Principal from the IDP usernamePassword login handler versus mod_auth_kerb

[Simon Lundström]

On Wed, 2012-12-19 at 21:59:24 +0000, Wessel, Keith William wrote:
> I'm finally setting up ECP support for our IDP.

Cool!

> Enter ECP. For simplicity, I was just planning to use mod_auth_kerb rather than a JAAS-based approach to protect our ECP endpoint. The problem: the principal being passed in through REMOTE_USER is username at domain.

We just strip the REALM if it exists, not pretty but it works(TM). I rewrote
our config to be pretty realm agnostic so there might be some issues:

attribute-resolver.xml:

  <!-- Get the supplied username, this attribute might be scoped with the Kerberos realm -->
  <resolver:AttributeDefinition id="principal" xsi:type="PrincipalName" dependencyOnly="true" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
    <resolver:AttributeEncoder xsi:type="SAML2StringNameID"
                               xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
  </resolver:AttributeDefinition>

  <!-- Take the scoped principal and remove the SU.SE realm from it -->
  <resolver:AttributeDefinition xsi:type="RegexSplit" dependencyOnly="true"
                                xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="regex_principal_split"
                                sourceAttributeID="principal" regex="^(.*?)(@.*)?$">
    <resolver:Dependency ref="principal" />
  </resolver:AttributeDefinition>

[…]

  <!-- SU LDAP Connector -->
  <resolver:DataConnector id="suLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
                          […]
                          >

    <resolver:Dependency ref="regex_principal_split" />
    <FilterTemplate>
      <![CDATA[
                (uid=${regex_principal_split.get(0)})
            ]]>
    </FilterTemplate>
  </resolver:DataConnector>


Good luck!
- Simon

____________________________________

Simon Lundström

IT Services
Stockholm University
SE-106 91 Stockholm, Sweden

www.su.se/it
____________________________________