Login issue
Gilles Badouet
badouetg at uni.coventry.ac.uk
Wed Jul 3 11:41:23 EDT 2013
Hi Peter,
I am using 8443 for IdP https access because the standard 443 is already used in IIS for my SP.
Concerning the current issue, I added <logger name="edu.vt.middleware.ldap.jaas.JaasAuthenticator" level="DEBUG" /> in my logging.xml file
but still cant see any change in IdP side. In LDAP logs, I cant neither see any issue related to IdP.
I cant see in an SP log file (shibd.log) the following error messages and would like to understand and know how solve it.
ERROR XMLTooling.ParserPool : error on line 42, column 17, message: element 'AttributeDecoder' is not allowed for content model '(AttributeDecoder?)'. I got a look at the indicated element in attribute-map.xml but dont understand what to do there.
ERROR Shibboleth.AttributeExtractor.XML : error while loading resource (C:/opt/shibboleth-sp/etc/shibboleth/attribute-map.xml): XML error(s) during parsing, check log for specifics. Certainly related to the first error.
Kind regards
Gilles Rubens Badouet
Student ID: 3940347
Faculty of Engineering and Computing
MSc Network Computing Course
Mobile: 07424486426
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of users-request at shibboleth.net [users-request at shibboleth.net]
Sent: 03 July 2013 13:07
To: users at shibboleth.net
Subject: users Digest, Vol 25, Issue 17
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. Re: shibboleth - stopped working after package update
(Pedro Albuquerque)
2. Re: shibboleth - stopped working after package update
(Peter Schober)
3. Session Closes on Browser Close (Saurabh Tyagi)
4. Login issue (Gilles Badouet)
5. Re: Session Closes on Browser Close (Peter Schober)
6. Re: Login issue (Zico)
----------------------------------------------------------------------
Message: 1
Date: Wed, 03 Jul 2013 12:23:33 +0100
From: Pedro Albuquerque <pedroalb at ebi.ac.uk>
Subject: Re: shibboleth - stopped working after package update
To: users at shibboleth.net
Message-ID: <51D409B5.6070808 at ebi.ac.uk>
Content-Type: text/plain; charset="iso-8859-1"
Thanks Scott.
The /etc/httpd/conf.d/shib.conf has been changed with the upgrade.
This block has been added with the update:
#
# Ensures handler will be accessible.
#
<Location /Shibboleth.sso>
Satisfy Any
Allow from all
</Location>
I just simply removed it and worked.
My question is: Why the use of Satisfy Any when the login handler is on
/Shibboleth.sso/Login? My drupal site points its login handler to that
location. If that Satisfy Any directive is there, it cannot authenticate.
Thanks,
Pedro.
On 02/07/2013 16:55, Cantor, Scott wrote:
>> I believe there are differences (even minor ones) that would affect
>> this. If I downgrade to 2.5.1-1.2 it works without changing any
>> configuration files. (I only keep the /etc/shibboleth/shibboleth2.xml
>> across versions).
>>
> The only thing I can think of is that you didn't modify shib.conf at all, in which case the upgrade would change that file, specifically adding a Location block for /Shibboleth.sso with commands to guarantee that nothing blocks access to the handlers inadvertently. That's the area to check, and I would simply remove the modification and see if that matters. I have no idea why or how it would.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130703/2c158502/attachment-0001.html
------------------------------
Message: 2
Date: Wed, 3 Jul 2013 13:34:48 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: shibboleth - stopped working after package update
To: users at shibboleth.net
Message-ID: <20130703113448.GO25104 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Pedro Albuquerque <pedroalb at ebi.ac.uk> [2013-07-03 13:24]:
> <Location /Shibboleth.sso>
> Satisfy Any
> Allow from all
> </Location>
>
> I just simply removed it and worked.
> My question is: Why the use of Satisfy Any when the login handler is
> on /Shibboleth.sso/Login? My drupal site points its login handler to
> that location. If that Satisfy Any directive is there, it cannot
> authenticate.
This location directive will also match anything "below"
/Shibbboleth.sso, so it will also match /Shibboleth.sso/Login.
Obviously you cannot protect endpoints at which Shibboleth initiates
sessions or recieves SAML assertions with the Shibboleth software, you
d never be able to log in (you can't mandate a valid session to allow
initiating of sessions).
So whatever is broken, access to /Shibboleth.sso needs to be
unrestricted from any access control and also cannot be routed to any
other application (e.g. Drupal),
-peter
------------------------------
Message: 3
Date: Wed, 3 Jul 2013 17:22:34 +0530
From: "Saurabh Tyagi" <saurabh.tyagi at thepsi.com>
Subject: Session Closes on Browser Close
To: "'Shib Users'" <users at shibboleth.net>
Message-ID: <004601ce77e3$d048da40$70da8ec0$@tyagi at thepsi.com>
Content-Type: text/plain; charset="us-ascii"
Hello Friends,
I logged into my application Using Shibboleth SP and Shibboleth IdP.
