<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">________________________________________<br>
From: users-bounces@shibboleth.net [users-bounces@shibboleth.net] on behalf of Nate Klingenstein [ndk@internet2.edu]<br>
Sent: Tuesday, June 11, 2013 6:25 PM<br>
To: Shib Users<br>
Subject: Re: open ports / version mismatch<br>
<br>
<br>
> I guess if I had to grasp at a straw, I'd see if the SP's that the IdP is working with successfully are including a desired authentication method of
<br>
> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport with their requests, as Eric alluded to, while your SP is not specifying a desired authentication method in its
<br>
> requests, and the IdP has both ph:RemoteUser and ph:UsernamePassword uncommented and using the default configuration.<br>
<br>
He sent me his handlers.xml; your guess seems to be correct, as far as I can read this https://gist.github.com/tingletech/5767470
<div><br>
</div>
<div>
<pre class="line-pre" style="font-family: Consolas, 'Liberation Mono', Courier, monospace; font-size: 12px; line-height: 16px; width: 1022px; margin-top: 0px; margin-bottom: 0px; padding: 0px; background-color: rgb(255, 255, 255); "><div class="line" id="file-handlers-xml-LC67"> <span class="c" style="color: rgb(153, 153, 136); font-style: italic; "><!-- Login Handlers --></span></div><div class="line" id="file-handlers-xml-LC68"> <span class="nt" style="color: navy; "><ph:LoginHandler</span> <span class="na" style="color: teal; ">xsi:type=</span><span class="s" style="color: rgb(221, 17, 68); ">"ph:RemoteUser"</span><span class="nt" style="color: navy; ">></span></div><div class="line" id="file-handlers-xml-LC69"> <span class="nt" style="color: navy; "><ph:AuthenticationMethod></span>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified<span class="nt" style="color: navy; "></ph:AuthenticationMethod></span></div><div class="line" id="file-handlers-xml-LC70"> <span class="nt" style="color: navy; "></ph:LoginHandler></span></div><div class="line" id="file-handlers-xml-LC71"> </div><div class="line" id="file-handlers-xml-LC72"> <span class="c" style="color: rgb(153, 153, 136); font-style: italic; "><!-- Login handler that delegates the act of authentication to an external system. --></span></div><div class="line" id="file-handlers-xml-LC73"> <span class="c" style="color: rgb(153, 153, 136); font-style: italic; "><!-- This login handler and the RemoteUser login handler will be merged in the next major release. --></span></div><div class="line" id="file-handlers-xml-LC74"> <span class="c" style="color: rgb(153, 153, 136); font-style: italic; "><!--</span></div><div class="line" id="file-handlers-xml-LC75"><span class="c" style="color: rgb(153, 153, 136); font-style: italic; "> <ph:LoginHandler xsi:type="ph:ExternalAuthn"></span></div><div class="line" id="file-handlers-xml-LC76"><span class="c" style="color: rgb(153, 153, 136); font-style: italic; "> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod></span></div><div class="line" id="file-handlers-xml-LC77"><span class="c" style="color: rgb(153, 153, 136); font-style: italic; "> <ph:QueryParam name="foo" value="bar" /></span></div><div class="line" id="file-handlers-xml-LC78"><span class="c" style="color: rgb(153, 153, 136); font-style: italic; "> </ph:LoginHandler></span></div><div class="line" id="file-handlers-xml-LC79"><span class="c" style="color: rgb(153, 153, 136); font-style: italic; "> --></span></div><div class="line" id="file-handlers-xml-LC80"> </div><div class="line" id="file-handlers-xml-LC81"> <span class="c" style="color: rgb(153, 153, 136); font-style: italic; "><!-- Username/password login handler --></span></div><div class="line" id="file-handlers-xml-LC82"> </div><div class="line" id="file-handlers-xml-LC83"> <span class="nt" style="color: navy; "><ph:LoginHandler</span> <span class="na" style="color: teal; ">xsi:type=</span><span class="s" style="color: rgb(221, 17, 68); ">"ph:UsernamePassword"</span></div><div class="line" id="file-handlers-xml-LC84"> <span class="na" style="color: teal; ">jaasConfigurationLocation=</span><span class="s" style="color: rgb(221, 17, 68); ">"file:///apps/shibboleth-idp/conf/login.config"</span><span class="nt" style="color: navy; ">></span></div><div class="line" id="file-handlers-xml-LC85"> <span class="nt" style="color: navy; "><ph:AuthenticationMethod></span>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<span class="nt" style="color: navy; "></ph:AuthenticationMethod></span></div><div class="line" id="file-handlers-xml-LC86"> <span class="nt" style="color: navy; "></ph:LoginHandler></span></div></pre>
<br>
<br>
> If my straw is the correct one, the best fix in this case would probably be for the IdP to comment out the RemoteUser login handler.</div>
<div><br>
</div>
<div>I'm not sure I'm going to have any luck convincing him anything is wrong with this configuration since it works with other SPs he has tested with. He can not provide me with any configuration information for these SPs that work with this IdP; and Scott
suggested I should not change my SP to accommodate this IdP configuration.</div>
<div><br>
</div>
<div>Testing the SP with this IdP seems to be on some checklist as a pre-reqresite to them registering my SP metadata with InCommon. Do you think testing with testshib.org is a good enough test?<br>
<br>
</div>
</div>
</body>
</html>