IDPv3 and ECP

[Cantor, Scott]

On 4/9/15, 5:35 PM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:

>Thanks so much, Scott.  I got web-based Kerberos authentication set up and
>successfully protecting a sample endpoint.  To use the
>RemoteUserInternalAuthnConfiguration, I set
>idp.authn.flows=RemoteUserInternal in idp.properties.  When I try to pull
>up https://myhost.edu/idp/profile/SAML2/SOAP/ECP, I get the error message
>below:

If you go directly to that URL, that's not going to do anything, that's a SOAP message endpoint. I would imagine the IdP log will say something about it. If the ECP client produces that result, then you'd have to check the log regardless.

Your ECP client code is going to have to understand how to do SPNEGO of course, if that's what you plan to do.


>I¹m using Apache Tomcat 8.0.20 and I have the SOAP endpoints configured in
>server.xml per 
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare

That isn't the same kind of endpoint. ECP is a front-channel thing. In theory you can use it on either port, and there might be reasons to do it on 8443, but in practice it's assumed the front channel is used mostly.

-- Scott