I have two application running , that need Authentication from Idp.
As I open the first application, Idp prompts for user name and password.
After logging ,if I open the second tab and tries to login , it immediately
logs me into second application.
Now, if I close the browser and start it again, and tries to login into the
first or second application.
It again ask for User name and password.
As per my understanding it should not ask for username and password if I try
to login from the same browser for next 30 minutes?
I have below lines in my handler.xml
<ph:LoginHandler xsi:type="ph:PreviousSession">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSess
ion</ph:AuthenticationMethod>
</ph:LoginHandler>
Can any open please tell if it should be the behavior? or something is
wrong?
Thanks and Regards
Saurabh Tyagi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130703/bda26dcf/attachment-0001.html
------------------------------
Message: 4
Date: Wed, 3 Jul 2013 12:02:25 +0000
From: Gilles Badouet <badouetg at uni.coventry.ac.uk>
Subject: Login issue
To: "users at shibboleth.net" <users at shibboleth.net>
Message-ID:
<1939041E7E86BB4297EB69590F1F928F65F2ED05 at AMSPRD0112MB561.eurprd01.prod.exchangelabs.com>
Content-Type: text/plain; charset="iso-8859-1"
Hello all,
After configuring my LDAP authentication method , I am not able to use a user credentials I created in the
LDAP database (within Apache Directory Studio 2.7) to log in when my IdP requests the login parameters (Username & password). It looks like my IdP doesn't recognize users credentials in LDAP server even as there is a connection between the two entities (LDAP & IdP).
Below is the exactly the scenario:
I browse https://ans.247lib.com/secure (my SP is within IIS 7 with an html page in the "secure" folder for test). I am then redirected to https://amlib.co.uk:8443/idp/Authn/UserPassword (my IdP is within Tomcat 6), that returns me the authentication page on which I can read among others "Log in to ans.247lib.com". When I provide Username and Password, I cant log in, the message is "Login has failed. Double-check your username and password"
I have checked all the logs but I cant see details about that issue.
I need some orientation please.
Kind regards
Gilles Rubens Badouet
Student ID: 3940347
Faculty of Engineering and Computing
MSc Network Computing Course
Mobile: 07424486426
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130703/ad33f689/attachment-0001.html
------------------------------
Message: 5
Date: Wed, 3 Jul 2013 14:03:02 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Session Closes on Browser Close
To: users at shibboleth.net
Message-ID: <20130703120302.GP25104 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Saurabh Tyagi <saurabh.tyagi at thepsi.com> [2013-07-03 13:53]:
> Now, if I close the browser and start it again, and tries to login
> into the first or second application.
>
> It again ask for User name and password.
That's the traditional and in fact desired behaviour. When your user
agent process exits it discards HTTP Cookies without an expiration
date (very much in line with RFC2109). Or it keeps them around but
doesn't restore them automatically.
Mozilla Firefox has a couple of options influencing this, check the
archives (mostly in threads labelled "logout" and "firefox").
Either way, it's all in your HTTP User Agent, Shibboleth has nothing
to do with it.
-peter
------------------------------
Message: 6
Date: Wed, 3 Jul 2013 07:06:02 -0500
From: Zico <mailzico at gmail.com>
Subject: Re: Login issue
To: Shib Users <users at shibboleth.net>
Message-ID:
<CA+1bt6Qv4R77yTovqYqTfTwD44GwowwSD_r0zDifXzmgppBzgw at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
On Wed, Jul 3, 2013 at 7:02 AM, Gilles Badouet
<badouetg at uni.coventry.ac.uk> wrote:
> Hello all,
>
> After configuring my LDAP authentication method , I am not able to use a
> user credentials I created in the
> LDAP database (within Apache Directory Studio 2.7) to log in when my IdP
> requests the login parameters (Username & password). It looks like my IdP
> doesn't recognize users credentials in LDAP server even as there is a
> connection between the two entities (LDAP & IdP).
>
> Below is the exactly the scenario:
> I browse https://ans.247lib.com/secure (my SP is within IIS 7 with an html
> page in the "secure" folder for test). I am then redirected to
> https://amlib.co.uk:8443/idp/Authn/UserPassword (my IdP is within Tomcat 6),
> that returns me the authentication page on which I can read among others
> "Log in to ans.247lib.com". When I provide Username and Password, I cant log
> in, the message is "Login has failed. Double-check your username and
> password"
> I have checked all the logs but I cant see details about that issue.
Please double check "idp-process.log" and "idp-access.log"
>
> I need some orientation please.
>
>
>
> Kind regards
>
>
>
>
>
> Gilles Rubens Badouet
>
> Student ID: 3940347
>
> Faculty of Engineering and Computing
>
> MSc Network Computing Course
>
> Mobile: 07424486426
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
--
Best,
Zico
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 25, Issue 17
*************************************
More information about the users
mailing list