Tomcat JAAS configuration for ECP

[Aaron Howell]

Thanks Rhys, seems to be the missing piece. As for Apache vs Tomcat, I really only tried to use Tomcat so to reuse the pre-existing JAAS config. 

>From your info and some other threads I dug out in the meantime, what I think I've deciphered, is Tomcat needs at least one role defined to be able to then match the wildcard "*" role. 

Cheers for your help

On 04/07/2013, at 5:32 PM, Rhys Smith <smith at CARDIFF.AC.UK> wrote:

> Hi Aaron,
> 
> JAAS logging can indeed be terse to the point of non-existant, which can be a bit annoying when trying to debug what's going on...
> 
> Not really an answer to your question, but I have to ask - if you're fronting with Apache, why not just set up a <Location> block for the ECP handler protected with LDAP basicauth, and forget about configuring it in tomcat? It's a darn sight easier than getting tomcat and JAAS working. And apache actually logs what's happening…
> 
> If you are insistent on using tomcat, I can confirm it really does work if you're happy to fiddle with it until it starts working, and then never touch it again in case tomcat breaks…
> 
> One question - your tomcat config - did you just take the snippet from IdPEnableECP and add nothing else? I'm just looking at my web.xml and I also have security roles referenced, as in:
> 
>    <!-- Security roles referenced by this web application -->
>    <security-role>
>        <description>The role that is required to access the ECP area</description>
>        <role-name>*</role-name>
>    </security-role>
> 
> (which is directly below the <security-constraint> section that has the ECP stuff in it). That helped in my quest to get it working...
> 
> Rhys.
> --
> Dr Rhys Smith
> Identity, Access, and Middleware Specialist
> Cardiff University & Janet - the UK's research and education network
> 
> email: smith at cardiff.ac.uk / rhys.smith at ja.net
> GPG: 0xDE2F024C
> 
> 
> On 4 Jul 2013, at 07:46, Aaron Howell <aaron.howell at deakin.edu.au> wrote:
> 
>> I'm setting up ECP for the first time. I'm just having a little trouble setting up the Auth component. I think it is probably something obvious that I'm missing - as the authentication appears to be succeeding - but I can't seem to find the missing piece to grant access. Was hoping someone might have successfully set this up previous and have a suggestion in the right direction
>> 
>> I'm using RHEL6 and their packaged Tomcat6 which is front-ended by Apache using proxy_ajp. Shibboleth is otherwise configured and working with Form auth.
>> 
>> Accessing the endpoint without any config, results in a SOAP error - as I would expect:
>> <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"> <env:Body> <env:Fault> <faultcode>env:Client</faultcode> <faultstring>An error occurred processing the request.</faultstring> <detail/> </env:Fault> </env:Body></env:Envelope>
>> 
>> I've added the bit to web.xml from (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP) - which causes a Basic Auth (401) prompt to occur - entering any credentials results in a further 401. This is expected considering as I haven't set up the Tomcat to use the JAAS config therefore I presume it does not have any users to authenticate against.
>> 
>> So I've added the login.config file to the JAVA_OPTS:
>> -Djava.security.auth.login.config=/opt/shibboleth-idp/conf/login.config
>> 
>> And added the Realm to the deployment descriptor:
>> <Context docBase="/opt/shibboleth-idp/war/idp.war"
>>        privileged="true"
>>        antiResourceLocking="false"
>>        antiJARLocking="false"
>>        unpackWAR="false"
>>        swallowOutput="true">
>>        <Realm className="org.apache.catalina.realm.JAASRealm" 
>>            appName="ShibUserPassAuth"
>>            userClassNames="edu.vt.middleware.ldap.jaas.LdapPrincipal"
>>            roleClassNames="edu.vt.middleware.ldap.jaas.LdapRole" />
>> </Context>
>> 
>> After restarting tomcat, accessing the endpoint prompts for Auth, putting in an incorrect credentials, results in a 401. Putting in accepted credentials, results in a 403 Access Denied. To me this means that it is successfully authenticating against LDAP, but I just don't quite understand why I am not granted access after this point. I've tried a few different guesses, and everything I've read on JAAS hasn't given me an indication of what I should be looking for.
>> 
>> I can't find any info in any logs (shibboleth or tomcat), and from a comment in here (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass) apparently JAAS logging can be quite silent.
>> 
>> Cheers
>> Aaron
>> 
>> 
>> Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.
>> 
>> Deakin University does not warrant that this email and any attachments are error or virus free.
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.