Apache/Tomcat

[Nate Klingenstein]

Joshua(apologies for mangling your name earlier),

The passage in the Wiki is accurate when the IdP is running in a servlet container that is listening directly to 443.  With Apache, you'll need to prompt for basic authentication and be sure to turn off tomcatAuthentication="false" in server.xml.  The username will then be picked up by the password authentication handler with this webflow:

    <action-state id="ExtractUsernamePasswordFromBasicAuth">
        <evaluate expression="ExtractUsernamePasswordFromBasicAuth" />
        <evaluate expression="'proceed'" />
        
        <transition on="proceed" to="ValidateUsernamePassword" />
        
        <!-- Fall through to a different flow if basic-auth extract fails on a passive or non-browser request. -->
        <transition on="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" to="ReselectFlow" />
        
        <transition on="NoCredentials" to="DisplayUsernamePasswordPage" />
        <transition on="InvalidCredentials" to="DisplayUsernamePasswordPage" />
        <on-exit>
            <set name="thisFlow" value="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).getAttemptedFlow()" />
        </on-exit>
    </action-state>

Take care,
Nate.
 
-----Original message-----
> From: Joshua Brodie
> Sent: Friday, June 28 2019, 5:34 pm
> To: Shib Users
> Subject: Re: Apache/Tomcat
> 
> 
> 
> Hi Nate:
> 
> I guess I was confused by the following passage from https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration <https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration>
> 
> "If your IdP relies on the Password <https://wiki.shibboleth.net/confluence/display/IDP30/PasswordAuthnConfiguration> login flow, the system automatically supports ECP via HTTP Basic authentication headers as long as the client provides the WWW-Authenticate header itself without being challenged. Theres nothing you need to set up."
> 
> I was assuming no other work required -- only to enable in the relying-party.xml.
> 
> Thanks.
> 
> On Fri, 28 Jun 2019 at 15:48, Nate Klingenstein <ndk at signet.id <mailto:ndk at signet.id>> wrote:
> 
> Koshua,
> 
> It looks to me like it ought to still work.  Which piece are you concerned about?
> 
> Best,
> 
> Nate.
> 
> --
> 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
> 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
> 
> --
> 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
>