Need help: Remote user auth via httpd using mod_jk connector

[Satheesh Kumar]

Thanks for the suggestion Peter,
We already have IDP V2, instead of upgrading to v 3.3 we are building it
from scratch...
So in the existing IDP we are using mod jk and other stuffs...So I have to
follow the same flow...It's a requirement!!!

I'd start with "AuthType basic" and whatever provider you want, as to
avoid any issues due to the way "AuthType forms" works??
        *Yeah I tried using  basic too. Apache is redirecting to IDP. But
IDP is not able to recognise the incoming request.*
*I miss some configurations there..Like you have said about web.xml, etc.*

Anyway, with HTTP proxying you also need to change
webapp/WEB-INF/web.xml, AFAIU, to make the IDP also use
"checkHeaders", as per the Shib IDP RemoteUser authentication
documentation??
      So can you please tell me what are the changes I have to do in
web.xml...
I saw in shib wiki pages, there they are discussing about remote user beans
and server config...I am not very much clear about the configuration..Can
you elaborate little bit on this ??
How do I make IDP to check headers during remote user authentication.

Whose access log??
*It is httpd servers access_log file, after authentication I can see https
is redirecting to IDP with principal name.*

Kindly share your suggestions, thanks in advance..

On 03-Aug-2017 6:01 PM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

> * Satheesh Kumar <satheeshvsbk at gmail.com> [2017-08-03 14:09]:
> > I am trying to do "Remote user authentication" via apache http
> > server(form based authentication)
>
> What documentation are you following to achieve this and why
> specifically do you want to do this? The IDP provides a forms-based
> authentication mechanism out of the box. Also, RemoteUserInternal
> might be easier to get working.
>
> >         1.  Apache config:
> >                   httpd.conf file:
> >                      added config for mod_jk:
> >                         <IfModule jk_module>
> > JkWorkersFile conf/workers.properties
> > JkShmFile logs/mod_jk.shm
> > JkLogLevel info
> > JkOptions +ForwardURICompatUnparsed
> > </IfModule>
>
> Why not mod_proxy_ajp, which comes with Apache httpd out of the box?
> (Not that any of this matters, as you state below you're not even
> using AJP. Whatever that means with all your mod_jk directices in
> place.)
>
> > SetHandler form-login-handler
> > AuthFormLoginRequiredLocation "http://www.testapp.com:8880/Login.html"
> > AuthFormLoginSuccessLocation  "http://www.testapp.com:8010/
> > idp/Authn/RemoteUser" (I tried this and *http://host.name:8010/idp
> > <http://host.name:8010/idp>* but it doesn't work...)
>
> I'd start with "AuthType basic" and whatever provider you want, as to
> avoid any issues due to the way "AuthType forms" works.
>
> > //actually it is not supporting AJP so changed the protocol to http like
> > this:
> >  <Connector  port="8010" protocol="HTTP/1.1" redirectPort="8443"
> > tomcatAuthentication="false" />
>
> What is the "it" that "it is not supporting AJP"? Below you write
> you're using Apache Tomcat and that certainly does support AJP.
>
> Anyway, with HTTP proxying you also need to change
> webapp/WEB-INF/web.xml, AFAIU, to make the IDP also use
> "checkHeaders", as per the Shib IDP RemoteUser authentication
> documentation.
>
> >            In logs the idp prints "it will look for remote user details
> in
> > headers and attributes[]".
>
> IIRC the IDP always logs that, from its build-in ECP support.
>
> > 5.  Added below config in relying party to support un verfied relying
> party:
>
> Now that has nothing to do with anything here (and of course there
> should be no need to ever to that).
>
> > So when I try to access the IDP via apache, IDP throws this error "*Web
> > Login Service - Stale Request*".
> > apache httpd server is sending* remote user name to tomca*t, I checked it
> > in the access logs.
>
> Whose access log?
>
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170803/2122c5aa/attachment.html>