I could solve a part of the problem, and know I can access the <br><br><a href="https://sp.machine.com:553/Shibboleth.sso/Metadata">https://sp.machine.com:553/Shibboleth.sso/Metadata</a> (SP runs under port 553, cause both SP and IdP are running on the same machine)<br>
and<br><a href="https://idp.machine.com/idp/profile/Status">https://idp.machine.com/idp/profile/Status</a><br><br>Nevertheless, when setting <b>clientAuth="true"</b> in tomcats server.xml I always got the follwing error when trying to access a protecetd ressource.<br>
<b><br>ssl_error_bad_cert_alert</b><br><br>A configured a virtual host in Apache httpd.conf:<br><b><br><VirtualHost _default_:553><br> ServerName <a href="http://sp.machine.com:553">sp.machine.com:553</a><br>
Include D:\opt\shibboleth-sp\etc\shibboleth\apache22.config<br> DocumentRoot D:\opt\Apache2.2\htdocs<br> ErrorLog D:\opt\Apache2.2/logs/error_ssl2.log<br> CustomLog D:\opt\Apache2.2/logs/access_ssl2.log combined<br>
<br> <Location /secure><br> AuthType shibboleth<br> ShibRequireSession On<br> require valid-user<br> </Location><br>
<br> SSLEngine on<br> SSLCertificateFile "D:\opt\shibboleth-sp\etc\shibboleth\sp-cert.pem"<br> SSLCertificateKeyFile "D:\opt\shibboleth-sp\etc\shibboleth\sp-key.pem"<br><br></VirtualHost></b><br>
<br>Still don't get where the problem is. If i set <b>clientAuth="false"</b> the error disappears and the shibboleth login appears as wished.<br><br>Stephan<br><br><br><div class="gmail_quote">2012/6/17 Chad La Joie <span dir="ltr"><<a href="mailto:lajoie@itumi.biz" target="_blank">lajoie@itumi.biz</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">If you went to the status URL (I assume you filled in the proper<br>
hostname) then you didn't use port 8443 so the connector had nothing<br>
to do with it. Making the change you did, however, will break any<br>
back-channel requests.<br>
<div><div><br>
On Sun, Jun 17, 2012 at 8:37 AM, Stephan Hackstedt<br>
<<a href="mailto:stephan.hackstedt@googlemail.com" target="_blank">stephan.hackstedt@googlemail.com</a>> wrote:<br>
> One is after follwing the IdP installtin instructin on:<br>
><br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall</a><br>
><br>
> I wasn't able to access the <a href="https://HOSTNAME/idp/profile/Status" target="_blank">https://HOSTNAME/idp/profile/Status</a> page. Got<br>
> some kind of bad cert error.<br>
><br>
> After I changed in apache server.xml<br>
><br>
> <Connector port="8443"<br>
> protocol="org.apache.coyote.http11.Http11Protocol"<br>
><br>
> SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"<br>
> scheme="https"<br>
> SSLEnabled="true"<br>
> clientAuth="true"<br>
> keystoreFile="IDP_HOME/credentials/idp.jks"<br>
> keystorePass="PASSWORD" /><br>
><br>
> to<br>
><br>
> <Connector port="8443"<br>
> protocol="org.apache.coyote.http11.Http11Protocol"<br>
><br>
> SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"<br>
> scheme="https"<br>
> SSLEnabled="true"<br>
> clientAuth="false"<br>
> keystoreFile="IDP_HOME/credentials/idp.jks"<br>
> keystorePass="PASSWORD" /><br>
><br>
> it worked.<br>
><br>
> Stephan<br>
><br>
><br>
><br>
> 2012/6/16 Chad La Joie <<a href="mailto:lajoie@itumi.biz" target="_blank">lajoie@itumi.biz</a>><br>
>><br>
>> First, be sure you're using the actual Shibboleth documentation not some<br>
>> third party document.<br>
>><br>
>> Second, turn on logging for the LDAP library and see what it says.<br>
>><br>
>> On 6/16/12 11:06 AM, Stephan Hackstedt wrote:<br>
>> > Hi,<br>
>> ><br>
>> > I'm new to Shibboleth and trying to setup a test environment on a single<br>
>> > Windows / x64 machine.<br>
>> > I followed some tutorials. Now I'm at a point where I'm trying to access<br>
>> > a ressource on the SP. The redirection to the IdP loginpage works fine.<br>
>> > But I cannot login, no matter if I use the right user/pw combination or<br>
>> > not.<br>
>> > I'm using LDAP as storage for the user data.<br>
>> > I tested two different LDAP Systems (APacheDS, OpenDS) but I couldnt get<br>
>> > it to work. The same error with both.<br>
>> ><br>
>> > The connection to the LDAP service can be established successfull on IdP<br>
>> > Startup, but after redirection and typing username and passwort at the<br>
>> > login screen Shibboleth IdP always gives the message "Credentials not<br>
>> > recognized".<br>
>> > Are there other configuration files, beside login.conf and<br>
>> > attribute-resolver,xmlm which I need to consider?<br>
>> ><br>
>> > It would be nice, if some has a hint for me regarding my problem, My<br>
>> > progress really stucks.<br>
>> ><br>
>> > conf snippets:<br>
>> ><br>
>> ><br>
>> > attribute-resolver.xml:<br>
>> > *<br>
>> > <!-- Example LDAP Connector for OpenDS--><br>
>> > <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br>
>> > ldapURL="ldap://<a href="http://127.0.0.1:12389" target="_blank">127.0.0.1:12389</a> <<a href="http://127.0.0.1:12389" target="_blank">http://127.0.0.1:12389</a>>"<br>
>> > baseDN="ou=people,dc=example,dc=com"<br>
>> > principal="cn=Directory Manager"<br>
>> > principalCredential="secret2"><br>
>> > <dc:FilterTemplate><br>
>> > <![CDATA[<br>
>> > (uid=$requestContext.principalName)<br>
>> > ]]><br>
>> > </dc:FilterTemplate>*<br>
>> ><br>
>> > login.config:<br>
>> ><br>
>> > *ShibUserPassAuth {<br>
>> > edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
>> > host="127.0.0.1"<br>
>> > base="ou=people,dc=example,dc=com"<br>
>> > bindDn ="cn=Directory Manager"<br>
>> > bindCredential="secret2"<br>
>> > port="12389"<br>
>> > ssl="false"<br>
>> > tls="false"<br>
>> > userField="uid";<br>
>> > };*<br>
>> ><br>
>> > Regards,<br>
>> > Stephan<br>
>> ><br>
>> ><br>
>> > --<br>
>> > To unsubscribe from this list send an email to<br>
>> > <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
>> ><br>
>><br>
>> --<br>
>> Chad La Joie<br>
>> <a href="http://www.itumi.biz" target="_blank">www.itumi.biz</a><br>
>> trusted identities, delivered<br>
>><br>
>><br>
>> --<br>
>> To unsubscribe from this list send an email to<br>
>> <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
><br>
><br>
><br>
> --<br>
> To unsubscribe from this list send an email to<br>
> <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
<br>
--<br>
Chad La Joie<br>
<a href="http://www.itumi.biz" target="_blank">www.itumi.biz</a><br>
trusted identities, delivered<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>