X.509 Authentication using Tomcat

[Mike Wiseman]

Sounds like you didn't install the X509 login handler handler.xml config. Something like this:

    <ph:LoginHandler xsi:type="x509:X509"
                  loginPageURL="/x509-login.jsp"
                  authenticationServletURL="/Authn/X509/Login">
        <ph:AuthenticationMethod>
            urn:oasis:names:tc:SAML:2.0:ac:classes:X509
        </ph:AuthenticationMethod>
    </ph:LoginHandler> 


Mike

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf
> Of nduan at dtechspace.com
> Sent: February-20-14 2:56 PM
> To: Shib Users
> Subject: Re: X.509 Authentication using Tomcat
> 
> Thanks Scott.  I would hope that this package can work out of the box to support X509 on
> Tomcat, but it didn't work with the latest Shibboleth IdP 2.4.0.  This is what I did:
> 
> 1. Followed the instructions on the wiki page to download the x509-login-handler source
> from forge.switch.ch.
> 2. Built the x509-login-handler package using JDK 1.6 (had to specify the servlet-api
> dependency in pom.xml file) 3. Modified the configuration files according to the instructions
> on wiki page (disabled the LDAP connector part so just to test the authentication part) and
> generated the deployment idp.
> 4. Configure the tomcat server to enable 2-way SSL 5. Start the tomcat IdP 6. IdP failed on
> startup.  Got an error message below.
> 
> Apparently there was some configuration steps missing. Not sure if the existing config
> instructions of X509 handler is applicable for idp 2.4.0.  Any hints would be very helpful.  I
> didn't run a syntax check on the handler.xml file and there was no XML validation error.
> 
> Thanks!
> 
> ND
> ------------ Error Message --------------------- DEBUG
> [edu.internet2.middleware.shibboleth.common.config.BaseReloadableService:136]
> - Initializing shibboleth.HandlerManager service with resources:
> [/opt/shibboleth-idp-x509/conf/handler.xml]
> 14:40:56.345 - INFO
> [edu.internet2.middleware.shibboleth.common.config.BaseService:158] - Loading new
> configuration for service shibboleth.HandlerManager
> 14:40:56.360 - ERROR
> [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration
> was not loaded for shibboleth.HandlerManager service, error creating components.  The
> root cause of this error was:
> org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting
> with element 'LoginHandler'. One of '{"urn:mace:shibboleth:2.0:idp:profile-
> handler":LoginHandler}' is expected.
> 
> On 2014-02-20 10:46, Cantor, Scott wrote:
> > On 2/20/14, 12:43 PM, "nduan at dtechspace.com" <nduan at dtechspace.com>
> > wrote:
> >
> >> Apparently the X509 Login Handler
> >> (https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Han
> >> dler) was written for using Apache Httpd as the front end of the
> >> Shibboleth Java IdP.  Could someone provide any insight on how to
> >> make X509 authentication to work directly with Tomcat without the
> >> Httpd?
> > I see no evidence any of that is true based on a very short look. The
> > servlet pulls from the standard Java attribute populated with a TLS
> > client credential. Apache's got nothing to do with it.
> > -- Scott
> >
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net