Adding Shibboleth to CAS

[Stein, Eric]

I set up my IdP as detailed here: https://github.com/Unicon/shib-cas-authenticator#readme

When I try to test against TestShib, I'm seeing a FatalProfileException. 
idp-process.log
07:27:11.749 - ERROR [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:618] - No user identified by login handler.
07:27:11.764 - ERROR [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:563] - Authentication failed with the error:
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException: No user identified by login handler.
	at edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.validateSuccessfulAuthentication(AuthenticationEngine.java:619) [shibboleth-identityprovider-2.3.8.jar:na]
	at edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.completeAuthentication(AuthenticationEngine.java:537) [shibboleth-identityprovider-2.3.8.jar:na]
	at edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.service(AuthenticationEngine.java:225) [shibboleth-identityprovider-2.3.8.jar:na]
[...]


Does anybody know what might be causing this? I can provide any configuration files, but I didn't want to spam with everything and I don't know what's important.

Thanks,
Eric

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, March 01, 2013 3:39 PM
To: Shib Users
Subject: Re: Adding Shibboleth to CAS

On 3/1/13 3:31 PM, "Stein, Eric" <steine at locustec.com> wrote:

>Okay, so I'm playing around with what I think is the third option - 
>using shib-cas-authenticator.

No, I don't believe that would be what I had third.

> As I understand it, I can protect applications using shibboleth2.xml.
>Users trying to access a protected application should be redirected to 
>CAS for authentication. Users who are already authenticated in my 
>federation will not have to reauthenticate and will be allowed to hit 
>the protected application.

That would be what I had as option 2, essentially running the SP instead of CAS, making your CAS system act as the authenticator for an IdP for your users, and then having the customer act as a second IdP option.

>I'll eventually be fronting Tomcat with HTTPD, but right now I'm just 
>running Tomcat. Where do I put the shibboleth2.xml file? Or do I need 
>to get Apache set up first?

The latter. The SP is not in Java, it requires Apache, IIS, or FastCGI (or Sun Java Server/Netscape/SunOne/WhoCaresNobodyUsesItAnymore).

What's behind those options can be anything.

If you would like a pure Java option to do the SAML, you would have to explore other solutions (but the SAML/CAS hand off could still be done in the manner you were evaluating).

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net