Login issue
Gilles Badouet
badouetg at uni.coventry.ac.uk
Thu Jul 4 19:05:06 EDT 2013
Hi Peter,
>How are you authenticating users in your IdP?
>Do you use the default edu.vt.middleware.ldap.jaas.LdapLoginModule in
>login.config? (If you post your config make sure to remove any
>passwords prior to sending). If so the line I sent you should have
>lots of information on the LDAP connection, try searching your
>idp-process.log for lines with "fgrep edu.vt.middleware.ldap.jaas".
>....
I am authenticating users using LDAP through Apache Directory Studio 2.0. I also tried OpenDJ 2.7 but was having the same issue. I cant see the above lines in idp-process.log. I just know that there is connection between IDP and LDAP server on a basis of the login page redirected when the resource is requested. The log content I see in LDAP DSA side is only about its internal operation and status and when I make a modification on it.
Please have a look on my JAAS authentication configuration in login.config below where I left the host,port, base and userField default as in ApacheDS. I also left the pwd Hash Method by default (SHA) in ApacheDS
ShibUserPassAuth {
edu.vt.middleware.ldap.jaas.LdapLoginModule required
host="localhost"
port="10389"
base="ou=users, ou=system, dc=example, dc=com"
ssl="true"
userField="uid"
subtreeSearch="true"
serviceCredential="myldap_pwd" ;
};
To reflect the login.config, I configured the Ldap connector in attribute-resolver.xml as below
<resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
ldapURL="ldap://localhost:10389"
baseDN="ou=users, ou=system, dc=example, dc=com"
principal="uid=admin,ou=system"
principalCredential="myldap_pwd">
<FilterTemplate>
<![CDATA[
(uid=$requestContext.principalName)
]]>
</FilterTemplate>
</resolver:DataConnector>
Besides, I made use of the default attribute-resolver.xml where I uncommented all the AttributeDefinition apart from the two with id="eduPersonTargetedID" and id="eduPersonTargetedID.old.
For the attribute-filter.xml I left the whole content default except that I added the following:
Under the First attributeFilterPolicy
<afp:AttributeRule attributeID="commonName">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
<afp:AttributeRule attributeID="surname">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
And at the end
<afp:AttributeFilterPolicy>
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://ans.247lib.com/shibboleth" />
<afp:AttributeRule attributeID="eduPersonAffiliation">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
<afp:AttributeRule attributeID="eduPersonEntitlement">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
</afp:AttributeFilterPolicy>
Finnally, I uncommented all the attributes in attribute-map.xml
Sorry for the long content of this mail.
Kind regards
Gilles Rubens Badouet
Student ID: 3940347
Faculty of Engineering and Computing
MSc Network Computing Course
Mobile: 07424486426
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of users-request at shibboleth.net [users-request at shibboleth.net]
Sent: 04 July 2013 12:23
To: users at shibboleth.net
Subject: users Digest, Vol 25, Issue 24
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. Re: limiting which IdPs can access an SP (Peter Schober)
2. RE: Login issue (Gilles Badouet)
3. Re: Login issue (Peter Schober)
4. Re: Tomcat JAAS configuration for ECP (Aaron Howell)
----------------------------------------------------------------------
Message: 1
Date: Thu, 4 Jul 2013 11:32:00 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: limiting which IdPs can access an SP
To: users at shibboleth.net
Message-ID: <20130704093200.GX25104 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Liam Hoekenga <liamr at umich.edu> [2013-07-03 22:13]:
> Short of ditching the federation metadata, and configuring
> MetadataProviders for the specific IdPs we want to talk to, is there
> a way to limit which IdPs it will permit authentication from? Can
> will filter out the unwanted IdPs somehow?
Implement proper authorization in the service (or SP)?
(You know, the old "authentication != authorized" adage?)
Unless this is a special case where positively /any/ credential valid
(think guest accounts etc.) at one of the whitelisted IDPs should be
able to access your service.
-peter
------------------------------
Message: 2
Date: Thu, 4 Jul 2013 10:27:59 +0000
From: Gilles Badouet <badouetg at uni.coventry.ac.uk>
Subject: RE: Login issue
To: "users at shibboleth.net" <users at shibboleth.net>
Message-ID:
<1939041E7E86BB4297EB69590F1F928F65F2ED9A at AMSPRD0112MB561.eurprd01.prod.exchangelabs.com>
Content-Type: text/plain; charset="us-ascii"
Hi Scott and Peter,
I managed to fix the xml issue and, I dont see anymore any error in shibd.log as in other logs. But still
I can't login. Since I am not seeing any error in my logs, I am quite blocked on what to check and process further.
