IDPv3 and ECP

[Edwards, Wendy A]

Thanks, Scott.

At this point, I’m just trying to get my IDP v 3 to work successfully with
the scripts at http://www.cilogon.org/ecp (testecp.sh and ecp.pl) so I’m
not trying to implement a client.  So far, I’ve verified that Kerberos
endpoint protection is working with my Apache server and have something
like this in my Apache auth_kerb.conf file to protect the endpoint:

<Location /idp/profile/SAML2/SOAP/ECP>
  AuthType Kerberos
  AuthName "SAML2 ECP"
  KrbDelegateBasic on
  require valid-user
</Location>


In idp.properties, I set the authentication flow to be RemoteUserInternal:

idp.authn.flows=RemoteUserInternal


It sounds like implementing ECP in IDP v3 is supposed to be simpler than
in IDP v2, but I’m a little confused about what specific steps need to be
taken.  Is there something I missed?


On 4/9/15, 4:42 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 4/9/15, 5:35 PM, "Edwards, Wendy A" <wedwards at illinois.edu> wrote:
>
>>Thanks so much, Scott.  I got web-based Kerberos authentication set up
>>and
>>successfully protecting a sample endpoint.  To use the
>>RemoteUserInternalAuthnConfiguration, I set
>>idp.authn.flows=RemoteUserInternal in idp.properties.  When I try to pull
>>up https://myhost.edu/idp/profile/SAML2/SOAP/ECP, I get the error message
>>below:
>
>If you go directly to that URL, that's not going to do anything, that's a
>SOAP message endpoint. I would imagine the IdP log will say something
>about it. If the ECP client produces that result, then you'd have to
>check the log regardless.
>
>Your ECP client code is going to have to understand how to do SPNEGO of
>course, if that's what you plan to do.
>
>
>>I¹m using Apache Tomcat 8.0.20 and I have the SOAP endpoints configured
>>in
>>server.xml per 
>>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepa
>>re
>
>That isn't the same kind of endpoint. ECP is a front-channel thing. In
>theory you can use it on either port, and there might be reasons to do it
>on 8443, but in practice it's assumed the front channel is used mostly.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net