<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="IT" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks Brent,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I did one step forward, but I’m still stuck.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Starting from your suggestion<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">--></span><span lang="EN-US"> you need to configure a Tomcat Realm to protect the ECP profile handler endpoint (...) and you can reuse the JAAS
configuration you may have configured for the UsernamePassword LoginHandler, but you do need to declare the Realm separately in Tomcat</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I followed these steps:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">1. I created a link between Java and login.config that I’m successfully using for IDP passive authentication, so I modified %java_home%\lib\security\java.security
as follows (line #88):<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">--> login.config.url.1=file:C:\Program Files (x86)\Internet2\Shib2IdP/conf/login.config<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">2. Since login.config contains the following excerpt,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">********************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">ShibUserPassAuth {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> edu.vt.middleware.ldap.jaas.LdapLoginModule required<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> host="SHIBDOMAIN.LOCAL"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> port="389"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> base="CN=Users,DC=shibdomain,DC=local"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> serviceCredential="abc123ABC"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> serviceUser="adreader@shibdomain.local"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> subtreeSearch = "true"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> userField="userPrincipalName,uaIdentifier";<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">};<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">********************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">, I added the following code in
</span><code><span lang="EN-US" style="font-size:10.0pt">$CATALINA_BASE/conf/server.xml</span></code><span lang="EN-US">
</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> withing the <Engine> node:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><Realm className="org.apache.catalina.realm.JAASRealm" appName="ShibUserPassAuth"/><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Just for the records, I recall that this is the part I modified in </span><span lang="EN-US">ShibIdpInstall\src\main\webapp\WEB-INF\web.xml</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">
before re-building the IDP configuration. I suppose this should bind the ECP path to the realm, shouldn’t it:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">*****************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><security-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <display-name>Shibboleth IdP</display-name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <web-resource-collection><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <web-resource-name>ECP</web-resource-name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <http-method>GET</http-method><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <http-method>POST</http-method><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </web-resource-collection><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <auth-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <role-name>*</role-name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </auth-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <user-data-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <transport-guarantee>CONFIDENTIAL</transport-guarantee><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </user-data-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"></security-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><login-config><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <auth-method>BASIC</auth-method><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <realm-name>ShibUserPassAuth</realm-name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"></login-config><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">*****************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">3. I restarted Tomcat and tried authenticating with my active client (Outlook 2010): as a result, the following error is tracked in
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">*****************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">ott 01, 2012 6:24:06 PM org.apache.catalina.realm.JAASRealm authenticate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">SEVERE: Unexpected error<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">java.lang.SecurityException: Configuration Error:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> No such file or directory<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at com.sun.security.auth.login.ConfigFile.<init>(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.lang.reflect.Constructor.newInstance(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.lang.Class.newInstance0(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.lang.Class.newInstance(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at javax.security.auth.login.Configuration$3.run(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at javax.security.auth.login.Configuration$3.run(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.security.AccessController.doPrivileged(Native Method)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at javax.security.auth.login.Configuration.getConfiguration(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at javax.security.auth.login.LoginContext$1.run(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at javax.security.auth.login.LoginContext$1.run(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.security.AccessController.doPrivileged(Native Method)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at javax.security.auth.login.LoginContext.init(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at javax.security.auth.login.LoginContext.<init>(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.catalina.realm.JAASRealm.authenticate(JAASRealm.java:393)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.catalina.realm.JAASRealm.authenticate(JAASRealm.java:334)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.catalina.authenticator.BasicAuthenticator.authenticate(BasicAuthenticator.java:181)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:528)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at java.lang.Thread.run(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Caused by: java.io.IOException: Configuration Error:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> No such file or directory<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at com.sun.security.auth.login.ConfigFile.init(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> at com.sun.security.auth.login.ConfigFile.init(Unknown Source)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> ... 28 more<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">*****************<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I guess I’m not configuring the realm properly (for instance, I’m not setting userClassNames and roleClassNames because I did not add additional
classes), but I can’t believe I should write a new realm from scratch. Can’t I simply take the same realm that the IDP successfully uses, and put it in server.xml?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks so much for your help,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Mauro<o:p></o:p></span></p>
</div>
</body>
</html>