<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas","serif";
color:black;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Christopher,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Ok.. so I am about to open up an old wound again but I need some help finalizing the creation of a duplicate UserPassword login handler as mentioned below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Here is what I have done so far and what is working and not working.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I created a duplicate entry in the handler.xml file like this<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Original Userpassword:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><ph:LoginHandler xsi:type="ph:UsernamePassword" jaasConfigurationLocation="file:///opt/shibboleth/idp/current/conf/login.config" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:ph="urn:mace:shibboleth:2.0:idp:profile-handler"><ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod></ph:LoginHandler><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Duplicate entry<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><ph:LoginHandler xsi:type="ph:UsernamePassword" jaasConfigurationLocation="file:///opt/shibboleth/idp/current/conf/login.config" authenticationServletURL="/Authn/UserVPassword"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ph="urn:mace:shibboleth:2.0:idp:profile-handler"><ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:VPasswordProtectedTransport</ph:AuthenticationMethod></ph:LoginHandler><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I then created an entry in the login.config with the name “test” that contained the LDAP information for LDAP2.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I then edited the web.xml to include this<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><servlet xmlns="http://java.sun.com/xml/ns/j2ee"><servlet-name>UsernameVPasswordAuthHandler</servlet-name><servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class><init-param><param-name>jaasConfigName</param-name><param-value>test</param-value></init-param><load-on-startup>3</load-on-startup></servlet><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><servlet-mapping xmlns="http://java.sun.com/xml/ns/j2ee"><servlet-name>UsernameVPasswordAuthHandler</servlet-name><url-pattern>/Authn/UserVPassword</url-pattern></servlet-mapping><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">So now I made the entry for Test Shib in my relying party to default Authentication method urn:oasis:names:tc:SAML:2.0:ac:classes:VPasswordProtectedTransport<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">When I use Test Shib I am directed to idp/Authn/UserVPassword and the login page is displayed. When I enter my credentials it fails… and I see in the log<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">08:14:07.967 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:177] - User authentication for brewerel failed<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">javax.security.auth.login.LoginException: No LoginModules configured for test<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I have also tried changing jaasConfigurationLocation in the second entry to a different file (leaving ShibUserPassAuth for the name) and dropping the init-param
and that makes it use the original file and LDAP1 to auth….<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">So, any suggestions.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I know that some of you are tempted to repeat your objections that were stated early. I respect your opinions and they have not fallen on deaf ears. I have
a task at hand I would not like to fail…. So, if there is a technical reason why this will not work then I would like to know.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks again,<br>
Lee<o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Christopher Bongaarts<br>
<b>Sent:</b> Thursday, August 22, 2013 4:34 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: Question on Login Handlers<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 8/22/2013 4:18 PM, Brewer, Edward L wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="color:#1F497D">*</span>One possibility would be to use two login handlers, one configured for LDAP1 (default) and one for LDAP2 (selectable with a particular
<span style="color:#1F497D">*</span>authentication method you dream up). Then ask the new app to request that authentication method (or define a separate RelyingParty for them with
<span style="color:#1F497D">*</span>that as their default auth method). <br>
<br>
<span style="color:#1F497D">I thought I could, but I was having a hard time figuring out how that would work. Currently I have two login handlers configured.. one of type UserPassword and the other PreviousSession. So, can I create another login handler like
UserPassord.. with a different login config file? How would I add it to the handler.xml?</span><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
See <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass">
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass</a> for specifics and gotchas:<br>
<br>
Duplicate the existing UserPassword login handler definition, and change the jassConfigurationLocation attribute to the alternate configuration file (this is the part I'm not sure about since I don't use it myself, there might be issues with this...) and change
the AuthenticationMethod element content to be the alternate name you make up (since it's a URI, using
<a href="https://www.vanderbilt.edu/shibboleth/authmethods/xxxxx">https://www.vanderbilt.edu/shibboleth/authmethods/xxxxx</a> might be a good name). Use this name in your RelyingParty for the rogue SP in the defaultAuthMethod attribute. The wiki page also
says you might need an "init" parameter to the servlet definition in web.xml if you want your made-up auth method identified in the SAML response to the SP.<br>
<br>
<o:p></o:p></p>
<pre>-- <o:p></o:p></pre>
<pre>%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu">cab@umn.edu</a> %%<o:p></o:p></pre>
<pre>%% OIT - Identity Management %% <a href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%<o:p></o:p></pre>
<pre>%% University of Minnesota %% +1 (612) 625-1809 %%<o:p></o:p></pre>
</div>
</body>
</html>