REMOTE_USER and LDAP issues with IdP 3

[Mark Cairney]

Hi,

I'm struggling to get RemoteUser authentication working with Shib V3.
I've looked at the docs
"https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserAuthnConfiguration"
and reading the thread
http://shibboleth.1660669.n2.nabble.com/How-to-Authn-RemoteUser-with-IdP-3-0-td7615111.html
I'm none the wiser.

Our SSO solution is Cosign so this requires proxying Tomcat behind
Apache and using mod_cosign for the user authentication and to populate
the REMOTE_USER variable.


In my idp.properties I've set
idp.authn.flows= RemoteUser

and can confirm that #idp.authn.flows.initial is commented out and that
there is no trailing whitespace after the value.

My Apache config looks fine in that it matches a working v2 config and
REMOTE_USER is being set:

ProxyPass /idp/ ajp://localhost:8009/idp/
<Location /idp/Authn/RemoteUser>
    CosignProtected on
</Location>
<Location /idp/profile/SAML2/Redirect/SSO>
    CosignProtected on
</Location>
<Location /idp/profile/SAML2/SOAP/ECP>
    CosignProtected On
</Location>

And from the Apache logs I can confirm the variable is being set:

129.215.201.136 - mcairney [04/Mar/2016:11:15:10 +0000] "GET
/idp/Authn/RemoteUser?conversation=e1s1 HTTP/1.1" 302 -
"https://www-test.ease.ed.ac.uk/cosign.cgi" "Mozilla/5.0 (X11; Linux
x86_64; rv:38.0) Gecko/20100101 Firefox/38.0"

I've attached my idp-process.log but 2 things stand out to me:

1. The IdP claims to not have a user identity in the request.

"2016-03-04 11:15:10,600 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticat
ionFlow:292] - Profile Action SelectAuthenticationFlow: No usable active
results
 available, selecting an inactive flow
2016-03-04 11:15:10,600 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticat
ionFlow:334] - Profile Action SelectAuthenticationFlow: Selecting
inactive authe
ntication flow authn/RemoteUser
2016-03-04 11:15:10,978 - INFO
[net.shibboleth.idp.authn.impl.RemoteUserAuthServ
let:257] - User identity not found in request
2016-03-04 11:15:11,039 - INFO
[net.shibboleth.idp.authn.impl.ValidateExternalAu
thentication:121] - Profile Action ValidateExternalAuthentication:
External auth
entication failed, no user identity or error information returned
"

2. I can see no evidence of any attempt to query LDAP for the user on
either the Shib side or in the LDAP server logs.

Has anyone got this working and see where I'm going wrong?

Kind regards,

Mark

-- 
/****************************

Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk
PGP: 0x435A9621

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: idp-process.log
Type: text/x-log
Size: 27048 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20160304/235e6f59/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20160304/235e6f59/attachment-0001.sig>