Compiling the Shibboleth SP for OHS

Mon Jul 29 23:07:58 EDT 2013

Hi Scott,

I'm on the middle of downloading the required development packages from
the below repo , but it seems that the: "libcurl-openssl-devel" is  not
there
any idea where it can be download it for RH-5 x86_64.

repo:
http://download.opensuse.org/repositories/security:/shibboleth/RHEL_5/x86_64/

I need the Shibboleth SP code must be compiled from source against the OHS
libraries.
I'm simply need to rebuilding binary RPM packages from SRPMs on RHEL
systems with OHS installed will be sufficient to create the necessary
Shibboleth SP binary packages for deployment.

Thanks,
--Pirulo

>
> Message: 1
> Date: Mon, 29 Jul 2013 21:58:41 +0000
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> Subject: Re: Compiling the Shibboleth SP for OHS
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> 	<BA63CEAE152A7742B854C678D9491383AD1332C5 at CIO-KRC-D1MBX01.osuad.osu.edu>
>
> Content-Type: text/plain; charset="us-ascii"
>
> On 7/29/13 5:46 PM, "support at pureview.com" <support at pureview.com> wrote:
>>
>>I need to Compile the Shibboleth SP for OHS. Have any one had done this
>>and in order to do this is apache need to be installed prior to start the
>>compiling.
>
> If you don't use Apache, you don't need Apache. I may not understand what
> you're asking.
>
> I have never personally built it, I have a TODO to build it for somebody
> on Windows.
>
> -- Scott
>
>
>
>
> ------------------------------
>
> Message: 2
> Date: Mon, 29 Jul 2013 15:02:48 -0700
> From: Christopher Peters <cjpeters at uci.edu>
> Subject: Re: SSL Error: alert internal error
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> 	<CAGocuEuBB2p=v-_Yk74-uvJT1=AEztnpdFC_FBLCwFnDZZR6-g at mail.gmail.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Well, we are using it for the SSO transaction (which uses Apache), but I
> see your point.  I don't really know how Java's dependencies are set up,
> but if you say it's not relying on OSSL, I will take your word for it.
>  That makes life much simpler anyway.
>
> As for the SSL thing, I have a server mirrored on another system and I can
> set it up with 1.7 and see if I can get an OpenSSL connection to Tomcat on
> 8443.  I will give that a shot and let you know what I find out.
>
> Chris
>
>
> On Mon, Jul 29, 2013 at 2:50 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 7/29/13 5:47 PM, "Christopher Peters" <cjpeters at uci.edu> wrote:
>>
>> >I will work on upgrading Java to 1.7 and possibly OpenSSL and see if
>> that
>> >fixes things.  We do have a rather old version of OpenSSL on the
>> system,
>> >and the related libraries. And, of course, an old version of Java.
>>
>> You're not using OpenSSL, that's not relevant.
>>
>> The bad cert error isn't the expiration, we're talking protocol level
>> issues here. OpenSSL's s_client doesn't care about the dates or the
>> validity, it's just trying to negotiate the connection.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Chris Peters
> Middleware Services Developer
> Office of Information Technology - NSP
> (949) 824-6845
> cjpeters at uci.edu
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://shibboleth.net/pipermail/users/attachments/20130729/0cde655e/attachment-0001.html
>
> ------------------------------
>
> Message: 3
> Date: Mon, 29 Jul 2013 16:16:17 -0800
> From: David Bantz <dabantz at alaska.edu>
> Subject: login.config to use private-CA-issued certificate
> To: Shib Users <users at shibboleth.net>
> Message-ID: <68074014-A087-44EA-A706-2A7091804436 at Alaska.edu>
> Content-Type: text/plain; charset="windows-1252"
>
>
> With the following in login.config to use and trust a private-CA
> certificate:
>
> // UA AD Auth
>    edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
> //    ldapUrl="ldap://fbk-adua01.ua.ad.alaska.edu:3269
>       ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3269"
>       baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
>       bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
>       bindCredential="??????????"
>       subtreeSearch="true"
> // Directly reference imported server certificate
>       sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem}"
>       ssl="true"
>       tls="false"
>       userField="sAMAccountName,uaIdentifier";
>
> Logs indicate the certificate file is loaded during authN:
>
> 15:44:59.767 - DEBUG
> [edu.vt.middleware.ldap.ssl.X509CertificatesCredentialReader:76] -
> Successfully loaded
> file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem
> 15:44:59.768 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83] -
> Created authenticator:
> edu.vt.middleware.ldap.auth.AuthenticatorConfig at 559102764::env={java.naming.provider.url=ldap://fbk-adua02.ua.ad.alaska.edu:3269,