Any further orientation would be really helpful.
Kind regards
Gilles Rubens Badouet
Student ID: 3940347
Faculty of Engineering and Computing
MSc Network Computing Course
Mobile: 07424486426
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of users-request at shibboleth.net [users-request at shibboleth.net]
Sent: 03 July 2013 18:18
To: users at shibboleth.net
Subject: users Digest, Vol 25, Issue 20
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. RE: Can Shibboleth IdP handle something like Domain/Group?
(Eric Goodman)
2. Re: Remote IdP not responding? (Christopher Bongaarts)
3. RE: shibboleth - stopped working after package update
(Cantor, Scott)
4. RE: shibboleth - stopped working after package update
(Cantor, Scott)
5. RE: help - multi vhosts with one single IdP configuration
entry (Cantor, Scott)
6. RE: Session Closes on Browser Close (Cantor, Scott)
7. RE: Login issue (Cantor, Scott)
----------------------------------------------------------------------
Message: 1
Date: Wed, 3 Jul 2013 16:24:02 +0000
From: Eric Goodman <Eric.Goodman at ucop.edu>
Subject: RE: Can Shibboleth IdP handle something like Domain/Group?
To: Shib Users <users at shibboleth.net>
Message-ID:
<CAAD65CCC876B544AFE2DD38197F758A047E8101 at p-irc-exmbx02.AD.UCOP.EDU>
Content-Type: text/plain; charset="us-ascii"
FWIW, I've actually always run different containers for various reasons (e.g., load testing, allowing devs to shell into test envs but not prod ones). I've found that running multiple shib instances is much easier than running and populating the multiple backend datastores that you're likely to need if you have, e.g., test accounts that you don't want in your prod datastore.
Whether an LDAP, AD, etc. the work we've always run into is around managing that extra datastore. Running the second shib instance has never been that much overhead.
--- Eric
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, July 02, 2013 8:46 PM
To: Shib Users
Subject: RE: Can Shibboleth IdP handle something like Domain/Group?
> When this was proposed to me I hinted at Scott's answer by asking
> whether it would really be any easier to manage one complex instance
> rather than five on separate VMs. The answer seems to be that it is
> mainly convenient for the server admins; multiple servers for them to
> administer and update versus one server; the more complex application
> layer isn't their problem and I was directed to investigate the possibility.
I didn't mean multiple VMs, I said virtualize the IdP. I don't see why you can't have one container running different copies (or multiple containers I suppose).
> And even that seems to still leave the problem of pulling the
> appropriate set of attributes - that is, the set of "my" attributes
> from the appropriate repository corresponding the service instance I ask to use.
That's down to creative querying and scripting, but like I said, brittle.
-- Scott
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
------------------------------
Message: 2
Date: Wed, 03 Jul 2013 11:32:50 -0500
From: Christopher Bongaarts <cab at umn.edu>
Subject: Re: Remote IdP not responding?
To: users at shibboleth.net
Message-ID: <51D45232.4020004 at umn.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
On 7/1/2013 7:10 PM, Roger Jagoda wrote:
> The only thing remaining is the Session initiation. We protect a page
> on our side (SP) and trigger the Shibboleth session with the usual
> vhost configuration:
>
> <Location /secure/protected.php>
> AuthType shibboleth
> ShibRequireSession On
> require valid-user
> ShibUseHeaders On
> </Location>
>
>
> What is the best way of forcing the redirection to the appropriate
> URL.
Apologies if this was already answered in a disconnected part of the
thread....
Add this line to your <Location> block:
ShibRequestSetting entityID https://shibboleth.testdb.idp2.edu
The SP will generate the necessary redirects and SAML requests for you.
References:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig
--
%% Christopher A. Bongaarts %% cab at umn.edu %%
%% OIT - Identity Management %% http://umn.edu/~cab %%
%% University of Minnesota %% +1 (612) 625-1809 %%
------------------------------
Message: 3
Date: Wed, 3 Jul 2013 17:01:05 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: shibboleth - stopped working after package update
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D9491383946011DC at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> My question is: Why the use of Satisfy Any when the login handler is on
> /Shibboleth.sso/Login? My drupal site points its login handler to that location.
> If that Satisfy Any directive is there, it cannot authenticate.
As Peter said, that's not possible, or certainly not correct anyway. Handlers are never protected *by* the SP, they have to run. People were complaining that their root server configs were accidentally blocking access to them.
There is no package issue if a change exposes an incorrect configuration in the first place.
