X.509 authentication
Douglas E. Engert
deengert at anl.gov
Tue Sep 3 14:14:44 EDT 2013
On 9/2/2013 2:53 AM, Шубарев Андрей Евгеньевич wrote:
> Hello.
>
> I’am trying to configure X.509 authentication by using this description - https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Handler
>
> And it didn`t works! I can`t find mistakes in my configurations.
You may also want to add to conf/logging.conf:
<!-- Logs X.509 LoginHandler messages -->
<logger name="ch.SWITCH.aai.idp.x509" level="DEBUG"/>
(or even TRACE or ALL)
>
> My environment for testing X.509:
>
> -Hostname idp.saml2.local
>
> -IDP 2.3.8 port 8443
>
> -Apache 2.2
>
> Parts of IDP configuration:
>
> ---------------------------------------
>
> attribute-resolver.xml
>
> <resolver:AttributeResolver xmlns:resolver="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>
> xmlns:pc="urn:mace:shibboleth:2.0:resolver:pc" xmlns:ad="urn:mace:shibboleth:2.0:resolver:ad"
>
> xmlns:dc="urn:mace:shibboleth:2.0:resolver:dc" xmlns:enc="urn:mace:shibboleth:2.0:attribute:encoder"
>
> xmlns:sec="urn:mace:shibboleth:2.0:security"
>
> xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver classpath:/schema/shibboleth-2.0-attribute-resolver.xsd
>
> urn:mace:shibboleth:2.0:resolver:pc classpath:/schema/shibboleth-2.0-attribute-resolver-pc.xsd
>
> urn:mace:shibboleth:2.0:resolver:ad classpath:/schema/shibboleth-2.0-attribute-resolver-ad.xsd
>
> urn:mace:shibboleth:2.0:resolver:dc classpath:/schema/shibboleth-2.0-attribute-resolver-dc.xsd
>
> urn:mace:shibboleth:2.0:attribute:encoder classpath:/schema/shibboleth-2.0-attribute-encoder.xsd
>
> urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd">
>
> <resolver:AttributeDefinition xsi:type="Script"
>
> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>
> dependencyOnly="true"
>
> id="x500Principal">
>
> <Script><![CDATA[
>
> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
>
> importPackage(Packages.javax.security.auth.x500);
>
> x500Principal = new BasicAttribute("x500Principal");
>
> subject = requestContext.getUserSession().getSubject();
>
> if (subject != null) {
>
> x500Principal.getValues().addAll(subject.getPrincipals(X500Principal("").getClass()));
>
> }
>
> ]]></Script>
>
> </resolver:AttributeDefinition>
>
> <!-- Provides the subjectAltNames of type rfc822Name from the certificate as attribute -->
>
> <resolver:AttributeDefinition xsi:type="Script"
>
> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>
> dependencyOnly="true"
>
> id="x500SubjectAltNameEMailPrincipal">
>
> <Script><![CDATA[
>
> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
>
> importPackage(Packages.ch.SWITCH.aai.idp.x509.principals);
>
> x500SubjectAltNameEMailPrincipal = new BasicAttribute("x500SubjectAltNameEMailPrincipal");
>
> subject = requestContext.getUserSession().getSubject();
>
> if (subject != null) {
>
> x500SubjectAltNameEMailPrincipal.getValues().addAll(subject.getPrincipals(EMailPrincipal("").getClass()));
>
> }
>
> ]]></Script>
>
> </resolver:AttributeDefinition>
>
> ------------------------------------------
>
> handler.xml
>
> <ph:ProfileHandlerGroup xmlns:ph="urn:mace:shibboleth:2.0:idp:profile-handler" xmlns:x509="http://www.switch.ch/aai/idp/x509"
>
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>
> xsi:schemaLocation="urn:mace:shibboleth:2.0:idp:profile-handler
>
> classpath:/schema/shibboleth-2.0-idp-profile-handler.xsd
>
> http://www.switch.ch/aai/idp/x509 classpath:/schema/x509-login-handler.xsd">
>
> <ph:LoginHandler xsi:type="x509:X509"
>
> loginPageURL="https://idp.saml2.local:8443/idp/x509-login.jsp"
Try without the :8443 The intent is to have appache at 443 do the SSL/TLS.
