IDPv3 and ECP

[Edwards, Wendy A]

Thanks so much, Scott.  I got web-based Kerberos authentication set up and
successfully protecting a sample endpoint.  To use the
RemoteUserInternalAuthnConfiguration, I set
idp.authn.flows=RemoteUserInternal in idp.properties.  When I try to pull
up https://myhost.edu/idp/profile/SAML2/SOAP/ECP, I get the error message
below:

<soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/">
<soap11:Body>
<soap11:Fault>
<faultcode>soap11:Client</faultcode>
<faultstring>An error occurred.</faultstring>
</soap11:Fault>
</soap11:Body>
</soap11:Envelope>

I¹m using Apache Tomcat 8.0.20 and I have the SOAP endpoints configured in
server.xml per 
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare
 .  Is there anything obvious I¹m missing?

Thanks,
Wendy





On 4/7/15, 3:58 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 4/7/15, 4:09 PM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:
>
>>Hi, I was trying to get ECP working with Shibboleth IDPv3 and wanted to
>>see if I was correct about the basic idea.  Ultimately, I¹d like to use
>>Kerberos authentication, which should be supported via the Apache web
>>server as well as Tomcat.
>
>Ok, that creates additional requirements. The "new" support for ECP was
>for handling basic-auth better so that you could skip all the web server
>parts, but you can't do that with Kerberos.
>
>>First, set up the endpoint /profile/SAML2/SOAP/ECP in the web.xml file,
>>maybe like this:
>
>You can, but that wouldn't apply to the Kerberos case, and it isn't
>necessary for the basic-auth case other than to remain compatible with
>how V2 operated.
>
>>Protect the endpoint in the Apache httpd configuration, sort of like:
>
>That's instead of doing basic-auth, but yes.
>
>>Assuming we get the "REMOTE_USER" successfully set, use the
>>RemoteUserInternalAuthn configuration defined in IDP v3.  See
>>https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserInternalAu
>>thnConfiguration
>
>Yes, that would be the simplest way to do it if Apache is handling things.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net