<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Mauro,<div><br></div><div>It seems to me like the authentication process is failing, and you're repeatedly prompted to reauthenticate after the first authentication fails. I have no idea where this authentication process would get logged, but the request likely never gets to the IdP at all, so no log entries in idp-process.log would not be surprising. Tomcat is notorious for eating logs, but catalina.out (and tomcat.log) in Tomcat's logs directory would not be a bad guess.</div><div><br></div><div>You shouldn't need to configure or use Apache. It can be used as a front-end for Tomcat, in which case it would be responsible for setting REMOTE_USER via some mechanism or module, but we don't recommend that deployment approach. 443 and 8443 are the only ports you should need open.</div><div><br></div><div>Thanks,</div><div>Nate.</div><div><br><div><div>On Sep 16, 2012, at 23:26 , Mauro Minella wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">I re-installed everything from scratch and now the situation is a little clearer, but still faulty.<br><br>To recap:<br>- I installed shib idp version 2.3.5<br>- I have Java 6U35 (see my previous thread "credentials not recognized" that I got with version 7)<br>- the ecp endpoint configured in my relying party (Office 365 Federation Gateway) is<span class="Apple-converted-space"> </span><a href="https://shibidp.eduteamit.com/idp/profile/SAML2/SOAP/ECP">https://shibidp.eduteamit.com/idp/profile/SAML2/SOAP/ECP</a><br>- passive authentication DOES work<br>- active client (Outlook 2010) keeps presenting the password request, endless<br>- if I try opening the ecp endpoint above, the browser pops up a dialog box with username/pwd request, which does NOT accept my credentials<br>- the failed ecp authentication attempts WERE logged with "ERROR: REMOTE_USER not set, unable to set principal name" BEFORE I updated default web.xml. After I updated it (as follows) and re-deployed/restarted tomcat, such ecp authentication requests are not tracked at all<br><br>Ideas (sorry if trivial):<br>- maybe apache should be configured too, in order to require Basic Auth for the ECP location?<br>- is Apache contacted even by the active clients, or should I make sure than another port is open, rather than 443 and 8443?<br></span></blockquote></div><br></div></body></html>