Unable to get through the login page with default ECP settings

[Peter Schober]

* Gaur, Himanshu <Himanshu.Gaur at fisglobal.com> [2015-10-08 15:21]:
> 1} First, Once I am able to login successfully then how I can be
> able to access other Apps (URLs) without the authentication ; In
> short where to define Accessible Applications and restrict roles?

The IDP does not come with a "portal" or landing page, in fact you
can't do anything "at" the IDP other than send it SAML protocol
messages. I.e., you can host something like that /anywhere/, esp on a
SAML2 Service Provider you host yourself and point subjects to.

> 2) When I am trying to access via ECP (https://xample.fissso.org/idp-web/profile/SAML2/SOAP/ECP)  then after entering valid uid/pwd getting the below error
> :

Not sure that's related but the ECP support in the IDP only works if
the ECP client sends the HTTP Basic Auth header without being prompted
for it. I'm sure the documentation mentions that.

> 3) When I am trying to access via login (xample.fissso.org/idp-web/login) then its redirect me to the below url for consent:
> https://xample.fissso.org/idp-web/profile/SAML2/Redirect/SSO?execution=e2s1

What is xample.fissso.org/idp-web/login exactly?

> After accepting the consent redirected to "HTTP Status 404 -
> /idp-web/login" with blank page.URL

Well, if you deployed the IDP to the context /idp-web then that's the
reason -- there is nothing in the context at that specific URL.
Why are you accessing that and what are you expecting to see there?

> 4) Not sure if this is getting able to connect to ApacheDS to get
> authenticated because there is nothing in the DS logs when I am
> using below details in httpd.conf -
> <Location /idp-web/*>    AuthType shibboleth
>                    ShibRequestSetting requireSession 1
>                    ShibUseHeaders On
>                    require valid-user         </Location>

So you've installed a Shibboleth SP on the webserver proxying to the
Shibboleth IDP, and you're requiring a session before even allowing
access to the IDP? How should I get a session from that IDP then?

> But when I am explicitly setting the below values -
> <Location /idp-web/profile/SAML2/SOAP/ECP>  AuthName "LDAP FIS Test Login"
>                 AuthType Basic
>                 AuthBasicProvider ldap
> AuthLDAPURL ldap://ads.fissso.org:10389/ou=users,ou=system?*??(objectClass=*)
>                 AuthLDAPBindAuthoritative off
>                 LDAPReferrals Off
> require valid-user            </Location>

> I am able to get below the DS logs -
> [21:01:47] WARN
> [org.apache.directory.server.core.normalization.NormalizationInterceptor]
> - undefined filter based on undefined attributeType not evaluted at
> all.  Returning empty enumeration.
> This seems to be because of * at the place of uid in the given LDAP
> URL; not sure how to overcome with this problem.

Debugging your LDAP server is not something for this list, given the
other problems that exist in your deployment.

> idp.authn.LDAP.bindDN   = uid=321
> idp.authn.LDAP.bindDNCredential   = test#ldap

Ouch.

-peter