Need help: Remote user auth via httpd using mod_jk connector

[Satheesh Kumar]

Okay Scott,
So I read the documentation and did below config:

        1. I configured the  remoteuser-internal-authn-config.xml to load
remote user header
                     * <util:list
id="shibboleth.authn.RemoteUser.checkHeaders">*
*                        <value>X-REMOTE_USER</value>*
*                             </util:list>*

        2. Configured the RemoteUserAuth servlets init param value.

                                  *<init-param>*
*                  <param-name>checkHeaders</param-name>*
*                  <param-value>X-REMOTE-USER</param-value>*
*                                   </init-param>*

*        3*. After authenting the user via apache, on redirecting to IDP I
get below error:

                          *  "No conversation key found."*

                 So, I tried to hard code the some key value like e1s1 in
the url like below

       *
 http://mytest.com/idp/Authn/RemoteUser?conversation=%e1s1%22
<http://mytest.com/idp/Authn/RemoteUser?conversation=%e1s1%22>*

                But after that IDP throws:

                         *ERROR
[net.shibboleth.idp.authn.ExternalAuthenticationException:76] -*
*net.shibboleth.idp.authn.ExternalAuthenticationException: No conversation
state found in session for key ("els1")*


      4.  apache is sending back the remote user name in headers to IDP .
                    *apache http server access log:  "  testuser
[04/Aug/2017:07:05:13 -0400] "POST /idp/ HTTP/1.1" 302 230"*

             let me know , how to resolve this?? Actually in the
documentation it is mentioned like when remote user is present in the http
header then remoteUserServlet will consider the user as authenticated and
will release the attributes for the user. But why the IDP needs
conversation key here... So do I miss any other configurations ??

Thanks in advance..




On Thu, Aug 3, 2017 at 1:22 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > We already have IDP V2, instead of upgrading to v 3.3 we are building it
> from
> > scratch...
>
> Then you're guaranteeing problems, basically. Remember that I said that
> when it breaks and you can't get it to behave like it did before.
>
> > How do I make IDP to check headers during remote user authentication.
>
> Did you read the documentation on the login method you're trying to use?
> Ask a specific question if something isn't clear. I won't repeat the
> documentation here.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
*Best wishes*,
*Satheesh K*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170804/b1825653/attachment-0001.html>