ECP: 401 error or application/vnd.paos+xml not supported?

[Käfer Thomas]

Hello everyone!

I'm currently trying to configure an IDP 4.1.5 instance to work as a replacement for an IDP 2.3.8 instance that authenticates our users to Microsoft services.

The browser login flow seems to work quite well already, but I also need it to to handle ECP requests for IMAP & POP3 authentication.

I found this test script: https://github.com/unikent-ms1/simple-soap-ecp-test
which makes my IDP 2.3.8 instance reply with valid looking responses.

Before adapting the IDP 4.1.5 to work with ECP it produced this error upon receiving an ECP request:
MessageDecodingException: Content-Type 'application/vnd.paos+xml' was not a supported media type

After following this ECP guide for IDP 3.x (couldn't find one for IDP 4.x):
https://shibboleth.atlassian.net/wiki/spaces/IDP30/pages/2497773698/ECPConfiguration
I instead get an HTTP ERROR 401 Unauthorized response from jetty, without any output in the Shibboleth logs.
Only effect I could find on the server is this line:
[my-ip] - - [29/März/2022:10:07:51 +0000] "POST /idp/profile/SAML2/SOAP/ECP HTTP/1.1" 401 474
in the jetty request.log.

Does anybody recognize a known problem and can give me a hint how to continue to get ECP working on IDP 4.1.5?
I guess otherwise my next steps will need to be to research how to make jetty log more verbose to find the reason for it's access denial.

Thank you,
kind regards,
Thomas Käfer

Informationen zum Datenschutz: www.fh-campuswien.ac.at/datenschutzerklaerung
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220329/24747396/attachment.htm>