<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
<div><br></div><div>
<p class="p1">I set up an IdP (2.3.8) and a SP (2.4.3) on one ubuntu 11.10 machine.</p>
<p class="p1">I get the example login panel in a browser to work properly when accessing documents.</p>
<p class="p2"><br></p>
<p class="p1">Now I'm trying to run the ECP profile. I keep exactly the same configuration except that :</p>
<p class="p3"><span class="s1">I'm using the python and shell client sample provided by: <span class="s2"><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/Contributions#Contributions-simplepython">https://wiki.shibboleth.net/confluence/display/SHIB2/Contributions#Contributions-simplepython</a></span></span></p><p class="p3"><span class="s1">and I added my own IdP endpoint : https://kamaji.idp.ch/idp/profile/SAML2/SOAP/ECP</span></p>
<p class="p2"><br></p>
<p class="p1">And the Idp.war file contains a web.xml file like the one described in :</p>
<p class="p3"><span class="s2"><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP</a></span></p>
<p class="p2"><br></p>
<p class="p1">ShibUserPassAuth is defined in the login.config file of the IdP as an LDAP authentication.(the same as the one used for the browser).</p>
<p class="p2"><br></p>
<p class="p1">When I run the example:</p>
<p class="p1">- the first request to the SP is fine ("request target from the SP") and it retrieves the relay_state and responseConsumer URL from the SP response.</p>
<p class="p1">- the second request to the IdP end point ( a POST with the user/password to /idp/profile/SAML2/SOAP/ECP ) is failing with a 401 error. I'm sure that the credentials are correct.</p><p class="p1">I got the same error if I'm using the shell example instead of the python example.</p>
<p class="p2"><br></p>
<p class="p1">Taking a look at the logs and the network through wireshark,, I see that :</p>
<p class="p2"><br></p>
<p class="p1">The POST being correctly sent to the right port through ajp to catalina .</p>
<p class="p1">The answer from catalina being a 401 error.</p>
<p class="p2"><br></p>
<p class="p1">I don't see any additional trace on the IdP side after that POST call.</p>
<p class="p2">I believed at this point that this URL would match the pattern provided in the security-constraint tag of the web.xml file and</p><p class="p2">then the authentication would be handled using the realm ShibUserPassAuth and the user/password provided in the data of the POST call.</p><p class="p2"><br></p>
<p class="p2">I am a beginner in that topic, I need some help to find out what is wrong in my configuration setup.</p><p class="p2"><br></p>
<p class="p1">Additional traces :</p><p class="p1"><br></p>
<p class="p1">-The packet of the POST call to Catalina as seen in Wireshark:</p>
<p class="p4">
<p class="p1">0000 00 00 03 04 00 06 00 00 00 00 00 00 00 00 08 00 ................ </p>
<p class="p1">0010 45 00 01 28 49 c0 40 00 40 06 f2 0d 7f 00 00 01 E..(I.@.@....... </p>
<p class="p1">0020 7f 00 00 01 8b 67 1f 49 1f 91 c4 db 36 ad 43 b0 .....g.I....6.C. </p>
<p class="p1">0030 80 18 04 01 ff 1c 00 00 01 01 08 0a 07 fd 8d 65 ...............e </p>
