RemoteUser Setting

[深瀬尚子]

Hi!

I'm trying to set Shibboleth SP, IdP, and ADFS as Identity Server.

I've already checked the behavior of Shibboleth SP and ADFS as Identity Servers and other SP and Shibboleth IdP as Identity Servers.

So I think I need Remote_User Setting, and I did, but I couldn't authenticate.

The log when I authenticated is below.
=========================
2024-06-14 17:51:25,006 - xxx.xxx.xxx.xxx - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:368] - Profile Action SelectAuthenticationFlow: Sele
cting inactive authentication flow authn/RemoteUser
2024-06-14 17:51:25,155 - xxx.xxx.xxx.xxx - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:277] - e1s2: User identity not found in request
2024-06-14 17:51:25,229 - xxx.xxx.xxx.xxx - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:201] - Profile Action ValidateExternalAuthentic
ation: External authentication failed, no user identity or error information returned
2024-06-14 17:51:25,252 - xxx.xxx.xxx.xxx - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:137] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/RemoteUser to intermediate set
2024-06-14 17:51:25,268 - xxx.xxx.xxx.xxx - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:270] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2024-06-14 17:51:25,277 - xxx.xxx.xxx.xxx - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:309] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
2024-06-14 17:51:25,285 - xxx.xxx.xxx.xxx - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:313] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
=========================

My configuration is as follows;

・/etc/shibboleth/shibboleth2.xml
    <ApplicationDefaults entityID="https://idp.xxx.xxx/shibboleth-sp"
        REMOTE_USER="uid"
        cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">

・/opt/shibboleth-idp/conf/authn/authn.properties
idp.authn.flows = RemoteUser
idp.authn.RemoteUser.checkRemoteUser = true
idp.authn.RemoteUser.checkAttributes = uid
idp.authn.RemoteUser.checkHeaders = uid

・/etc/httpd/conf.d/shib.conf
<Location /idp>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require shib-session
  ShibUseHeaders On
</Location>



My environment is as follows;
OS: Rocky Linux release 9.4
Shibboleth IdP: Version 5.1.2
Shibboleth SP: 3.4.1
Container: jetty-home-12.0.10
Apache: Version 2.4.57

What should I do to resolve the problem?

I really appreciate any help you can provide. 


best regards
Naoko