<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 9/28/12 7:35 PM, Mauro Minella
wrote:<span style="font-size:12.0pt;font-family:"Times New
Roman","serif";color:black;mso-fareast-language:IT"
lang="EN"><b></b><o:p></o:p></span></div>
<blockquote
cite="mid:29E7B8530496AB4089D46F3537AF3A2E265BFD@DB3EX14MBXC325.europe.corp.microsoft.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"
style="mso-margin-top-alt:0cm;margin-right:21.0pt;margin-bottom:0cm;margin-left:39.0pt;margin-bottom:.0001pt;background:white"><span
style="font-size:12.0pt;font-family:"Times New
Roman","serif";color:black;mso-fareast-language:IT"
lang="EN">REMOTE_USER is:
<b><a class="moz-txt-link-freetext" href="https://shibidp.eduteamit.com/idp/shibboleth!https://sp.testshib.org/shibboleth-sp!TCu0M2sm2tRa06I+AzsNNzN2bj8=">https://shibidp.eduteamit.com/idp/shibboleth!https://sp.testshib.org/shibboleth-sp!TCu0M2sm2tRa06I+AzsNNzN2bj8=</a></b><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">********************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN">Please note the last line,
saying that REMOTE_USER does contain some pieces of
information.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</blockquote>
<br>
That's just because the TestShib SP is configured to populate
REMOTE_USER with another attribute. This has nothing to do with you
getting ECP working on the IdP side.<br>
<br>
<br>
<blockquote
cite="mid:29E7B8530496AB4089D46F3537AF3A2E265BFD@DB3EX14MBXC325.europe.corp.microsoft.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Then, since I need ECP
extension for my Outlook 2010 (which is an ACTIVE CLIENT), I
followed the guide on
</span><a moz-do-not-send="true"
href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP"><span
lang="EN-US">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP</span></a>
<span lang="EN-US">to </span><span lang="EN-US">build the
excerpt below, </span></p>
</div>
</blockquote>
<br>
As that wiki page tries to make clear, the main task in configuring
authentication for ECP is to configure your web server or container
with an authentication mechanism. It does *not* use the
authentication framework used by other profile handlers in the IdP
(i.e. the LoginHandlers).<br>
<br>
So updating the IdP web.xml is necessary, but not sufficient. Since
you mentioned using the Tomcat servlet container, and assuming you
don't have Apache or another web server in front of it, you need to
configure a Tomcat Realm to protect the ECP profile handler
endpoint.<br>
<br>
<a class="moz-txt-link-freetext" href="http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html">http://tomcat.apache.org/tomcat-6.0-doc/realm-howto.html</a><br>
<br>
Since I believe you said you were using Active Directory as an LDAP
authN source, you can use either the JNDIRealm or the JAASRealm with
an LDAP JAAS module. For the latter I believe you can reuse the
JAAS configuration you may have configured for the UsernamePassword
LoginHandler, but you do need to declare the Realm separately in
Tomcat. Tomcat's config is not related to the IdP's configuration
in any way.<br>
<br>
<br>
<span lang="EN-US"><o:p></o:p></span>
<blockquote
cite="mid:29E7B8530496AB4089D46F3537AF3A2E265BFD@DB3EX14MBXC325.europe.corp.microsoft.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US"><o:p> <br>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">01:08:44.394 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SAML2ECPProfileHandler:408]
- REMOTE_USER not set, unable to set principal name</span></p>
</div>
</blockquote>
<br>
<br>
This most certainly means you have not successfully protected the
endpoint
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
"/idp/profile/SAML2/SOAP/ECP" with some kind of web server or
container authentication mechanism that populates REMOTE_USER.<br>
<br>
<br>
<br>
<span lang="EN-US"><o:p></o:p></span>
<blockquote
cite="mid:29E7B8530496AB4089D46F3537AF3A2E265BFD@DB3EX14MBXC325.europe.corp.microsoft.com"
type="cite">
<div class="WordSection1">
<p class="MsoListParagraph"
style="text-indent:-18.0pt;mso-list:l0 level1 lfo2"><!--[if !supportLists]--><span
lang="EN-US"><span style="mso-list:Ignore">-<span
style="font:7.0pt "Times New Roman"">
</span></span></span><!--[endif]--><span lang="EN-US">Help
me understanding if the excerpt above, which I wrote in
C:\Program Files
(x86)\Internet2\Shib2IdPInstall\src\main\webapp\WEB-INF\web.xml,
is correct with regards to values I used for federation
($passiveLogOnUri, $activeLogOnUri, …) described at the
beginning of this message?</span></p>
</div>
</blockquote>
<br>
<br>
It may or may not be correct, depending on what web server or
container authentication mechanism you use. But the important thing
is that it is not sufficient, you need to configure your web server
or container.<br>
<br>
<br>
</body>
</html>