-- Scott
------------------------------
Message: 4
Date: Wed, 3 Jul 2013 17:02:14 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: shibboleth - stopped working after package update
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D9491383946011F5 at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> This modification causes a redirection loop with an SP of ours. If I
> comment it out, everything works again.
I don't see how that's possible, but would be fascinated to learn how. What is not in doubt is that your SP had an incorrect Apache configuration to start with. If we know in what way, we can document around that.
-- Scott
------------------------------
Message: 5
Date: Wed, 3 Jul 2013 17:04:41 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: help - multi vhosts with one single IdP configuration
entry
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D94913839460121B at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> ACS had to be configured in IdP, not in SP.
That's what metadata means, yes.
> This was established by using FQDN handler URL in SP configuration:
You should NOT do that, in virtually any case. That's a sign you have a misconfigured system to begin with.
-- Scott
------------------------------
Message: 6
Date: Wed, 3 Jul 2013 17:09:23 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: Session Closes on Browser Close
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D949138394601252 at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> If there are alternatives that /only/ use cookies with an Expires
> attribute that satisfy your needs (in most cases that means
> cross-domain WebSSO with rich attribute support) feel free to use
> that instead.
Heh, this is certainly the first time anybody has complained that Shibboleth sessions are too fragile.
In any case, cookieLifetime has been there since 2.1, you can use it if you really want to set an expiration time for them that goes beyond session.
In fact, I've been meaning to play with that as a means if possibly getting around the Firefox and Chrome nonsense. It seems that "persistent" cookies are now the way to achieve non-persistence.
-- Scott
------------------------------
Message: 7
Date: Wed, 3 Jul 2013 17:17:46 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: Login issue
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D949138394601297 at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> I am using 8443 for IdP https access because the standard 443 is already used
> in IIS for my SP.
Which is why we advised not doing this on one host.
> Concerning the current issue, I added <logger
> name="edu.vt.middleware.ldap.jaas.JaasAuthenticator" level="DEBUG" />
> in my logging.xml file
> but still cant see any change in IdP side. In LDAP logs, I cant neither see any
> issue related to IdP.
Then there's a failure occurring before it gets that far.
> I cant see in an SP log file (shibd.log) the following error messages and would
> like to understand and know how solve it.
Fix the XML in your file. The error is strange looking and is probably an indication you have a namespace error in however you've added the broken element, or possibly have added two elements where only one is permitted.
You should be able to solve errors like that by reading the documentation, which describes the content permitted in those files.
-- Scott
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 25, Issue 20
*************************************
------------------------------
Message: 3
Date: Thu, 4 Jul 2013 13:04:30 +0200
From: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Login issue
To: users at shibboleth.net
Message-ID: <20130704110430.GA15981 at aco.net>
Content-Type: text/plain; charset=us-ascii
* Gilles Badouet <badouetg at uni.coventry.ac.uk> [2013-07-03 17:42]:
> I am using 8443 for IdP https access because the standard 443 is
> already used in IIS for my SP.
You could have both on port 443 by tunnelling to Tomcat from MS-IIS:
http://tomcat.apache.org/connectors-doc/webserver_howto/iis.html
Jfyi.
> Concerning the current issue, I added <logger
> name="edu.vt.middleware.ldap.jaas.JaasAuthenticator" level="DEBUG"
> /> in my logging.xml file but still cant see any change in IdP
> side. In LDAP logs, I cant neither see any issue related to IdP.
How are you authenticating users in your IdP?
Do you use the default edu.vt.middleware.ldap.jaas.LdapLoginModule in
login.config? (If you post your config make sure to remove any
passwords prior to sending). If so the line I sent you should have
lots of information on the LDAP connection, try searching your
idp-process.log for lines with "fgrep edu.vt.middleware.ldap.jaas".
On your LDAP DSA side, "not seeing an issue" does not say much. So you
can verify that the connection from the IDP has been established
correctly, that a bind with the DN (it's not, but your DSA seems to
want this broken syntax) "Administrator at ADdomain" succeeds? That
subsequent LDAP search operations return non-null number of objects?
That all returned result codes are successful?
You should probably verify the connection parameters required for your
LDAP DSA works with some other tool. (Personally I'd use OpenLDAP's
ldapsearch but there are plenty of others, e.g. Apache Directory
Studio, LDAPExplorerTool, IXplorer, etc.). If you have something
"known good" migrate those settings to your IdP.
