X.509 authentication

[Douglas E. Engert]

On 9/9/2013 8:12 AM, Шубарев Андрей Евгеньевич wrote:
> I`am still trying to make X.509 authentication but it doesn`t work! Today continue reconfigure it.
>
> But can`t find mistakes…
>
> 07:40:49.322 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:85] - Successfully decoded message.
>
> 07:40:49.322 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:191] - Checking SAML message intended destination endpoint against receiver endpoint
>
> 07:40:49.322 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:210] - Intended message destination endpoint: https://idp.saml2.local:8443/idp/profile/SAML2/Redirect/SSO
>
> 07:40:49.322 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:211] - Actual message receiver endpoint: https://idp.saml2.local:8443/idp/profile/SAML2/Redirect/SSO
>
> 07:40:49.322 - DEBUG [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:219] - SAML message intended destination endpoint matched recipient endpoint
>
> 07:40:49.322 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID:
> https://idp.saml2.local:8443/idp/shibboleth
>
> 07:40:49.322 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] - Searching for entity descriptor with an entity ID of https://idp.saml2.local:8443/idp/shibboleth
>
> 07:40:49.322 - DEBUG [org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - Checking child metadata provider for entity descriptor with entity ID:
> https://idp.saml2.local:8443/idp/shibboleth
>
> 07:40:49.322 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] - Searching for entity descriptor with an entity ID of https://idp.saml2.local:8443/idp/shibboleth
>
> 07:40:49.337 - TRACE [ch.SWITCH.aai.idp.x509.X509LoginHandler:133] - 2 Cookie(s) are sent
>
> 07:40:49.337 - TRACE [ch.SWITCH.aai.idp.x509.X509LoginHandler:135] - Cookie name is JSESSIONID
>
> 07:40:49.337 - TRACE [ch.SWITCH.aai.idp.x509.X509LoginHandler:135] - Cookie name is _idp_authn_lc_key
>
> 07:40:49.337 - DEBUG [ch.SWITCH.aai.idp.x509.X509LoginHandler:69] - Cookie '_idp_login_X509_pass-through' is not set: continue with x509 login page.
>
> 07:40:49.337 - DEBUG [ch.SWITCH.aai.idp.x509.X509LoginHandler:101] - No URL configured in loginPageURL: /x509-login
>
> 07:40:49.337 - DEBUG [ch.SWITCH.aai.idp.x509.X509LoginHandler:74] - Redirect to https://idp.saml2.local:8443/idp/x509-login
>

In your previous note, there is a httpd.conf
that protects the:
   <Location /idp/Authn/X509/Login>
and requires the client to use a certificate:
  SSLVerifyClient require

But the Apache web server is only listening on port 443.
The X509 login handler is setup to have the Apache front end
do the client verify.

So why are you using port 8443 in the
https://idp.saml2.local:8443/idp/x509-login

Tomcat might be able to do the TLS with client certificates,
but the x509 login handler docs describe how ti use a
front end Apache web server.

See the other comments in the my note of 9/3.


>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444