>
> authenticationServletURL="https://idp.saml2.local:8443/idp/Authn/X509/Login">
Try with authenticationServletURL="/Authn/X509/Login">
>
> <ph:AuthenticationMethod>
>
> urn:oasis:names:tc:SAML:2.0:ac:classes:X509
>
> </ph:AuthenticationMethod>
>
> </ph:LoginHandler>
>
> -----------------------------
>
> x509-login.jsp
>
> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
>
> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
>
> <head>
>
> <meta http-equiv="Content-Type" content="text/html; class="MsoNormal"> <title>Login</title>
>
> </head>
>
> <body onload="document.loginform.submit.focus()">
>
> <form id="loginform" action="https://idp.saml2.local:8443/idp/Authn/X509/Login" method="post">
>
> <h1> Login </h1>
>
> <table>
>
> <tr>
>
> <td>
>
> Please make sure that your user certificate is properly
>
> configured in your web browser and click on the <strong>Certificate Login </strong> button.
>
> </td>
>
> </tr>
>
> <tr>
>
> <td>
>
> <input name="submit" type="submit" tabindex="1" accesskey="l"/>
>
> </td>
>
> </tr>
>
> </table>
>
> <p>
>
> <input type="checkbox" name="x509-pass-through" value="true" tabindex="2"/>
>
> Do not show this page for future logins
>
> </p>
>
> </form>
>
> </body>
>
> </html>
>
> -----------------------------------------------------------------
>
> http.conf
>
> <VirtualHost *:443>
>
> ServerName idp.saml2.local
>
> DocumentRoot C:/opt/apache22/htdocs
>
> ErrorLog C:/opt/apache22/logs/error_ssl.log
>
> CustomLog C:/opt/apache22/logs/access_ssl.log combined
>
> SSLEngine on
>
> SSLCertificateFile "C:/opt/apache22/conf/server.crt"
>
> SSLCertificateKeyFile "C:/opt/apache22/conf/server.key"
>
> <Location /idp/Authn/X509/Login>
>
> SSLVerifyClient require
>
> SSLVerifyDepth 5
>
> SSLOptions -StdEnvVars +ExportCertData
>
> SSLRequire ( %{SSL_CLIENT_S_DN_Email} =~ m/^.+ at nucrf\.ru$/ )
As a test, comment out the SSLRequire.
The above says the subject DN has to have a component of email,
but the EMailPrincipal you appear to be looking for is in the subjectAltName,
extension in the certificate.
>
> </Location>
>
> </VirtualHost>
>
Where is the mod_proxy_ajp part of the apache conf?
Normally apache will do the SSL/TLS and pass on the certificate to the X509 login handler.
> ------------------------
>
> Idp-process.log
>
> 02:21:19.211 - TRACE [ch.SWITCH.aai.idp.x509.X509LoginServlet:53] - servlet service
>
> 02:21:19.216 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:325] - LoginContext key cookie was not present in request
>
> 02:21:19.217 - DEBUG [edu.internet2.middleware.shibboleth.idp.ui.ServiceContactTag:177] - No relying party, nothing to display
>
> Tomcat log:
>
> SEVERE: Servlet.service() for servlet X509LoginServlet threw exception
>
> java.lang.NullPointerException
>
> at ch.SWITCH.aai.idp.x509.X509LoginServlet.service(X509LoginServlet.java:56)
That is the init routine.
>
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
>
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
>
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>
> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
>
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
>
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>
> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81)
>
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
>
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>
> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
>
> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
>
> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>
> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
>
> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
>
> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
>
> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
>
> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
>
> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
>
> at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861)
>
> at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606)
>
> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
>
> at java.lang.Thread.run(Unknown Source)
>
> --
>
> ashubarev at nucrf.ru
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
--
Douglas E. Engert <DEEngert at anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
More information about the users
mailing list