-peter
------------------------------
Message: 4
Date: Thu, 4 Jul 2013 11:23:04 +0000
From: Aaron Howell <aaron.howell at deakin.edu.au>
Subject: Re: Tomcat JAAS configuration for ECP
To: Shib Users <users at shibboleth.net>
Message-ID: <14925570-2AFB-4F2F-BED5-5500B4FE0993 at deakin.edu.au>
Content-Type: text/plain; charset="windows-1252"
Thanks Rhys, seems to be the missing piece. As for Apache vs Tomcat, I really only tried to use Tomcat so to reuse the pre-existing JAAS config.
>From your info and some other threads I dug out in the meantime, what I think I've deciphered, is Tomcat needs at least one role defined to be able to then match the wildcard "*" role.
Cheers for your help
On 04/07/2013, at 5:32 PM, Rhys Smith <smith at CARDIFF.AC.UK> wrote:
> Hi Aaron,
>
> JAAS logging can indeed be terse to the point of non-existant, which can be a bit annoying when trying to debug what's going on...
>
> Not really an answer to your question, but I have to ask - if you're fronting with Apache, why not just set up a <Location> block for the ECP handler protected with LDAP basicauth, and forget about configuring it in tomcat? It's a darn sight easier than getting tomcat and JAAS working. And apache actually logs what's happening?
>
> If you are insistent on using tomcat, I can confirm it really does work if you're happy to fiddle with it until it starts working, and then never touch it again in case tomcat breaks?
>
> One question - your tomcat config - did you just take the snippet from IdPEnableECP and add nothing else? I'm just looking at my web.xml and I also have security roles referenced, as in:
>
> <!-- Security roles referenced by this web application -->
> <security-role>
> <description>The role that is required to access the ECP area</description>
> <role-name>*</role-name>
> </security-role>
>
> (which is directly below the <security-constraint> section that has the ECP stuff in it). That helped in my quest to get it working...
>
> Rhys.
> --
> Dr Rhys Smith
> Identity, Access, and Middleware Specialist
> Cardiff University & Janet - the UK's research and education network
>
> email: smith at cardiff.ac.uk / rhys.smith at ja.net
> GPG: 0xDE2F024C
>
>
> On 4 Jul 2013, at 07:46, Aaron Howell <aaron.howell at deakin.edu.au> wrote:
>
>> I'm setting up ECP for the first time. I'm just having a little trouble setting up the Auth component. I think it is probably something obvious that I'm missing - as the authentication appears to be succeeding - but I can't seem to find the missing piece to grant access. Was hoping someone might have successfully set this up previous and have a suggestion in the right direction
>>
>> I'm using RHEL6 and their packaged Tomcat6 which is front-ended by Apache using proxy_ajp. Shibboleth is otherwise configured and working with Form auth.
>>
>> Accessing the endpoint without any config, results in a SOAP error - as I would expect:
>> <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"> <env:Body> <env:Fault> <faultcode>env:Client</faultcode> <faultstring>An error occurred processing the request.</faultstring> <detail/> </env:Fault> </env:Body></env:Envelope>
>>
>> I've added the bit to web.xml from (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP) - which causes a Basic Auth (401) prompt to occur - entering any credentials results in a further 401. This is expected considering as I haven't set up the Tomcat to use the JAAS config therefore I presume it does not have any users to authenticate against.
>>
>> So I've added the login.config file to the JAVA_OPTS:
>> -Djava.security.auth.login.config=/opt/shibboleth-idp/conf/login.config
>>
>> And added the Realm to the deployment descriptor:
>> <Context docBase="/opt/shibboleth-idp/war/idp.war"
>> privileged="true"
>> antiResourceLocking="false"
>> antiJARLocking="false"
>> unpackWAR="false"
>> swallowOutput="true">
>> <Realm className="org.apache.catalina.realm.JAASRealm"
>> appName="ShibUserPassAuth"
>> userClassNames="edu.vt.middleware.ldap.jaas.LdapPrincipal"
>> roleClassNames="edu.vt.middleware.ldap.jaas.LdapRole" />
>> </Context>
>>
>> After restarting tomcat, accessing the endpoint prompts for Auth, putting in an incorrect credentials, results in a 401. Putting in accepted credentials, results in a 403 Access Denied. To me this means that it is successfully authenticating against LDAP, but I just don't quite understand why I am not granted access after this point. I've tried a few different guesses, and everything I've read on JAAS hasn't given me an indication of what I should be looking for.
>>
>> I can't find any info in any logs (shibboleth or tomcat), and from a comment in here (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass) apparently JAAS logging can be quite silent.
>>
>> Cheers
>> Aaron
>>
>>
>> Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.
>>
>> Deakin University does not warrant that this email and any attachments are error or virus free.
>>
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.
Deakin University does not warrant that this email and any attachments are error or virus free.
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 25, Issue 24
*************************************
More information about the users
mailing list