X.509 authentication
Шубарев Андрей Евгеньевич
ashubarev at nucrf.ru
Mon Sep 2 03:53:20 EDT 2013
Hello.
I'am trying to configure X.509 authentication by using this description - https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Handler <https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Handler>
And it didn`t works! I can`t find mistakes in my configurations.
My environment for testing X.509:
- Hostname idp.saml2.local
- IDP 2.3.8 port 8443
- Apache 2.2
Parts of IDP configuration:
---------------------------------------
attribute-resolver.xml
<resolver:AttributeResolver xmlns:resolver="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:pc="urn:mace:shibboleth:2.0:resolver:pc" xmlns:ad="urn:mace:shibboleth:2.0:resolver:ad"
xmlns:dc="urn:mace:shibboleth:2.0:resolver:dc" xmlns:enc="urn:mace:shibboleth:2.0:attribute:encoder"
xmlns:sec="urn:mace:shibboleth:2.0:security"
xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver classpath:/schema/shibboleth-2.0-attribute-resolver.xsd
urn:mace:shibboleth:2.0:resolver:pc classpath:/schema/shibboleth-2.0-attribute-resolver-pc.xsd
urn:mace:shibboleth:2.0:resolver:ad classpath:/schema/shibboleth-2.0-attribute-resolver-ad.xsd
urn:mace:shibboleth:2.0:resolver:dc classpath:/schema/shibboleth-2.0-attribute-resolver-dc.xsd
urn:mace:shibboleth:2.0:attribute:encoder classpath:/schema/shibboleth-2.0-attribute-encoder.xsd
urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd">
<resolver:AttributeDefinition xsi:type="Script"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
dependencyOnly="true"
id="x500Principal">
<Script><![CDATA[
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
importPackage(Packages.javax.security.auth.x500);
x500Principal = new BasicAttribute("x500Principal");
subject = requestContext.getUserSession().getSubject();
if (subject != null) {
x500Principal.getValues().addAll(subject.getPrincipals(X500Principal("").getClass()));
}
]]></Script>
</resolver:AttributeDefinition>
<!-- Provides the subjectAltNames of type rfc822Name from the certificate as attribute -->
<resolver:AttributeDefinition xsi:type="Script"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
dependencyOnly="true"
id="x500SubjectAltNameEMailPrincipal">
<Script><![CDATA[
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
importPackage(Packages.ch.SWITCH.aai.idp.x509.principals);
x500SubjectAltNameEMailPrincipal = new BasicAttribute("x500SubjectAltNameEMailPrincipal");
subject = requestContext.getUserSession().getSubject();
if (subject != null) {
x500SubjectAltNameEMailPrincipal.getValues().addAll(subject.getPrincipals(EMailPrincipal("").getClass()));
}
]]></Script>
</resolver:AttributeDefinition>
------------------------------------------
handler.xml
<ph:ProfileHandlerGroup xmlns:ph="urn:mace:shibboleth:2.0:idp:profile-handler" xmlns:x509="http://www.switch.ch/aai/idp/x509"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:idp:profile-handler
classpath:/schema/shibboleth-2.0-idp-profile-handler.xsd
http://www.switch.ch/aai/idp/x509 classpath:/schema/x509-login-handler.xsd">
<ph:LoginHandler xsi:type="x509:X509"
loginPageURL="https://idp.saml2.local:8443/idp/x509-login.jsp"
authenticationServletURL="https://idp.saml2.local:8443/idp/Authn/X509/Login">
<ph:AuthenticationMethod>
urn:oasis:names:tc:SAML:2.0:ac:classes:X509
</ph:AuthenticationMethod>
</ph:LoginHandler>
-----------------------------
x509-login.jsp
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Login</title>
</head>
<body onload="document.loginform.submit.focus()">
<form id="loginform" action="https://idp.saml2.local:8443/idp/Authn/X509/Login" method="post">
<h1> Login </h1>
<table>
<tr>
<td>
Please make sure that your user certificate is properly
configured in your web browser and click on the <strong>Certificate Login </strong> button.
</td>
</tr>
<tr>
<td>
<input name="submit" type="submit" tabindex="1" accesskey="l"/>
</td>
</tr>
</table>
<p>
<input type="checkbox" name="x509-pass-through" value="true" tabindex="2"/>
Do not show this page for future logins
</p>
</form>
</body>
</html>
-----------------------------------------------------------------
http.conf
<VirtualHost *:443>
ServerName idp.saml2.local
DocumentRoot C:/opt/apache22/htdocs
ErrorLog C:/opt/apache22/logs/error_ssl.log
CustomLog C:/opt/apache22/logs/access_ssl.log combined
SSLEngine on
SSLCertificateFile "C:/opt/apache22/conf/server.crt"
SSLCertificateKeyFile "C:/opt/apache22/conf/server.key"
<Location /idp/Authn/X509/Login>
SSLVerifyClient require
SSLVerifyDepth 5
SSLOptions -StdEnvVars +ExportCertData
SSLRequire ( %{SSL_CLIENT_S_DN_Email} =~ m/^.+ at nucrf\.ru$/ )
</Location>
</VirtualHost>
------------------------
Idp-process.log
02:21:19.211 - TRACE [ch.SWITCH.aai.idp.x509.X509LoginServlet:53] - servlet service
02:21:19.216 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:325] - LoginContext key cookie was not present in request
02:21:19.217 - DEBUG [edu.internet2.middleware.shibboleth.idp.ui.ServiceContactTag:177] - No relying party, nothing to display
Tomcat log:
SEVERE: Servlet.service() for servlet X509LoginServlet threw exception
java.lang.NullPointerException
at ch.SWITCH.aai.idp.x509.X509LoginServlet.service(X509LoginServlet.java:56)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
at java.lang.Thread.run(Unknown Source)
--
ashubarev at nucrf.ru
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130902/9d09c6fe/attachment-0001.html
More information about the users
mailing list