.3.8.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
[servlet-api.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:290) [catalina.jar:6.0.29]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
	at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCa
cheFilter.java:50) [shibboleth-identityprovider-2.3.8.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:235) [catalina.jar:6.0.29]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
	at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilte
r(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.8.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:235) [catalina.jar:6.0.29]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
	at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doF
ilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.7.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:235) [catalina.jar:6.0.29]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206) [catalina.jar:6.0.29]
	at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValv
e.java:233) [catalina.jar:6.0.29]
	at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValv
e.java:191) [catalina.jar:6.0.29]
	at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java
:127) [catalina.jar:6.0.29]
	at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java
:102) [catalina.jar:6.0.29]
	at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.
java:109) [catalina.jar:6.0.29]
	at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:2
98) [catalina.jar:6.0.29]
	at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:85
7) [tomcat-coyote.jar:6.0.29]
	at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(
Http11Protocol.java:588) [tomcat-coyote.jar:6.0.29]
	at
org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
[tomcat-coyote.jar:6.0.29]
	at java.lang.Thread.run(Unknown Source) [na:1.7.0_09]
Caused by: java.io.IOException: Configuration Error:
	No such file or directory
	at com.sun.security.auth.login.ConfigFile.init(Unknown Source)
~[na:1.7.0_09]
	at com.sun.security.auth.login.ConfigFile.init(Unknown Source)
~[na:1.7.0_09]
	... 40 common frames omitted

I've attached my login.config, handler.xml and attribute-resolver.xml
file.  My LDAP server is Read-sgdc-03-pv.  Can you tell me what I've
done wrong?  I can see online that other people have had the same
problem, not sure if it's related to my attribute resolver.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
On Behalf Of Kevin P. Foote
Sent: 11 January 2013 18:28
To: Shib Users
Subject: RE: Authentication Failure

On Fri, 11 Jan 2013, Ogunleye, Philip wrote:

-> Hi Kevin,
-> 
-> I've amended my handler.xml to have the following:

If you are trying to get things working initially .. I would suggest
commenting out RemoteUser and all other login handlers excepts
UsernamePassword   AND once you have that working .. uncomment the
PreviousSession login handler.. 

Having multiple login handlers in play can get confusing unless you know
how to pick the right one via your initiating request. 

Sticking to one login handler and putting your ldap logging to DEBUG or
higher should give you some clue as to what is going on when the user
enters a user/pass pair.

re.. ldap have you verified that you can reach your ldap server from
your IdP host?  

------
thanks
  kevin.foote
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: handler.xml
Type: text/xml
Size: 6254 bytes
Desc: handler.xml
Url : http://shibboleth.net/pipermail/users/attachments/20130114/8c831f0f/attachment-0002.xml 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: login.config
Type: application/octet-stream
Size: 1979 bytes
Desc: login.config
Url : http://shibboleth.net/pipermail/users/attachments/20130114/8c831f0f/attachment-0001.obj 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: attribute-resolver.xml
Type: text/xml
Size: 22192 bytes
Desc: attribute-resolver.xml
Url : http://shibboleth.net/pipermail/users/attachments/20130114/8c831f0f/attachment-0003.xml 