<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
On 5/8/2012 7:43 PM, xingcy wrote:
<blockquote cite="mid:801077B949A84091AB53F016A682BCF4@xingcy"
type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<meta name="GENERATOR" content="MSHTML 8.00.6001.19222">
<style></style>
<div><font size="2">Hi, <br>
I have finished the connectiong idp2.3.3 and ldap on linux
and everything is working just fine with ldap authentication
using sp,now I want to trying to setup kerberos
authentication. They are installed in the same computer.<br>
But the idp_process.log lists the error: <br>
09:13:46.538 - ERROR
[edu.internet2.middleware.shibboleth.common.config.BaseSer<br>
vice:188] - Configuration was not loaded for
shibboleth.AttributeResolver servi<br>
ce, error creating components. The root cause of this error
was: org.xml.sax.S<br>
AXParseException: cvc-identity-constraint.4.3: Key
'DataConnectorAttributeDefin<br>
itionDependencyRef' with value 'HTTP' not found for identity
constraint of elem<br>
ent 'AttributeResolver'.</font></div>
<div> </div>
<div><font size="2"> My configure file are listed below:</font></div>
<div> </div>
<div><font size="2"> attribute-resolver.xml</font></div>
<div> </div>
<div><font size="2"> <!-- Example LDAP Connector --></font></div>
<div> </div>
<div><font size="2"> <resolver:DataConnector id="myLDAP"
xsi:type="dc:LDAPDirectory"<br>
ldapURL="<a moz-do-not-send="true"
href="ldap://ldap.ihep.ac.cn">ldap://ldap.ihep.ac.cn</a>"<br>
baseDN="ou=people,dc=ihep,dc=ac,dc=cn"<br>
principal="cn=root,dc=ihep,dc=ac,dc=cn"<br>
principalCredential="123456"<br>
lowercaseAttributeNames="true"><br>
<resolver:Dependency ref="HTTP" /><br>
<resolver:Dependency ref="ihep.ac.cn" /></font></div>
<div> </div>
<div><font size="2"> <dc:FilterTemplate><br>
<![CDATA[<br>
(uid=$requestContext.principalName)(&(samaccountname=${krb_principalname.get(0)})(msSFU30NisDomain=${krb_domain.get(0)})))(objectclass=user))</font></div>
<div> </div>
<div><font size="2"> ]]><br>
</dc:FilterTemplate></font></div>
<div> </div>
<div><font size="2"> </resolver:DataConnector></font></div>
<div> </div>
<div><font size="2">handler.xml<br>
<!-- Kerberos Idp --><br>
<ph:LoginHandler xsi:type="krb:KERBEROS"<br>
kerberosCfg="/etc/krb5.conf"<br>
customUnauthorized="/usr/local/java-idp-kerberos-login-handler/examples/unauthorized.html"<br>
><br>
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</ph:AuthenticationMethod><br>
<krb:Realm domain="IHEP.AC.CN"><br>
<krb:principal><a class="moz-txt-link-abbreviated" href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</a></krb:principal><br>
<krb:keytab>/etc/http.keytab</krb:keytab><br>
</krb:Realm><br>
</ph:LoginHandler></font></div>
</blockquote>
<br>
<br>
The above looks correct for GSS-API/SPNEGO. <br>
<br>
The following login.xml does not look correct as it is requiring the<br>
user to authenticate to LDAP *and* Kerberos, which is probably<br>
not what you want. <br>
(In the distribution the file is called login.config, as it is not
xml.) <br>
<br>
<blockquote cite="mid:801077B949A84091AB53F016A682BCF4@xingcy"
type="cite">
<div><font size="2">login.xml<br>
ShibUserPassAuth {</font></div>
<div> </div>
<div><font size="2">// Example LDAP authentication<br>
edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
ldapUrl="<a moz-do-not-send="true"
href="ldap://ldap.ihep.ac.cn">ldap://ldap.ihep.ac.cn</a>"<br>
baseDn="ou=people,dc=ihep,dc=ac,dc=cn"<br>
ssl="false";</font> <br>
</div>
</blockquote>
<blockquote cite="mid:801077B949A84091AB53F016A682BCF4@xingcy"
type="cite">
<div><font size="2"> com.sun.security.auth.module.Krb5LoginModule
required<br>
useKeyTab="true"<br>
