<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi:<br>
<br>
I think I used apache with mod_auth_kerb, combined with "remote
user" authentication.<br>
<br>
First get mod_auth_kerb working by creating some directory on your
apache (say /secure) and get it protected. There are lots of docs
on the internet.<br>
<br>
Basically: create a keytab on the AD server for
HTTP/your.server.name, and export it and put it "somewhere" on your
IDP with the right permissions and possibly the right selinux
security context. Configure in apache .conf file. Make sure this is
working.<br>
<br>
Second, use the RemoteUserAuthnConfiguration, standard. I *think*
you need to set tomcatAuthentication=false in your server.xml
(assuming you are running the IdP in tomcat) or else it will ignore
the passed credential information received from apache over the ajp
link.<br>
<br>
This is all from memory. My test IdP is currently unavalable.<br>
<br>
-- <br>
Thanks,<br>
David Mansfield<br>
Cobite,<br>
<br>
<br>
<div class="moz-cite-prefix">On 03/03/2015 11:14 AM, Arnal, Pascal
wrote:<br>
</div>
<blockquote
cite="mid:B3D035DFCB70254294E9485D5B9BFF500CFB197E11@CPW1-EXCH-MB4.capitale.qc.ca"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-CA">I would like to use my
Windows Authentication with Shibboleth IDP V3 AND Shibboleth
SP V2.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">I followed the
documentation <a moz-do-not-send="true"
href="https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">When I want to access my
application, the login page of the IDP is displayed and
after I filled my credentials, my application is accessible.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Now I would like to use
my Windows Authentication and the Kerberos Token for not
fill again my credential.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Is-it possible, and how
please ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA">Thanks<o:p></o:p></span></p>
</div>
<br>
<hr>
<font size="1" color="Gray" face="Arial">AVIS: Ce courriel
privilégié et confidentiel est destiné à la seule personne ou
entité à laquelle il est adressé. Pour toute autre personne,
toute action prise en rapport à ce courriel ainsi que toute
lecture, reproduction, transmission et/ou divulgation d'une
partie ou de l'ensemble de celui-ci est interdite. Si vous
n'êtes pas la personne autorisée à recevoir ce courriel, S.V.P.
le retourner à l'expéditeur et le détruire. Bien que ce courriel
ait été traité contre les virus, il est de la responsabilité du
destinataire de s'assurer que l'envoi en est exempt. Nos
communications avec vous peuvent contenir des renseignements
confidentiels ou protégés par le secret professionnel. Si vous
désirez que nous communiquions avec vous par un autre moyen de
transmission que le courrier électronique ordinaire non
sécurisé, veuillez nous en aviser.<br>
<br>
NOTICE: This privileged and confidential email is intended only
for the individual or entity to whom it is addressed. With
regard to all others, any action related with this email as well
as any reading, reproduction, transmission and/or dissemination
in whole or in part of the information included in this email is
prohibited. If you are not the addressee, immediately return the
email to sender prior to destroying all copies. Even if this
email is believed to be free from any virus, it is the
responsibility of the recipient to make sure that it is virus
exempt. Our communications to you may contain confidential
information or information protected under solicitor-client
privilege. Please advise if you wish us to use a mode of
communication other than regular, unsecured e-mail in our
communications with you.<br>
</font>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>