Windows 10 and Kerberos

[Argenis Lopez]

I'm using shibboleth 2.4 to handle SSO for several of our intranet applications and it works fine. We are in the process of testing Windows 10 and after the same browser configurations we have for Windows 7 the SSO solution (Kerberos+ shibboleth) keeps prompting for windows authentication and even after entering my credentials it give unauthorized access.

The browser is the new windows browser (Edge), do I need to register new user agents some where in shibboleth or apache?. Any help will be appreciated.


Argenis


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Kirk Turner-Rustin
Sent: Tuesday, September 29, 2015 2:38 PM
To: Shib Users
Subject: Re: IdP v3: reload-service.sh

On Tue, 29 Sep 2015, Cantor, Scott wrote:

>> Container's access log registered an HTTP redirect (302) for my curl
>> attempt, i.e.:
>
> Then that's the problem. The IdP doesn't return that.

Just to put closure on this:

We have tomcat configured to force (redirect) connections to port 8443.
The reload-service.sh doesn't follow redirects (nor IMO should it need to), and the curl command line I unsuccessfully used didn't follow redirects either. So naturally I never got past the container's HTTP connector.

These commands worked just fine:

     Follow the redirect, ignoring SSL cert exchange requirements:

     # curl -kL \
        http://localhost/idp/profile/admin/reload-service?id=[serviceId]

     Don't futz with redirects but go directly to the service URL,
     respecting SSL cert requirements.

     # JAVA_HOME=/usr ./reload-service.sh -id [serviceId] \
        -ts /etc/pki/java/tomcat.keystore \
        -tp [keystore-password] \
        -u https://idp.owu.edu:8443

Thanks again to all.

Cheers,
Kirk

--
   Kirk Turner-Rustin SCJP  | Senior Systems Analyst
   Ohio Wesleyan University | Information Services
   http://www.owu.edu       | http://infoserv.owu.edu
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

FCCI Insurance Group
More than a policy. A promise.®
www.fcci-group.com<http://www.fcci-group.com>


FCCI Insurance Group companies: Brierfield Insurance Company, FCCI Advantage Insurance Company, FCCI Commercial Insurance Company, FCCI Insurance Company, Monroe Guaranty Insurance Company, and National Trust Insurance Company.


This communication, along with any documents, files or attachments, is intended only for the use of the addressee and may contain legally privileged and confidential information. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of any information contained in or attached to this communication is strictly prohibited. If you have received this message in error, please notify the sender immediately and destroy the original communication and its attachments without reading, printing or saving in any manner.