<p class="p1">0040 07 fd 8d 64 12 34 00 f0 02 04 00 08 48 54 54 50 ...d.4......HTTP </p>
<p class="p1">0050 2f 31 2e 31 00 00 1b 2f 69 64 70 2f 70 72 6f 66 /1.1.../idp/prof </p>
<p class="p1">0060 69 6c 65 2f 53 41 4d 4c 32 2f 53 4f 41 50 2f 45 ile/SAML2/SOAP/E </p>
<p class="p1">0070 43 50 00 00 09 31 32 37 2e 30 2e 30 2e 31 00 ff CP...127.0.0.1.. </p>
<p class="p1">0080 ff 00 0d 6b 61 6d 61 6a 69 2e 69 64 70 2e 63 68 ...kamaji.idp.ch </p>
<p class="p1">0090 00 01 bb 01 00 06 a0 03 00 08 69 64 65 6e 74 69 ..........identi </p>
<p class="p1">00a0 74 79 00 a0 08 00 03 36 38 36 00 a0 0b 00 0d 6b ty.....686.....k </p>
<p class="p1">00b0 61 6d 61 6a 69 2e 69 64 70 2e 63 68 00 a0 07 00 amaji.idp.ch.... </p>
<p class="p1">00c0 21 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 !application/x-w </p>
<p class="p1">00d0 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 ww-form-urlencod </p>
<p class="p1">00e0 65 64 00 a0 06 00 05 63 6c 6f 73 65 00 a0 0e 00 ed.....close.... </p>
<p class="p1">00f0 11 50 79 74 68 6f 6e 2d 75 72 6c 6c 69 62 2f 32 .Python-urllib/2 </p>
<p class="p1">0100 2e 37 00 08 00 12 44 48 45 2d 52 53 41 2d 41 45 .7....DHE-RSA-AE </p>
<p class="p1">0110 53 32 35 36 2d 53 48 41 00 0b 01 00 0a 00 0f 41 S256-SHA.......A </p>
<p class="p1">0120 4a 50 5f 52 45 4d 4f 54 45 5f 50 4f 52 54 00 00 JP_REMOTE_PORT.. </p>
<p class="p1">0130 05 35 33 39 32 39 00 ff .53929.. </p><p class="p1"><br></p></p>
<p class="p1">-The packet of the response from Catalina as seen in Wireshark:</p>
<p class="p2">
<p class="p1"><br></p><p class="p1">Apache JServ Protocol v1.3 </p>
<p class="p1"> Magic: 4142 </p>
<p class="p1"> Length: 136 </p>
<p class="p1"> Code: (4) SEND HEADERS </p>
<p class="p1"> RSTATUS: 401 </p>
<p class="p1"> RSMSG: Unauthorized </p>
<p class="p1"> NHDR: 0 </p>
<p class="p1"> </p>
<p class="p1">0000 00 00 03 04 00 06 00 00 00 00 00 00 00 00 08 00 ................ </p>
<p class="p1">0010 45 00 00 c0 ce d5 40 00 40 06 6d 60 7f 00 00 01 E.....@.@.m`.... </p>
<p class="p1">0020 7f 00 00 01 1f 49 8b 67 36 ad 43 b0 1f 91 c5 cf .....I.g6.C..... </p>
<p class="p1">0030 80 18 04 22 fe b4 00 00 01 01 08 0a 07 fd 8d 65 ..."...........e </p>
<p class="p1">0040 07 fd 8d 65 41 42 00 88 04 01 91 00 0c 55 6e 61 ...eAB.......Una </p>
<p class="p1">0050 75 74 68 6f 72 69 7a 65 64 00 00 03 00 10 57 57 uthorized.....WW </p>
<p class="p1">0060 57 2d 41 75 74 68 65 6e 74 69 63 61 74 65 00 00 W-Authenticate.. </p>
<p class="p1">0070 1e 42 61 73 69 63 20 72 65 61 6c 6d 3d 22 53 68 .Basic realm="Sh </p>
<p class="p1">0080 69 62 55 73 65 72 50 61 73 73 41 75 74 68 22 00 ibUserPassAuth". </p>
<p class="p1">0090 00 0c 43 6f 6e 74 65 6e 74 2d 54 79 70 65 00 00 ..Content-Type.. </p>
<p class="p1">00a0 17 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 .text/html;chars </p>
<p class="p1">00b0 65 74 3d 75 74 66 2d 38 00 00 0e 43 6f 6e 74 65 et=utf-8...Conte </p>
<p class="p1">00c0 6e 74 2d 4c 65 6e 67 74 68 00 00 03 39 35 34 00 nt-Length...954. </p>
<p class="p1"> </p></p>
<p class="p2"><br></p>
<p class="p2"><br></p>
<p class="p1">Regards,</p>
<p class="p1">Jean-Denis</p></div> </div></body>
</html>