Tomcat JAAS configuration for ECP

[Aaron Howell]

I'm setting up ECP for the first time. I'm just having a little trouble setting up the Auth component. I think it is probably something obvious that I'm missing - as the authentication appears to be succeeding - but I can't seem to find the missing piece to grant access. Was hoping someone might have successfully set this up previous and have a suggestion in the right direction

I'm using RHEL6 and their packaged Tomcat6 which is front-ended by Apache using proxy_ajp. Shibboleth is otherwise configured and working with Form auth.

Accessing the endpoint without any config, results in a SOAP error - as I would expect:
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"> <env:Body> <env:Fault> <faultcode>env:Client</faultcode> <faultstring>An error occurred processing the request.</faultstring> <detail/> </env:Fault> </env:Body></env:Envelope>

I've added the bit to web.xml from (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP) - which causes a Basic Auth (401) prompt to occur - entering any credentials results in a further 401. This is expected considering as I haven't set up the Tomcat to use the JAAS config therefore I presume it does not have any users to authenticate against.

So I've added the login.config file to the JAVA_OPTS:
-Djava.security.auth.login.config=/opt/shibboleth-idp/conf/login.config

And added the Realm to the deployment descriptor:
<Context docBase="/opt/shibboleth-idp/war/idp.war"
         privileged="true"
         antiResourceLocking="false"
         antiJARLocking="false"
         unpackWAR="false"
         swallowOutput="true">
         <Realm className="org.apache.catalina.realm.JAASRealm" 
             appName="ShibUserPassAuth"
             userClassNames="edu.vt.middleware.ldap.jaas.LdapPrincipal"
             roleClassNames="edu.vt.middleware.ldap.jaas.LdapRole" />
</Context>

After restarting tomcat, accessing the endpoint prompts for Auth, putting in an incorrect credentials, results in a 401. Putting in accepted credentials, results in a 403 Access Denied. To me this means that it is successfully authenticating against LDAP, but I just don't quite understand why I am not granted access after this point. I've tried a few different guesses, and everything I've read on JAAS hasn't given me an indication of what I should be looking for.

I can't find any info in any logs (shibboleth or tomcat), and from a comment in here (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass) apparently JAAS logging can be quite silent.

Cheers
Aaron


Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.