AW: ECP: 401 error or application/vnd.paos+xml not supported?

[Käfer Thomas]

Dear Peter,

thank you for the hint with the relying-party.xml file. I've used it to defined a separate block for Microsoft like this:

<bean parent="RelyingPartyByName" c:relyingPartyIds="urn:federation:MicrosoftOnline">
<property name="profileConfigurations">
<list>
<ref bean="SAML2.SSO" />
<bean parent="SAML2.ECP" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
</list>
</property>
</bean>

With this the ECP reply of my IDP 4.1.5 server comes very close to the one of the old IDP 2.3.8 server. For the final test we will have to try switching ips or dns-entries of the servers, to make Microsoft use the IDP 4.1.5 instead of the IDP 2.3.8 server.

Thank you!
Kind regards,
Thomas Käfer

________________________________
Von: Käfer Thomas <thomas.kaefer at fh-campuswien.ac.at>
Gesendet: Dienstag, 29. März 2022 16:35
An: Shib Users <users at shibboleth.net>
Betreff: AW: ECP: 401 error or application/vnd.paos+xml not supported?

Thank you Pete and Matthew!

with that fix I am able to get an ECP reply from my IDP 4.1.5 server that I'm almost happy with. Only problem left is that the IDP 4.1.5 answers with a transient ID while I'm pretty sure Microsoft will require the same persistent nameID it also needs in the browser based authentication.

I've adapted the request template to match the ECP requests I can see in my IDP 2.3.8 logs, but that doesn't contain any special request for the persistent nameID like I can see in the browser.

How can I make my IDP 4.1.5 server always use the persistent nameID no matter if requested or not? (This instance will only be used to serve Microsofts requests so it doesn't matter security / principle of data economy wise).

Thank you!
Kind regards,
Thomas Käfer
________________________________
Von: Käfer Thomas <thomas.kaefer at fh-campuswien.ac.at>
Gesendet: Dienstag, 29. März 2022 12:41
An: Shib Users <users at shibboleth.net>
Betreff: ECP: 401 error or application/vnd.paos+xml not supported?

Hello everyone!

I'm currently trying to configure an IDP 4.1.5 instance to work as a replacement for an IDP 2.3.8 instance that authenticates our users to Microsoft services.

The browser login flow seems to work quite well already, but I also need it to to handle ECP requests for IMAP & POP3 authentication.

I found this test script: https://github.com/unikent-ms1/simple-soap-ecp-test
which makes my IDP 2.3.8 instance reply with valid looking responses.

Before adapting the IDP 4.1.5 to work with ECP it produced this error upon receiving an ECP request:
MessageDecodingException: Content-Type 'application/vnd.paos+xml' was not a supported media type

After following this ECP guide for IDP 3.x (couldn't find one for IDP 4.x):
https://shibboleth.atlassian.net/wiki/spaces/IDP30/pages/2497773698/ECPConfiguration
I instead get an HTTP ERROR 401 Unauthorized response from jetty, without any output in the Shibboleth logs.
Only effect I could find on the server is this line:
[my-ip] - - [29/März/2022:10:07:51 +0000] "POST /idp/profile/SAML2/SOAP/ECP HTTP/1.1" 401 474
in the jetty request.log.

Does anybody recognize a known problem and can give me a hint how to continue to get ECP working on IDP 4.1.5?
I guess otherwise my next steps will need to be to research how to make jetty log more verbose to find the reason for it's access denial.

Thank you,
kind regards,
Thomas Käfer

Informationen zum Datenschutz: www.fh-campuswien.ac.at/datenschutzerklaerung
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220329/bfc401a2/attachment.htm>