REMOTE_USER and LDAP issues with IdP 3

[Mark Cairney]

Hi Scott,

That sounds reasonable and the tomcat config is about the only thing I
hadn't checked.

I've checked it and I've currently got this in my server.xml:

"    <Connector port="8009"
                protocol="AJP/1.3"
                URIEncoding="UTF-8"
                enableLookups="false"
                redirectPort="8443"
                address="127.0.0.1"
                request.tomcatAuthentication="false"
                minSpareThreads="10"
                maxSpareThreads="25"
                maxThreads="300"
                maxPostSize="100000"
         />

"

This matches what I've had on my Shib 2 IdPs for years. However I'm now
running Tomcat 8 so had a look at a server I'd set up with Apache +
Cosign in front of Tomcat more recently and it only had
'tomcatAuthentication="false" '. I removed the request part and
restarted Tomcat and some success!

20160304T151101Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_4a776837ef4b20c1291d92002acce18f|https://test.ukfederation.org.uk/entity|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp3-test.is.ed.ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_e9acb6f2569b2846ebdf45f7abe62f0a|mcairney|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|eduPersonScopedAffiliation|AAdzZWNyZXQxOIrKCKwnXvdPIUUfcK0qw4C5EFH1sHtKoPjTbKK9FRC7mdFsjn4LhsedVlnj9d8Ac8J4xs8E4ln/aphzOWEA8qsuGeaJ/hkljiasCUyxFEWy5E2Yt7qlXPIDGtS8k8p+khYTeFkubTDnq78dyw==|_355980b0bda89873d0664b3a64de64c6

Obviously a bit of work required w.r.t. attribute resolving and release
policies but it's a start!

Thanks for the nod in the right direction, definitely a case of not
seeing the wood for the trees...

On 04/03/16 14:34, Cantor, Scott wrote:
>> My Apache config looks fine in that it matches a working v2 config and
>> REMOTE_USER is being set:
> 
> Setting it in Apache isn't relevant, though, as you probably know. It's obviously not set in the container. Being ajp, that implies Tomcat, so I guess you didn't set tomcatAuthentication to false in the connector.
> 
>> 2. I can see no evidence of any attempt to query LDAP for the user on
>> either the Shib side or in the LDAP server logs.
> 
> I wouldn't expect there would be.
> 
> -- Scott
> 

-- 
/****************************

Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk
PGP: 0x435A9621

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20160304/cb4f0f1a/attachment.sig>