IDPv3 and ECP

[Edwards, Wendy A]

Hi, I was trying to get ECP working with Shibboleth IDPv3 and wanted to see if I was correct about the basic idea.  Ultimately, I’d like to use Kerberos authentication, which should be supported via the Apache web server as well as Tomcat.

First, set up the endpoint /profile/SAML2/SOAP/ECP in the web.xml file, maybe like this:

  <security-constraint>
      <display-name>Shibboleth IdP</display-name>
      <web-resource-collection>
          <web-resource-name>ECP</web-resource-name>
          <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern>
          <http-method>GET</http-method>
          <http-method>POST</http-method>
      </web-resource-collection>
      <auth-constraint>
          <role-name>*</role-name>
      </auth-constraint>
      <user-data-constraint>
          <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint>
  </security-constraint>
  <login-config>
      <auth-method>BASIC</auth-method>
  </login-config>

Similar to the example at https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP except we won’t be hitting an LDAP server

Protect the endpoint in the Apache httpd configuration, sort of like:

<Location /idp/profile/SAML2/SOAP/ECP>
AuthType Kerberos
AuthName "ECP Shibboleth Identity Provider - ECP profile"
  KrbMethodNegotiate on
  KrbMethodK5Passwd off
  KrbAuthRealms ourrealm.edu
  Krb5Keytab "/path/to/krb5.keytab"
        AuthName "ECP Shibboleth Identity Provider - ECP profile"
        Require valid-user
</Location>

We want Apache to use Kerberos authentication and to allow any valid user in.

Assuming we get the "REMOTE_USER" successfully set, use the RemoteUserInternalAuthn configuration defined in IDP v3.  See
https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserInternalAuthnConfiguration

Is this the right idea?

Thanks,
Wendy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150407/b9f64c9d/attachment.html