Need help: Remote user auth via httpd using mod_jk connector

[Satheesh Kumar]

Hi all,

         I am trying to do "Remote user authentication" via apache http
server(form based authentication)
         Below are my configs:

        1.  Apache config:
                  httpd.conf file:
                     added config for mod_jk:
                        <IfModule jk_module>
JkWorkersFile conf/workers.properties
JkShmFile logs/mod_jk.shm
JkLogLevel info
JkOptions +ForwardURICompatUnparsed
</IfModule>
worker.properties:
    ( basic config for tomcat & worker details )
2. enabled vhosts and added below configs:
                   httpd-vhosts.conf:
                     <VirtualHost *:8880>
ServerName www.testapp.com
       JkMount /idp/* worker1
<Location /idp>
SetHandler form-login-handler
AuthFormLoginRequiredLocation "http://www.testapp.com:8880/Login.html"
AuthFormLoginSuccessLocation  "http://www.testapp.com:8010/
idp/Authn/RemoteUser" (I tried this and *http://host.name:8010/idp
<http://host.name:8010/idp>* but it doesn't work...)
AuthFormProvider file
AuthUserFile /conf/user.db
AuthType form
Session On
SessionCookieName session path=/
require valid-user
AuthName "admin"
#AuthUserFile conf/user.db
require valid-user
</Location>
</VirtualHost>
3. In server.xml file I uncommented the ajp port and enabled it and also
tested the IDP status page via http port.
//actually it is not supporting AJP so changed the protocol to http like
this:
 <Connector  port="8010" protocol="HTTP/1.1" redirectPort="8443"
tomcatAuthentication="false" />

4. Enabled RemoteUser in idp.propertied file:
           In logs the idp prints "it will look for remote user details in
headers and attributes[]".
5.  Added below config in relying party to support un verfied relying party:

             <bean id="shibboleth.UnverifiedRelyingParty"
parent="RelyingParty">
<property name="profileConfigurations">
<list>
<!-- <bean parent="SAML2.SSO" p:encryptAssertions="false" /> -->
<ref bean="SAML2.ECP" />
 <ref bean="SAML2.Logout" />
  <ref bean="SAML2.AttributeQuery" />
<ref bean="SAML2.ArtifactResolution" />
</list>
</property>
</bean>

So when I try to access the IDP via apache, IDP throws this error "*Web
Login Service - Stale Request*".
apache httpd server is sending* remote user name to tomca*t, I checked it
in the access logs. But still IDP is not recognizing the *remote user login
flow*.

Do I miss any other configuration ?? Kindly let me know your suggestions
and one more question, how I can preserve the incoming request URI  in
apache  proxy and redirect it to tomcat after authentication is successful
?? Thanks in advance...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170803/178e5f2b/attachment-0001.html>