keyTab="/etc/http.keytab";<br>
</font></div>
</blockquote>
<br>
What you may want is more like:<br>
<br>
<small>com.sun.security.auth.module.Krb5LoginModule requisite<br>
useKeyTab="true"</small><font size="2"><small> </small><br>
keyTab="/etc/http.keytab"</font> <br>
<small> storeKey="false"<br>
debug="true";</small><br>
<br>
<font size="2"> edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
ldapUrl="<a moz-do-not-send="true"
href="ldap://ldap.ihep.ac.cn">ldap://ldap.ihep.ac.cn</a>"<br>
baseDn="ou=people,dc=ihep,dc=ac,dc=cn"<br>
ssl="false"<br>
debug="true"<br>
bindDn="some-ldap-account-with-read-access"<br>
bindCredential="password-for-some-ldap-account-with-read-access"<br>
useFirstPass="false"<br>
tryFirstPass="false"<br>
subtreeSearch="true"<br>
userFilter="uid={0}"</font>;<br>
<br>
And then turn off debug and turn on ssl or tls for production. <br>
This requires the user to authenticate via Kerberos and be in the
LDAP database. <br>
<br>
If your LDAP was AD, something like this could be used to also test
the account is not disabled<br>
<br>
userFilter="(&(samAccountName={0})(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"<br>
<br>
<blockquote cite="mid:801077B949A84091AB53F016A682BCF4@xingcy"
type="cite">
<div><font size="2">};</font></div>
<div> </div>
<div><font size="2">I have added HTTP principal in kdc.<br>
#kadmin.local <br>
kadmin.local: addprinc HTTP/kerberos.ihep.ac.cn<br>
WARNING: no policy specified for <a moz-do-not-send="true"
href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</a>;
defaulting to no policy<br>
Enter password for principal "<a moz-do-not-send="true"
href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</a>":
<br>
Re-enter password for principal "<a moz-do-not-send="true"
href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</a>":
<br>
Principal "<a moz-do-not-send="true"
href="mailto:HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN">HTTP/kerberos.ihep.ac.cn@IHEP.AC.CN</a>"
created.<br>
kadmin.local: </font></div>
<div> </div>
<div><font size="2"># kadmin.local<br>
Authenticating as principal <a moz-do-not-send="true"
href="mailto:HTTP/admin@IHEP.AC.CN">HTTP/admin@IHEP.AC.CN</a>
with password.<br>
kadmin.local: ktadd -k /etc/http.keytab
HTTP/kerberos.ihep.ac.cn<br>
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2,
encryption type AES-256 CTS mode with 96-bit SHA-1 HMAC added
to keytab WRFILE:/etc/http.keytab.<br>
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2,
encryption type AES-128 CTS mode with 96-bit SHA-1 HMAC added
to keytab WRFILE:/etc/http.keytab.<br>
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2,
encryption type Triple DES cbc mode with HMAC/sha1 added to
keytab WRFILE:/etc/http.keytab.<br>
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2,
encryption type ArcFour with HMAC/md5 added to keytab
WRFILE:/etc/http.keytab.<br>
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2,
encryption type DES with HMAC/sha1 added to keytab
WRFILE:/etc/http.keytab.<br>
Entry for principal HTTP/kerberos.ihep.ac.cn with kvno 2,
encryption type DES cbc mode with RSA-MD5 added to keytab
WRFILE:/etc/http.keytab.<br>
kadmin.local: </font></div>
<div> </div>
<div><font size="2">Anyone has experience on idp connection
kerberos, Please give me some advise about it.<br>
thank you very much!</font></div>
<div> </div>
<div><font size="2">Best Regards.<br>
xingcy</font></div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="200">--
Douglas E. Engert <a class="moz-txt-link-rfc2396E" href="mailto:DEEngert@anl.gov"><DEEngert@anl.gov></a>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444</pre>
</body>
</html>