Need help: Remote user auth via httpd using mod_jk connector

[Peter Schober]

* Satheesh Kumar <satheeshvsbk at gmail.com> [2017-08-03 14:09]:
> I am trying to do "Remote user authentication" via apache http
> server(form based authentication)

What documentation are you following to achieve this and why
specifically do you want to do this? The IDP provides a forms-based
authentication mechanism out of the box. Also, RemoteUserInternal
might be easier to get working.

>         1.  Apache config:
>                   httpd.conf file:
>                      added config for mod_jk:
>                         <IfModule jk_module>
> JkWorkersFile conf/workers.properties
> JkShmFile logs/mod_jk.shm
> JkLogLevel info
> JkOptions +ForwardURICompatUnparsed
> </IfModule>

Why not mod_proxy_ajp, which comes with Apache httpd out of the box?
(Not that any of this matters, as you state below you're not even
using AJP. Whatever that means with all your mod_jk directices in
place.)

> SetHandler form-login-handler
> AuthFormLoginRequiredLocation "http://www.testapp.com:8880/Login.html"
> AuthFormLoginSuccessLocation  "http://www.testapp.com:8010/
> idp/Authn/RemoteUser" (I tried this and *http://host.name:8010/idp
> <http://host.name:8010/idp>* but it doesn't work...)

I'd start with "AuthType basic" and whatever provider you want, as to
avoid any issues due to the way "AuthType forms" works.

> //actually it is not supporting AJP so changed the protocol to http like
> this:
>  <Connector  port="8010" protocol="HTTP/1.1" redirectPort="8443"
> tomcatAuthentication="false" />

What is the "it" that "it is not supporting AJP"? Below you write
you're using Apache Tomcat and that certainly does support AJP.

Anyway, with HTTP proxying you also need to change
webapp/WEB-INF/web.xml, AFAIU, to make the IDP also use
"checkHeaders", as per the Shib IDP RemoteUser authentication
documentation.

>            In logs the idp prints "it will look for remote user details in
> headers and attributes[]".

IIRC the IDP always logs that, from its build-in ECP support.

> 5.  Added below config in relying party to support un verfied relying party:

Now that has nothing to do with anything here (and of course there
should be no need to ever to that).

> So when I try to access the IDP via apache, IDP throws this error "*Web
> Login Service - Stale Request*".
> apache httpd server is sending* remote user name to tomca*t, I checked it
> in the access logs.

Whose access log?

-peter