ECP: 401 error or application/vnd.paos+xml not supported?

[Pete Birkinshaw]

Hi,

It's not a Shibboleth IdP problem, it's a known bug in the test:

  https://github.com/unikent-ms1/simple-soap-ecp-test/issues/1

And a fix is here:

  https://github.com/unikent-ms1/simple-soap-ecp-test/pull/2/files


Pete

-- 
Pete Birkinshaw
Digital Identity Ltd | http://www.digitalidentity.ltd.uk 
Registered in England and Wales No. 7121888 

From: Käfer Thomas via users <users at shibboleth.net>
Reply: Shib Users <users at shibboleth.net>
Date: 29 March 2022 at 11:41:45
To: Shib Users <users at shibboleth.net>
Cc: Käfer Thomas <thomas.kaefer at fh-campuswien.ac.at>
Subject:  ECP: 401 error or application/vnd.paos+xml not supported?  

Hello everyone!

I'm currently trying to configure an IDP 4.1.5 instance to work as a replacement for an IDP 2.3.8 instance that authenticates our users to Microsoft services.

The browser login flow seems to work quite well already, but I also need it to to handle ECP requests for IMAP & POP3 authentication.

I found this test script: https://github.com/unikent-ms1/simple-soap-ecp-test
which makes my IDP 2.3.8 instance reply with valid looking responses.

Before adapting the IDP 4.1.5 to work with ECP it produced this error upon receiving an ECP request:
MessageDecodingException: Content-Type 'application/vnd.paos+xml' was not a supported media type

After following this ECP guide for IDP 3.x (couldn't find one for IDP 4.x):
https://shibboleth.atlassian.net/wiki/spaces/IDP30/pages/2497773698/ECPConfiguration
I instead get an HTTP ERROR 401 Unauthorized response from jetty, without any output in the Shibboleth logs.
Only effect I could find on the server is this line:
[my-ip] - - [29/März/2022:10:07:51 +0000] "POST /idp/profile/SAML2/SOAP/ECP HTTP/1.1" 401 474
in the jetty request.log.

Does anybody recognize a known problem and can give me a hint how to continue to get ECP working on IDP 4.1.5?
I guess otherwise my next steps will need to be to research how to make jetty log more verbose to find the reason for it's access denial.

Thank you,
kind regards,
Thomas Käfer
Informationen zum Datenschutz: www.fh-campuswien.ac.at/datenschutzerklaerung

--  
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw  
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220329/eb6b1272/attachment.htm>