<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=gb2312" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.19222">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>Hi, <BR> I have finished the connectiong idp2.3.3
and ldap on linux and everything is working just fine with ldap authentication
using sp,now I want to trying to setup kerberos authentication. They are
installed in the same computer.<BR> But the idp_process.log lists the
error: <BR> 09:13:46.538 - ERROR
[edu.internet2.middleware.shibboleth.common.config.BaseSer<BR>vice:188] -
Configuration was not loaded for shibboleth.AttributeResolver servi<BR>ce, error
creating components. The root cause of this error was:
org.xml.sax.S<BR>AXParseException: cvc-identity-constraint.4.3: Key
'DataConnectorAttributeDefin<BR>itionDependencyRef' with value 'HTTP' not found
for identity constraint of elem<BR>ent 'AttributeResolver'.</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2> My configure file are listed below:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2> attribute-resolver.xml</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2> <!-- Example LDAP Connector
--></FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2> <resolver:DataConnector id="myLDAP"
xsi:type="dc:LDAPDirectory"<BR>
ldapURL="<A
href="ldap://ldap.ihep.ac.cn">ldap://ldap.ihep.ac.cn</A>"<BR>
baseDN="ou=people,dc=ihep,dc=ac,dc=cn"<BR>
principal="cn=root,dc=ihep,dc=ac,dc=cn"<BR>
principalCredential="123456"<BR>
lowercaseAttributeNames="true"><BR>
<resolver:Dependency ref="HTTP"
/><BR> <resolver:Dependency
ref="ihep.ac.cn" /></FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2>
<dc:FilterTemplate><BR>
<![CDATA[<BR>
(uid=$requestContext.principalName)(&(samaccountname=${krb_principalname.get(0)})(msSFU30NisDomain=${krb_domain.get(0)})))(objectclass=user))</FONT></DIV>
<DIV> </DIV>
<DIV><FONT
size=2>
]]><BR>
</dc:FilterTemplate></FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2>
</resolver:DataConnector></FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2>handler.xml<BR> <!-- Kerberos Idp
--><BR> <ph:LoginHandler
xsi:type="krb:KERBEROS"<BR>
kerberosCfg="/etc/krb5.conf"<BR>
customUnauthorized="/usr/local/java-idp-kerberos-login-handler/examples/unauthorized.html"<BR>
><BR>
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</ph:AuthenticationMethod><BR>
<krb:Realm
domain="IHEP.AC.CN"><BR>
<krb:principal>HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</krb:principal><BR>
<krb:keytab>/etc/http.keytab</krb:keytab><BR>
</krb:Realm><BR> </ph:LoginHandler></FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2>login.xml<BR>ShibUserPassAuth {</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2>// Example LDAP authentication<BR>
edu.vt.middleware.ldap.jaas.LdapLoginModule
required<BR> ldapUrl="<A
href="ldap://ldap.ihep.ac.cn">ldap://ldap.ihep.ac.cn</A>"<BR>
baseDn="ou=people,dc=ihep,dc=ac,dc=cn"<BR>
ssl="false";</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2> com.sun.security.auth.module.Krb5LoginModule
required<BR>
useKeyTab="true"<BR>
keyTab="/etc/http.keytab";<BR>};</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2>I have added HTTP principal in kdc.<BR>#kadmin.local
<BR>kadmin.local: addprinc HTTP/kerberos.ihep.ac.cn<BR>WARNING: no policy
specified for <A
href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</A>;
defaulting to no policy<BR>Enter password for principal "<A
href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</A>":
<BR>Re-enter password for principal "<A
href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</A>":
<BR>Principal "<A
href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</A>"
created.<BR>kadmin.local: </FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2># kadmin.local<BR>Authenticating as principal <A
href="mailto:HTTP/admin@IHEP.AC.CN">HTTP/admin@IHEP.AC.CN</A> with
password.<BR>kadmin.local: ktadd -k /etc/http.keytab
HTTP/kerberos.ihep.ac.cn<BR>Entry for principal HTTP/kerberos.ihep.ac.cn with
kvno 2, encryption type AES-256 CTS mode with 96-bit SHA-1 HMAC added to keytab
WRFILE:/etc/http.keytab.<BR>Entry for principal HTTP/kerberos.ihep.ac.cn with
kvno 2, encryption type AES-128 CTS mode with 96-bit SHA-1 HMAC added to keytab
WRFILE:/etc/http.keytab.<BR>Entry for principal HTTP/kerberos.ihep.ac.cn with
kvno 2, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab
WRFILE:/etc/http.keytab.<BR>Entry for principal HTTP/kerberos.ihep.ac.cn with
kvno 2, encryption type ArcFour with HMAC/md5 added to keytab
WRFILE:/etc/http.keytab.<BR>Entry for principal HTTP/kerberos.ihep.ac.cn with
kvno 2, encryption type DES with HMAC/sha1 added to keytab
WRFILE:/etc/http.keytab.<BR>Entry for principal HTTP/kerberos.ihep.ac.cn with
kvno 2, encryption type DES cbc mode with RSA-MD5 added to keytab
WRFILE:/etc/http.keytab.<BR>kadmin.local: </FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2>Anyone has experience on idp connection kerberos, Please give
me some advise about it.<BR>thank you very much!</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2>Best Regards.<BR>xingcy</FONT></DIV></BODY></HTML>