<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>I’m trying to implement two Username/Password login handlers so I can have two different LDAP configurations. One LDAP supports one-time passwords and the other does not. I’ve successfully been able to implement two RemoteUser login handlers so I’m not sure where I’m failing with the UserPass ones.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My configurations are:<o:p></o:p></p><p class=MsoNormal>handler.xml –<o:p></o:p></p><p class=MsoNormal> <ph:LoginHandler xsi:type="ph:UsernamePassword" <o:p></o:p></p><p class=MsoNormal> jaasConfigurationLocation="<a href="file:///\\opt%20\shibboleth\conf\tplogin.config">file:///opt /shibboleth/conf/tplogin.config</a>"><o:p></o:p></p><p class=MsoNormal> <ph:AuthenticationMethod>urn:mace:rit.edu:Authn:TPPasswordProtectedTransport</ph:AuthenticationMethod><o:p></o:p></p><p class=MsoNormal> </ph:LoginHandler><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>/opt /shibboleth/conf/tplogin.config exists with modifications based off the default login.config<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>web.xml - <o:p></o:p></p><p class=MsoNormal><servlet><o:p></o:p></p><p class=MsoNormal> <servlet-name>TPUsernamePasswordAuthHandler</servlet-name><o:p></o:p></p><p class=MsoNormal> <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class><o:p></o:p></p><p class=MsoNormal> <load-on-startup>3</load-on-startup><o:p></o:p></p><p class=MsoNormal> </servlet><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> <servlet-mapping><o:p></o:p></p><p class=MsoNormal> <servlet-name>TPUsernamePasswordAuthHandler</servlet-name><o:p></o:p></p><p class=MsoNormal> <url-pattern>/Authn/TPUserPassword</url-pattern><o:p></o:p></p><p class=MsoNormal> </servlet-mapping><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>relying-party.xml –<o:p></o:p></p><p class=MsoNormal> <rp:RelyingParty<o:p></o:p></p><p class=MsoNormal> id="<a href="https://sp.example.com">https://sp.example.com</a>"<o:p></o:p></p><p class=MsoNormal> provider="<a href="https://%3cshib-idp%3e/idp/shibboleth">https://<shib-idp>/idp/shibboleth</a>"<o:p></o:p></p><p class=MsoNormal> defaultSigningCredentialRef="IdPCredential"<o:p></o:p></p><p class=MsoNormal> defaultAuthenticationMethod="urn:mace:rit.edu:Authn:TPPasswordProtectedTransport"><o:p></o:p></p><p class=MsoNormal> <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"<o:p></o:p></p><p class=MsoNormal> encryptAssertions="never"<o:p></o:p></p><p class=MsoNormal> encryptNameIds="never" /><o:p></o:p></p><p class=MsoNormal> </rp:RelyingParty><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>IdP is version 2.3.2 (I know it’s not the latest version.)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>When trying to authenticate using IdP initiated SSO I get passed to /idp/Authn/UserPassword instead of /idp/Authn/TPUserPassword however /idp/Authn/TPUserPassword gives me the login form.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Another issue that might be related is that the wiki says that the LoginHandler element takes an optional parameter of authenticationServletURL however the IdP fails to start and gives the error:<o:p></o:p></p><p class=MsoNormal>12:50:50.006 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - [] - [] - Configuration was not loaded for shibboleth.HandlerManager service, error creating components. The root cause of this error was: org.xml.sax.SAXParseException: cvc-complex-type.3.2.2: Attribute 'protectedServletPath' is not allowed to appear in element 'ph:LoginHandler'.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My final thought is that I’m trying to implement this in the wrong way and gladly welcome anyone to tell me so.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>Clay Cooper<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>Systems Administrator<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>Information Technology Services<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt'>Rochester Institute of Technology <o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b><span style='font-size:7.0pt'>CONFIDENTIALITY NOTE</span></b><span style='font-size:7.0pt'>: The information transmitted, including attachments, is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this information.<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>