<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://4805/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi Mauro,<div><br></div><div>Not sure if you already resolved your issues, but I believe that the message in your log file:</div><div><br></div><div><span style="font-family: Calibri, sans-serif; font-size: 15px; ">No return endpoint available for relying party</span><span class="apple-converted-space" style="font-family: Calibri, sans-serif; font-size: 15px; "> </span><a href="urn:federation:MicrosoftOnline" style="color: purple; font-family: Calibri, sans-serif; font-size: 15px; ">urn:federation:MicrosoftOnline</a></div><div><br></div><div>has nothing to do with your setup but is related to an issue with Office 365.</div><div>When a user connects to Microsoft's IMAP server, for example, he/she sends a username and password for authentication that is subsequently relayed to the user's IdP using the SAML ECP profile. That is, a SOAP request is sent from Microsoft's servers to your IdP's ECP endpoint (using HTTP Basic authentication), e.g.</div><div><br></div><div><div><S:Envelope xmlns:S="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"></div><div> <S:Body></div><div> <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_73ffcfca-e08e-4a4c-88f5-2b8022c61bf2" IssueInstant="2012-10-11T12:06:28.0084232Z" Version="2.0" AssertionConsumerServiceIndex="2"></div><div> <saml:Issuer>urn:federation:MicrosoftOnline</saml:Issuer></div><div> </samlp:AuthnRequest></div><div> </S:Body></div><div></S:Envelope></div></div><div><br></div><div>The problem is (I think) that there is no ACS URL with index 2 listed in Microsoft's Windows Azure AD metadata at</div><div><a href="https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml">https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml</a></div><div><br></div><div>So when such a request is posted to your IDP, it has no idea what endpoint to return an authentication response to:</div><div><br></div><div><div>$ curl --data @request.xml -H 'Content-type: application/soap+xml;charset=UTF-8' -u myusername:mypassword <a href="http://idp.example.org/idp/profile/SAML2/SOAP/ECP">http://idp.example.org/idp/profile/SAML2/SOAP/ECP</a></div><div><env:Envelope xmlns:env="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"> <env:Body> <env:Fault> <faultcode>env:Client</faultcode> <faultstring>An error occurred processing the request.</faultstring> <detail/> </env:Fault> </env:Body></env:Envelope></div></div><div><br></div><div>Hence the log entry in your dip-process.log:</div><div><br></div><div><div>13:20:02.459 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429] - No return endpoint available for relying party urn:federation:MicrosoftOnline</div></div><div><br></div><div>I'm not very familiar with Shibboleth, so maybe someone more knowledgeable on this list may be able to confirm if this makes sense…</div><div><br></div><div>Cheers,</div><div>--</div><div>Joost van Dijk</div><div>SURFnet</div><div><br></div><div><br></div><div><br></div><div><div><div>On Oct 5, 2012, at 10:43 AM, Mauro Minella <<a href="mailto:Mauro.Minella@microsoft.com">Mauro.Minella@microsoft.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="white" lang="IT" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Before anyone replies, I can add an important piece to my last note: if I try authenticating with a NON-EXISTING user (</span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; "><a href="mailto:john.smithXYZ@shibdomain.eduteamit.com" style="color: purple; text-decoration: underline; ">john.smithXYZ@shibdomain.eduteamit.com</a></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">), I get the same error<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">WARNING: Login exception authenticating username "john.smithXYZ"<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">javax.security.auth.login.LoginException: Found more than (1) DN for: john.smithXYZ<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">at edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:167)<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">so this means that it’s NOT just a mis-configuration in login.config, and brings me back to the JAAS configuration file as I replied to Brent:<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><p class="MsoNormal" style="margin: 0cm 0cm 12pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><i><span lang="EN-US">You probably didn't need to do that (create a new JAAS application in your config). I didn't mean to take the VT LDAP example literally, it's just where they documented the user and role principal classes, etc. I'd just use the same app name and config that is used for the Shib IdP (ShibUserPassAuth). I think you already indicated that that was working as far as regular (non-ECP) authN goes, so no reason to add an additional thing to debug.</span></i><i><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p></o:p></span></i></p><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Actually the first thing I tried was to configure %java_home%\lib\security\java.security<span class="Apple-converted-space"> </span><b> </b>to use the same login.config file that I successfully use for passive authentication. However, if I do that (or even if duplicate login.config and point to its exact copy) I get the following error in catalina log:<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">SEVERE: Unexpected error<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">java.lang.SecurityException: Configuration Error: Can not specify multiple entries for ShibUserPassAuth<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">I guess this error could be workarounded since it means that login.config is loaded twice, however before doing that I wanted to make sure that this is the right way to go.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">So I duplicated it, renamed ShibUserPassAuth to ShibUserPassAuth2, updated server.xml and restarted Tomcat.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">This time, the active authentication fails as before (Outlooks shows the dialog box with username/password over and over) and the same catalina.log traces the following error<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">oct 04, 2012 12:23:50 AM org.apache.catalina.realm.JAASRealm authenticate<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">WARNING: Login exception authenticating username "aldo.minella"<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 35.4pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn<o:p></o:p></span></div></div>--<br>To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: purple; text-decoration: underline; ">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br></div></body></html>