> java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> java.naming.security.protocol=ssl,
> java.naming.ldap.factory.socket=edu.vt.middleware.ldap.ssl.TLSSocketFactory}
> 15:44:59.768 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] -
> Looking up DN using userField
> 15:44:59.769 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] -
> Search with the following parameters:
> 15:44:59.769 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] -
>  dn = dc=ua,dc=ad,dc=alaska,dc=edu
> 15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] -
>  filter = (|(sAMAccountName={0})(uaIdentifier={0}))
> 15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] -
>  filterArgs = [dabantz]
> 15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] -
>  searchControls = javax.naming.directory.SearchControls at 5f51d6cb
> 15:44:59.771 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] -
>  handler =
> [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 75ecda50]
>
> but the bind fails with "unable to find valid certification path to
> requested target:"
>
> 15:44:59.771 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with
> the following parameters:
> 15:44:59.772 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype
> = simple
> 15:44:59.772 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn =
> cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu
> 15:44:59.772 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -
> credential = <suppressed>
> 15:45:00.361 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error
> connecting to LDAP URL: ldap://fbk-adua02.ua.ad.alaska.edu:3269
> javax.naming.CommunicationException: simple bind failed:
> fbk-adua02.ua.ad.alaska.edu:3269
> ?
> Caused by: javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target
> ?
> Caused by: sun.security.validator.ValidatorException: PKIX path building
> failed: sun.security.provider.certpath.SunCertPathBuilderException: unable
> to find valid certification path to requested target
> ?
> Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
> unable to find valid certification path to requested target
>
> What are the possible sources of this failure other than having been
> provided the wrong certificate for the server?   Do I ALSO need to import
> the issuing CA certificate?  Use a different certificate file format? ?
>
> Thanks in advance,
>
> David Bantz
> U Alaska
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://shibboleth.net/pipermail/users/attachments/20130729/63575ada/attachment-0001.html
>
> ------------------------------
>
> Message: 4
> Date: Tue, 30 Jul 2013 01:18:56 +0000
> From: Brian Tingle <Brian.Tingle at ucop.edu>
> Subject: skipping unmapped SAML 2.0 Attribute with Name:
> 	urn:oid:0.9.2342.19200300.100.1.3
> To: "users at shibboleth.net" <users at shibboleth.net>
> Message-ID:
> 	<0170B8307BF9CC47A76E79DEB6E1F210187C4F02 at p-irc-exmbx02.AD.UCOP.EDU>
> Content-Type: text/plain; charset="us-ascii"
>
> I was using the shibboleth-sp-2.4.3 package from pkgsrc on my first app.
>
> I see 2.4.3 is no longer secure, so I've set up my second app using SP
> 2.5.2.
>
> As far as I can tell, my new app and my old app have equivalent
> configurations.  I had to add in some attributes to shibboleth2.xml for
> 2.5.2 to get rid of some warnings form shibd -t, but everything else is
> the same except for the entityId as far as I can tell.
>
> On my first app (2.4.3) I'm able to get both the attributes I want.
>
> On my second app (2.5.2) I'm only able to get one of the attributes I
> want.
>
> My IdP is sending equivalent SAML that includes both the attributes I
> want.
>
> The second app on 2.5.2 says this in the logs
>
> skipping unmapped SAML 2.0 Attribute with Name:
> urn:oid:0.9.2342.19200300.100.1.3
>
> The first app using 2.4.3 gives me this
>
> decoding SimpleAttribute (mail) from SAML 2 Attribute
> (urn:oid:0.9.2342.19200300.100.1.3) with 1 value(s)
>
> I'm also only seeing these in the second app's logs
> unable to extract attributes, unknown XML object type: saml2p:Response
> unable to extract attributes, unknown XML object type:
> saml2:AuthnStatement
>
> This gist shows more of the debug log around these messages with the new
> and the old SP
> https://gist.github.com/tingletech/6109136
>
> Does anyone have any thoughts or suggestions on this issue?  I'm stumped.
>
> Thanks -- Brian
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://shibboleth.net/pipermail/users/attachments/20130730/748626cb/attachment.html
>
> ------------------------------
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> End of users Digest, Vol 25, Issue 130
> **************************************
>