X.509 Authentication using Tomcat

Thu Feb 20 15:41:48 EST 2014

Actually this is the place that causes the exception.  The complete 
handler.xml file is attached.  Thanks!

ND

----------- handler.xml -----------------
<?xml version="1.0" encoding="UTF-8"?>

<ph:ProfileHandlerGroup 
xmlns:ph="urn:mace:shibboleth:2.0:idp:profile-handler"
			xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
			xmlns:x509="http://www.switch.ch/aai/idp/x509"

xsi:schemaLocation="urn:mace:shibboleth:2.0:idp:profile-handler

classpath:/schema/shibboleth-2.0-idp-profile-handler.xsd
                            http://www.switch.ch/aai/idp/x509 
classpath:/schema/x509-login-handler.xsd">

<!--xsi:schemaLocation="urn:mace:shibboleth:2.0:idp:profile-handler 
classpath:/schema/shibboleth-2.0-idp-profile-handler.xsd"-->
     <!-- Error Handler -->
     <ph:ErrorHandler xsi:type="ph:JSPErrorHandler" 
jspPagePath="/error.jsp"/>

     <!-- Profile Handlers -->
     <!--
         All profile handlers defined below are accessed via the Servlet 
path "/profile" so if your profile
         handler's request path is "/Status" then the full path is 
"<servletContextName>/profile/Status"
      -->
     <ph:ProfileHandler xsi:type="ph:Status">
         <ph:RequestPath>/Status</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAMLMetadata" 
metadataFile="/opt/shibboleth-idp-x509/metadata/idp-metadata.xml">
         <ph:RequestPath>/Metadata/SAML</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:ShibbolethSSO" 
inboundBinding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:1.0:profiles:browser-post

urn:oasis:names:tc:SAML:1.0:profiles:artifact-01">
         <ph:RequestPath>/Shibboleth/SSO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML1AttributeQuery" 
inboundBinding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding">
         <ph:RequestPath>/SAML1/SOAP/AttributeQuery</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML1ArtifactResolution" 
inboundBinding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding">
         <ph:RequestPath>/SAML1/SOAP/ArtifactResolution</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SSO" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
         <ph:RequestPath>/SAML2/POST/SSO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SSO" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
         <ph:RequestPath>/SAML2/POST-SimpleSign/SSO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SSO" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
         <ph:RequestPath>/SAML2/Redirect/SSO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SSO" 
inboundBinding="urn:mace:shibboleth:2.0:profiles:AuthnRequest"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
         <ph:RequestPath>/SAML2/Unsolicited/SSO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2ECP" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
         <ph:RequestPath>/SAML2/SOAP/ECP</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SLO" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
         <ph:RequestPath>/SAML2/Redirect/SLO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SLO" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
         <ph:RequestPath>/SAML2/POST/SLO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SLO" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact">
         <ph:RequestPath>/SAML2/POST-SimpleSign/SLO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SLO" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
         <ph:RequestPath>/SAML2/SOAP/SLO</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2SLO" 
inboundBinding="urn:mace:shibboleth:2.0:profiles:LocalLogout">
         <ph:RequestPath>/Logout</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2AttributeQuery" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
         <ph:RequestPath>/SAML2/SOAP/AttributeQuery</ph:RequestPath>
     </ph:ProfileHandler>

     <ph:ProfileHandler xsi:type="ph:SAML2ArtifactResolution" 
inboundBinding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"

outboundBindingEnumeration="urn:oasis:names:tc:SAML:2.0:bindings:SOAP">
         <ph:RequestPath>/SAML2/SOAP/ArtifactResolution</ph:RequestPath>
     </ph:ProfileHandler>

     <!-- Login Handlers -->
     <ph:LoginHandler xsi:type="ph:RemoteUser">

<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
     </ph:LoginHandler>

     <!--
         Removal of this login handler will disable SSO support, that is 
it will require the user to authenticate
         on every request.
     -->
     <ph:LoginHandler xsi:type="ph:PreviousSession">

<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</ph:AuthenticationMethod>
     </ph:LoginHandler>

