RemoteUser authnMethodHeader example?

[Liam Hoekenga]

On Tue, Feb 7, 2017 at 12:32 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> I simply used the wrong terminology.
>

It worked when I changed it to init-param.

So... our configuration uses two locally modified copies of
remoteuser-authn: remoteuserplus and remoteusertoken.

RemoteUserPlus
- supports isPassive, forceAuthn
- supports PasswordProtectedTransport, Password and unspecified

RemoteUserToken
- supports TimeSyncToken

My authentication flows are set for
"remoteuserplus|remoteusertoken|RemoteUserInternal"

If I set my authnMethodHeader to include TimeSyncToken, I see...

2017-02-07 15:08:49,292 - WARN
[net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:280] - xxx.xxx.xxx.xxx
- Unable to locate a suitable Principal for authentication method from
header UMAuthnContext: urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken

...and then evaluates the possible flows...

2017-02-07 15:08:36,847 - DEBUG
[net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:111] -
xxx.xxx.xxx.xxx - Profile Action InitializeRequestedPrincipalContext:
Profile configuration does not include any default authentication methods
2017-02-07 15:08:36,848 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:146]
- xxx.xxx.xxx.xxx - Profile Action ProcessRequestedAuthnContext:
AuthnRequest did not contain a RequestedAuthnContext, nothing to do
2017-02-07 15:08:36,856 - DEBUG
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:126] -
xxx.xxx.xxx.xxx - Profile Action PopulateAuthenticationContext: Installing
custom PrincipalEvalPredicateFactoryRegistry into AuthenticationContext
2017-02-07 15:08:36,856 - DEBUG
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:167] -
xxx.xxx.xxx.xxx - Profile Action PopulateAuthenticationContext: Installed 3
authentication flows into AuthenticationContext
2017-02-07 15:08:36,857 - DEBUG
[net.shibboleth.idp.session.impl.PopulateSessionContext:131] -
xxx.xxx.xxx.xxx - Profile Action PopulateSessionContext: No session found
for client
2017-02-07 15:08:36,859 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] -
xxx.xxx.xxx.xxx - Profile Action FilterFlowsByForcedAuthn: Request does not
have forced authentication requirement, nothing to do
2017-02-07 15:08:36,860 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByPassivity:53] - xxx.xxx.xxx.xxx
- Profile Action FilterFlowsByPassivity: Request does not have passive
requirement, nothing to do
2017-02-07 15:08:36,861 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] -
xxx.xxx.xxx.xxx - Profile Action FilterFlowsByNonBrowserSupport: Request
does not have non-browser requirement, nothing to do
2017-02-07 15:08:36,862 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:257] -
xxx.xxx.xxx.xxx - Profile Action SelectAuthenticationFlow: No specific
Principals requested
2017-02-07 15:08:36,862 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:292] -
xxx.xxx.xxx.xxx - Profile Action SelectAuthenticationFlow: No usable active
results available, selecting an inactive flow
2017-02-07 15:08:36,863 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:334] -
xxx.xxx.xxx.xxx - Profile Action SelectAuthenticationFlow: Selecting
inactive authentication flow authn/RemoteUserInternal
2017-02-07 15:08:36,991 - DEBUG
[net.shibboleth.idp.authn.impl.ExtractRemoteUser:160] - xxx.xxx.xxx.xxx -
Profile Action ExtractRemoteUser: No user identity found in request
2017-02-07 15:08:36,993 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:130] -
xxx.xxx.xxx.xxx - Profile Action SelectAuthenticationFlow: Moving
incomplete flow authn/RemoteUserInternal to intermediate set
2017-02-07 15:08:36,994 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:257] -
xxx.xxx.xxx.xxx - Profile Action SelectAuthenticationFlow: No specific
Principals requested
2017-02-07 15:08:36,995 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:292] -
xxx.xxx.xxx.xxx - Profile Action SelectAuthenticationFlow: No usable active
results available, selecting an inactive flow
2017-02-07 15:08:36,995 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:334] -
xxx.xxx.xxx.xxx - Profile Action SelectAuthenticationFlow: Selecting
inactive authentication flow authn/remoteuserplus

...but only looks at RemoteUserPlus and RemoteUserInternal, skipping over
the flow that supports TimeSyncToken - RemoteUserToken.

Should it have looked at RemoteUserToken?

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170207/7b42db45/attachment.html>