IDPv3 and ECP

[John Dennis]

My suggestion would be to avoid kerberos until you have basic or digest
auth in Jetty. Don't even try performing an ECP transaction until you
know Jetty can authenticate the user, just use a simple HTTP client for
that.  If you have an ldap directory to authenticate to you might
consider using LDAP JAAS because not only will you be able to
authenticate the user from the IdP but you'll be able to return user
attributes, something you'll probably want to test as well. But for now
I'd just get basic auth working on Jetty, there are many tutorials on
how to do that and test it.

You also have to make sure your certs are set up and you've imported the
trusted CA's which will be use. This has to be done both on the IdP and
on the client.  For Jetty you'll need to edit /etc/jetty/keystore and
/etc/jetty/truststore where the certs and CA trust anchors are stored
respectively. I found the "keystore explorer" to be a great tool for
browsing and editing Java keystores.

The other thing I found useful was to modify the scripts to print out
what is being sent and received. I found it useful to pretty print xml
so I could read it easily. It's also useful to dump the HTTP headers to
verify they are properly set. I've attached the ECP shell script I've
been using, it's a modified version of the one on the Shibboleth site,
if you pass -d and -v you get full debugging dumps.

-- 
John
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ecp.sh
Type: application/x-shellscript
Size: 13144 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20150414/5caee1aa/attachment-0001.bin