shibidp ECP extension configuration: REMOTE_USER not set [SOLVED]

[Mauro Minella]

Hi,

I finally made it work. The last trick before compiling is to prevent Shibboleth from sending the Transient NameID by removing or commenting the following lines out in attribute-filter.xml:



        <afp:AttributeRule attributeID="transientId">

            <afp:PermitValueRule xsi:type="basic:ANY"/>

        </afp:AttributeRule>



To recap, in order to implement ACTIVE authentication, you should:

- Install the Shibboleth ECP Extension (already included in Shibboelth 2.3.3 or later)

- Enable HTTP Basic authentication in Tomcat

- Provide the ECP entry point on the SP side

- Add SAML2 ECP Profile entry to the Windows Azure AD Relying Party

- Enable ECP extension in WEB.XML

- Update certificate name in BUILD.XML

- Block Shibboleth from sending the Transient NameID

- Restart Apache Tomcat service



To whom it may concern, I collected the results in this playlist http://www.youtube.com/playlist?list=PLzp167WWyvMLpvQeNeurJzbF6yPOeadOS&feature=em-share_playlist_user which includes 6 videos showing how to implement Office 365 federation with Shibboleth, end-to-end.



Mauro

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130507/ca65a34c/attachment.html