<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Console";
panose-1:2 11 6 9 4 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi, I started another thread on this alias several days ago, which led me to fix the errors to implement federation between my Shibboleth IDP (2.3.8, relying on AD) and Office365 (<a href="http://technet.microsoft.com/en-us/library/jj205456">http://technet.microsoft.com/en-us/library/jj205456</a>).
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">As a matter of facts, I’m now able to get any federated users (like mark.twain@shibbdomain.eduteamit.com) authenticated on Outlook Online (<a href="https://outlook.com">https://outlook.com</a>). As you know, this concerns
PASSIVE authentication.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’m now even able to try ECP authentication from ACTIVE clients, with apparently no errors on the server logs.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In fact, my users need to get authenticated even with ACTIVE clients (like Outlook 2010). I believe could setup ECP quite correctly, in fact when the users run the Outlook 2010 Wizard to create their profile, they enter
username (mark.twain@shibbdomain.eduteamit.com) + password (abc123ABC) and my Shibboleth IDP seems correctly authenticating them (pls see my logs below). However, on the client side it seems that the user is NOT authenticated because the username/password
dialog box keeps being presented.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I even tried building an application on TOMCAT which uses the same JAAS module and WEB.XML configuration and it does work.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Here are my logs below together with main configuration files, do you have any idea for better troubleshooting and identifying what’s wrong?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thank you for any hints.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Mauro<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">LOGIN.CONFIG:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US">ShibUserPassAuthJAAS {<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">// Example LDAP authentication<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">// See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> edu.vt.middleware.ldap.jaas.LdapLoginModule required<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> host="localhost"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> port="389"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> base="CN=Users,DC=shibdomain,DC=local"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> serviceCredential="***MYPWD***"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> serviceUser="adreader@shibdomain.local"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> subtreeSearch = "true"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> userField="sAMAccountName";<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">}<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">WEB.XML<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><security-constraint>
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <web-resource-collection><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <web-resource-name>ECP</web-resource-name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <http-method>GET</http-method><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <http-method>POST</http-method><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> </web-resource-collection><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <auth-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <role-name>*</role-name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> </auth-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <user-data-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <transport-guarantee>CONFIDENTIAL</transport-guarantee><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> </user-data-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""></security-constraint><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><!-- Define the Login Configuration for this Application --><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><login-config><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <auth-method>BASIC</auth-method><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <realm-name>ShibUserPassAuthJAAS</realm-name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""></login-config><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><!-- Security roles referenced by this web application --><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><security-role><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <description>The role that is required to access the ECP area</description><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <role-name>*</role-name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""></security-role><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US">%CATALINA_HOME%\conf\server.xml:<o:p></o:p></span></b></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""><Service name="Catalina"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console"">...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <Engine name="Catalina" defaultHost="localhost"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console""> <Realm className="org.apache.catalina.realm.JAASRealm"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:106.2pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console"">appName="ShibUserPassAuthJAAS"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:106.2pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console"">userClassNames="edu.vt.middleware.ldap.jaas.LdapPrincipal"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:106.2pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console"">roleClassNames="edu.vt.middleware.ldap.jaas.LdapRole"/><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console"">...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">--------- CATALINA.LOG: OUTLOOK AUTHENTICATION STARTS<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.authenticator.AuthenticatorBase invoke<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Security checking request POST /idp/profile/SAML2/SOAP/ECP<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.RealmBase findSecurityConstraints<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Checking constraint 'SecurityConstraint[ECP]' against POST /profile/SAML2/SOAP/ECP --> true<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.authenticator.AuthenticatorBase invoke<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Calling hasUserDataPermission()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.RealmBase hasUserDataPermission<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: User data constraint already satisfied<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.authenticator.AuthenticatorBase invoke<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Calling authenticate()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.JAASRealm authenticate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: JAASRealm login requested for username "mark.twain" using LoginContext for application "ShibUserPassAuthJAAS"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.JAASRealm authenticate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Login context created mark.twain<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.JAASRealm authenticate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: JAAS LoginContext created for username "mark.twain"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.JAASRealm createPrincipal<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Checking Principal "mark.twain[]" [edu.vt.middleware.ldap.jaas.LdapPrincipal]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.JAASRealm createPrincipal<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Principal "mark.twain" is a valid user class. We will use this as the user Principal.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.JAASRealm createPrincipal<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: No valid role Principals found.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.JAASRealm authenticate<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Username "mark.twain" successfully authenticated as Principal "{1}" -- Subject was created too<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.authenticator.AuthenticatorBase register<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Authenticated 'mark.twain' with type 'BASIC'<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.authenticator.AuthenticatorBase invoke<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Calling accessControl()<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.RealmBase hasResourcePermission<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Checking roles GenericPrincipal[mark.twain()]<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.RealmBase hasRole<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Username mark.twain has role *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.realm.RealmBase hasResourcePermission<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Role found: *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">nov 03, 2012 8:05:42 PM org.apache.catalina.authenticator.AuthenticatorBase invoke<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">FINE: Successfully passed all security constraints<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">--------- CATALINA.LOG: OUTLOOK AUTHENTICATION ENDS<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">--------- IDP-PROCESS.LOG: OWA AUTHENTICATION STARTS<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">20:04:01.708 - INFO [Shibboleth-Access:74] - 20121103T190401Z|87.24.1.141|shibbidp.eduteamit.com:443|/profile/SAML2/POST/SSO|<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">20:04:06.562 - INFO [Shibboleth-Access:74] - 20121103T190406Z|87.24.1.141|shibbidp.eduteamit.com:443|/profile/SAML2/POST/SSO|<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">20:04:06.843 - INFO [Shibboleth-Audit:989] - 20121103T190406Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_dda45ee1-e6db-4dc4-9644-7670678dd8ed|urn:federation:MicrosoftOnline|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://shibbidp.eduteamit.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_b2dfd7f1a6f46b1cb1502509397305be|mark.twain|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|transientId,eduPersonScopedAffiliation,UserId,eduPersonTargetedID.old,ImmutableID,eduPersonTargetedID,|5GVHEfZRJ0i+fJqtxP0Jrg==|_ffb79c621871e371aa07b3c4359d9175,|<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">--------- IDP-PROCESS.LOG: OUTLOOK AUTHENTICATION STARTS<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">20:05:42.483 - INFO [Shibboleth-Access:74] - 20121103T190542Z|157.56.252.5|shibbidp.eduteamit.com:443|/profile/SAML2/SOAP/ECP|<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">20:05:42.858 - INFO [Shibboleth-Audit:989] - 20121103T190542Z|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_8c62ad9c-52bf-448c-bf97-2d60b9d51c8a|urn:federation:MicrosoftOnline|urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp|https://shibbidp.eduteamit.com/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:SOAP|_dd9639a0044b3825230446ed3501dd58|mark.twain||transientId,eduPersonScopedAffiliation,UserId,eduPersonTargetedID.old,ImmutableID,eduPersonTargetedID,|_1e62f11837be4ed0a01df02b68f521af|_74f97d433963aadfb9aa72e2400ee844,|<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>