     <!-- X509 Login Handler -->
     <!-- configuration attributes: -->
     <!-- loginPageURL (required): URL of JSP page with login form -->
     <!-- authenticationServletURL (required): Client AuthN protected 
page -->
     <!-- cookieDomain (optional): set domain of login context cookie 
for -->
     <!--     spefic environments, e.g. if authenticationServlet runs 
under -->
     <!--     a different domain name than the IdP -->
     <LoginHandler xsi:type="x509:X509"
                   loginPageURL="/x509-login"
                   authenticationServletURL="/Authn/X509/Login">
         <AuthenticationMethod>
             urn:oasis:names:tc:SAML:2.0:ac:classes:X509
         </AuthenticationMethod>
     </LoginHandler>

</ph:ProfileHandlerGroup>

On 2014-02-20 13:06, Mike Wiseman wrote:
> Sounds like you didn't install the X509 login handler handler.xml
> config. Something like this:
> 
>     <ph:LoginHandler xsi:type="x509:X509"
>                   loginPageURL="/x509-login.jsp"
>                   authenticationServletURL="/Authn/X509/Login">
>         <ph:AuthenticationMethod>
>             urn:oasis:names:tc:SAML:2.0:ac:classes:X509
>         </ph:AuthenticationMethod>
>     </ph:LoginHandler>
> 
> 
> Mike
> 
>> -----Original Message-----
>> From: users-bounces at shibboleth.net 
>> [mailto:users-bounces at shibboleth.net] On Behalf
>> Of nduan at dtechspace.com
>> Sent: February-20-14 2:56 PM
>> To: Shib Users
>> Subject: Re: X.509 Authentication using Tomcat
>> 
>> Thanks Scott.  I would hope that this package can work out of the box 
>> to support X509 on
>> Tomcat, but it didn't work with the latest Shibboleth IdP 2.4.0.  
>> This is what I did:
>> 
>> 1. Followed the instructions on the wiki page to download the 
>> x509-login-handler source
>> from forge.switch.ch.
>> 2. Built the x509-login-handler package using JDK 1.6 (had to specify 
>> the servlet-api
>> dependency in pom.xml file) 3. Modified the configuration files 
>> according to the instructions
>> on wiki page (disabled the LDAP connector part so just to test the 
>> authentication part) and
>> generated the deployment idp.
>> 4. Configure the tomcat server to enable 2-way SSL 5. Start the 
>> tomcat IdP 6. IdP failed on
>> startup.  Got an error message below.
>> 
>> Apparently there was some configuration steps missing. Not sure if 
>> the existing config
>> instructions of X509 handler is applicable for idp 2.4.0.  Any hints 
>> would be very helpful.  I
>> didn't run a syntax check on the handler.xml file and there was no 
>> XML validation error.
>> 
>> Thanks!
>> 
>> ND
>> ------------ Error Message --------------------- DEBUG
>> [edu.internet2.middleware.shibboleth.common.config.BaseReloadableService:136]
>> - Initializing shibboleth.HandlerManager service with resources:
>> [/opt/shibboleth-idp-x509/conf/handler.xml]
>> 14:40:56.345 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:158] - 
>> Loading new
>> configuration for service shibboleth.HandlerManager
>> 14:40:56.360 - ERROR
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - 
>> Configuration
>> was not loaded for shibboleth.HandlerManager service, error creating 
>> components.  The
>> root cause of this error was:
>> org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid 
>> content was found starting
>> with element 'LoginHandler'. One of 
>> '{"urn:mace:shibboleth:2.0:idp:profile-
>> handler":LoginHandler}' is expected.
>> 
>> On 2014-02-20 10:46, Cantor, Scott wrote:
>>> On 2/20/14, 12:43 PM, "nduan at dtechspace.com" <nduan at dtechspace.com>
>>> wrote:
>>> 
>>>> Apparently the X509 Login Handler
>>>> (https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Han
>>>> dler) was written for using Apache Httpd as the front end of the
>>>> Shibboleth Java IdP.  Could someone provide any insight on how to
>>>> make X509 authentication to work directly with Tomcat without the
>>>> Httpd?
>>> I see no evidence any of that is true based on a very short look. 
>>> The
>>> servlet pulls from the standard Java attribute populated with a TLS
>>> client credential. Apache's got nothing to do with it.
>>> -- Scott
>>> 
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>> 
>> --
>> To unsubscribe from this list send an email to 
>> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net