Regarding connecting ECP client with Shibboleth

Tue Aug 28 23:56:01 EDT 2018

Hi Peter,
Thank you for replying me so quickly.

I configured installed shibboleth IDP and can be accessd with
https://idp.shibboleth.com.

My shibboleth protected SP is at https://localhost/myservice/

When I send the request to the SP using the ECP client the response is

shibsp::ConfigurationException

The system encountered an error at Wed Aug 29 09:24:24 2018

To report this problem, please contact the site administrator at winma at test.

Please include the following message in any email:

shibsp::ConfigurationException at (https://localhost/myservice/)

No session initiator found with id (ECP), check requireSessionWith command.

My Apache .conf file is as below.

<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerAdmin winma at localhost

DocumentRoot /var/www/html

# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   A self-signed (snakeoil) certificate can be created by installing
#   the ssl-cert package. See
#   /usr/share/doc/apache2/README.Debian.gz for more info.
#   If both key and certificate are stored in the same file, only the
#   SSLCertificateFile directive is needed.
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convinience.
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
#   Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt

#   Certificate Revocation Lists (CRL):
#   Set the CA revocation path where to find CA CRLs for client
#   authentication or alternatively one huge file containing all
#   of them (file must be PEM encoded)
#   Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl

#   Client Authentication (Type):
#   Client certificate verification type and depth.  Types are
#   none, optional, require and optional_no_ca.  Depth is a
#   number which specifies how deeply to verify the certificate
#   issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth  10

#   SSL Engine Options:
#   Set various options for the SSL engine.
#   o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation.  This means that
# the standard Auth/DBMAuth methods can be used for access control.  The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
#   o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
#   o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
#   o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>

#   SSL Protocol Adjustments:
#   The safe and default but still SSL/TLS standard compliant shutdown
#   approach is that mod_ssl sends the close notify alert but doesn't wait
for
#   the close notify alert from client. When you need a different shutdown
#   approach you can use one of the following variables:
#   o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received.  This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
#   o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
#   Notice: Most problems of broken clients are also related to the HTTP
#   keep-alive facility, so you usually additionally want to disable
#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
#   "force-response-1.0" for this.
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

Alias /myservice/ /var/www/myservice/
              <Location /myservice/>
                     AuthType shibboleth
                     ShibRequestSetting requireSessionWith ECP
                     Require valid-user
              </Location>

</VirtualHost>
</IfModule>

My shibboleth2.xml file is as below.

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">

    <!--
    By default, in-memory StorageService, ReplayCache, ArtifactMap, and
SessionCache
    are used. See example-shibboleth2.xml for samples of explicitly
configuring them.
    -->

    <!--
    To customize behavior for specific resources on Apache, and to link
vhosts or
    resources to ApplicationOverride settings below, use web server
options/commands.
    See
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements
for help.

    For examples with the RequestMap XML syntax instead, see the
example-shibboleth2.xml
    file, and the
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo
topic.
    -->

    <!-- The ApplicationDefaults element is where most of Shibboleth's SAML
bits are defined. -->
    <ApplicationDefaults entityID="https://localhost/shibboleth"
                         REMOTE_USER="eppn persistent-id targeted-id">

        <!--
        Controls session lifetimes, address checks, cookie handling, and
the protocol handlers.
        You MUST supply an effectively unique handlerURL value for each of
your applications.
        The value defaults to /Shibboleth.sso, and should be a relative
path, with the SP computing
        a relative value based on the virtual host. Using
handlerSSL="true", the default, will force
        the protocol to be https. You should also set cookieProps to
"https" for SSL-only sites.
        Note that while we default checkAddress to "false", this has a
negative impact on the
        security of your site. Stealing sessions via cookie theft is much
easier with this disabled.
        -->
        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="true"
cookieProps="https">

            <!--
            Configures SSO for a default IdP. To allow for >1 IdP, remove
            entityID property and adjust discoveryURL to point to discovery
service.
            (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF
support.)
            You can also override entityID on /Login query string, or in
RequestMap/htaccess.
            -->
            <SSO entityID="https://idp.shibboleth.com/idp/shibboleth"
                 discoveryProtocol="SAMLDS" discoveryURL="
https://ds.example.org/DS/WAYF">
              SAML2 SAML1
            </SSO>

            <!-- SAML and local-only logout. -->
            <Logout>SAML2 Local</Logout>

            <!-- Extension service that generates "approximate" metadata
based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata"
signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.1.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session"
showAttributeValues="false"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
        </Sessions>

        <!--
        Allows overriding of error template information/filenames. You can
        also add attributes with values that can be plugged into the
templates.
        -->
        <Errors supportContact="winma at test"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>

        <!-- Example of remotely supplied batch of signed metadata. -->

<MetadataProvider type="XML"
                  file="idp-metadata.xml"/>

        <!--
        <MetadataProvider type="XML" uri="
http://federation.org/federation-metadata.xml"
              backingFilePath="federation-metadata.xml"
reloadInterval="7200">
            <MetadataFilter type="RequireValidUntil"
maxValidityInterval="2419200"/>
            <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
        </MetadataProvider>
        -->

        <!-- Example of locally maintained metadata. -->
        <!--
        <MetadataProvider type="XML" file="partner-metadata.xml"/>
        -->

        <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true"
reloadChanges="false" path="attribute-map.xml"/>

        <!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>

        <!-- Default filtering policy for recognized attributes, lets other
data pass. -->
        <AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/>

        <!-- Simple file-based resolver for using a single keypair. -->
        <CredentialResolver type="File" key="sp-key.pem"
certificate="sp-cert.pem"/>

        <!--
        The default settings can be overridden by creating
ApplicationOverride elements (see
        the
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride
topic).
        Resource requests are mapped by web server commands, or the
RequestMapper, to an
        applicationId setting.

        Example of a second application (for a second vhost) that has a
different entityID.
        Resources on the vhost would map to an applicationId of "admin":
        -->
        <!--
        <ApplicationOverride id="admin" entityID="
https://admin.example.org/shibboleth"/>
        -->
    </ApplicationDefaults>

    <!-- Policies that determine how to process and authenticate runtime
messages. -->
    <SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for
use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>

</SPConfig>

Could you please tell me what I did wrong in my SP configuration?

Thank you!!!
Winma

On Tue, Aug 28, 2018 at 5:20 PM Peter Schober <peter.schober at univie.ac.at>
wrote:

> * winma heenatigala <winma2014al at gmail.com> [2018-08-28 13:21]:
> > I tried many examples from internet but all failed. Can anyone
> > please give my some guidance or any documents to follow.
>
> Without knowing what you did and how exactly it failed it's hard to
> tell you what to do differently.
>
> -peter
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180829/0551cc4a/attachment.html>