<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
Hi:<br>
<br>
Did you find the AJP connector settings in your server.xml and
change it to make sure tomcatAuthentication="false" is specified?<br>
<br>
Mine looks like:<br>
<br>
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443"
<br>
tomcatAuthentication="false" /><br>
<br>
Also, here is my apache virtual host configuration:<br>
<br>
Listen idptest.mydomain.com:443<br>
<br>
<VirtualHost idptest.mydomain.com:443><br>
ServerName idptest.mydomain.com<br>
SslEngine on<br>
ProxyPass /idp ajp://localhost:8009/idp retry=0 flushpackets=auto<br>
ProxyPassReverse /idp ajp://localhost:8009/idp<br>
<br>
<Location /><br>
AuthType Kerberos<br>
AuthName "Enter Domain Credentials"<br>
Krb5Keytab /etc/httpd/conf/idptest.keytab<br>
KrbAuthRealms MYDOMAIN.COM<br>
Require valid-user<br>
KrbLocalUserMapping on<br>
# allow user of passwords<br>
KrbMethodK5Passwd on<br>
</Location><br>
</VirtualHost><br>
<br>
- David<br>
<br>
<br>
<div class="moz-cite-prefix">On 03/06/2015 11:19 AM, Arnal, Pascal
wrote:<br>
</div>
<blockquote
cite="mid:B3D035DFCB70254294E9485D5B9BFF500CFB407CB7@CPW1-EXCH-MB4.capitale.qc.ca"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-CA">“</span><span
lang="EN-CA">Second, use the RemoteUserAuthnConfiguration,
standard. I *think* you need to set
tomcatAuthentication=false in your server.xml (assuming you
are running the IdP in tomcat) or else it will ignore the
passed credential information received from apache over the
ajp link.</span><span style="color:#1F497D" lang="EN-CA">”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-CA">I
try to use this solution but I have one error <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-CA">[net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:121]
- Profile Action ValidateExternalAuthentication: External
authentication failed, no user identity or error information
returned<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-CA">Could
you explain me how to configure Apache httpd and Tomcat
together ?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-CA"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-CA">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-CA"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:FR-CA"
lang="FR">De :</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:FR-CA"
lang="FR"> <a class="moz-txt-link-abbreviated"
href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>
[<a class="moz-txt-link-freetext"
href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>]
<b>De la part de</b> David Mansfield<br>
<b>Envoyé :</b> 3 mars 2015 12:01<br>
<b>À :</b> <a class="moz-txt-link-abbreviated"
href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Objet :</b> Re: Kerberos Authentication<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi:<br>
<br>
I think I used apache with mod_auth_kerb, combined with
"remote user" authentication.<br>
<br>
First get mod_auth_kerb working by creating some directory on
your apache (say /secure) and get it protected. There are
lots of docs on the internet.<br>
<br>
Basically: create a keytab on the AD server for
HTTP/your.server.name, and export it and put it "somewhere" on
your IDP with the right permissions and possibly the right
selinux security context. Configure in apache .conf file.
Make sure this is working.<br>
<br>
Second, use the RemoteUserAuthnConfiguration, standard. I
*think* you need to set tomcatAuthentication=false in your
server.xml (assuming you are running the IdP in tomcat) or
else it will ignore the passed credential information received
from apache over the ajp link.<br>
<br>
This is all from memory. My test IdP is currently unavalable.<br>
<br>
-- <br>
Thanks,<br>
David Mansfield<br>
Cobite,<br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">On 03/03/2015 11:14 AM, Arnal, Pascal
wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">I would like to use my
Windows Authentication with Shibboleth IDP V3 AND
Shibboleth SP V2.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">I followed the
documentation <a moz-do-not-send="true"
href="https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/KerberosAuthnConfiguration</a></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">When I want to access
my application, the login page of the IDP is displayed and
after I filled my credentials, my application is
accessible.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Now I would like to
use my Windows Authentication and the Kerberos Token for
not fill again my credential.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Is-it possible, and
how please ?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Thanks</span><o:p></o:p></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;font-family:"Times New
Roman","serif";mso-fareast-language:FR-CA"><o:p> </o:p></span></p>
<div class="MsoNormal" style="text-align:center"
align="center"><span
style="font-size:12.0pt;font-family:"Times New
Roman","serif";mso-fareast-language:FR-CA">
<hr size="2" width="100%" align="center"> </span></div>
<p class="MsoNormal"><span
style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray;mso-fareast-language:FR-CA">AVIS:
Ce courriel privilégié et confidentiel est destiné à la
seule personne ou entité à laquelle il est adressé. Pour
toute autre personne, toute action prise en rapport à ce
courriel ainsi que toute lecture, reproduction,
transmission et/ou divulgation d'une partie ou de
l'ensemble de celui-ci est interdite. Si vous n'êtes pas
la personne autorisée à recevoir ce courriel, S.V.P. le
retourner à l'expéditeur et le détruire. Bien que ce
courriel ait été traité contre les virus, il est de la
responsabilité du destinataire de s'assurer que l'envoi en
est exempt. Nos communications avec vous peuvent contenir
des renseignements confidentiels ou protégés par le secret
professionnel. Si vous désirez que nous communiquions avec
vous par un autre moyen de transmission que le courrier
électronique ordinaire non sécurisé, veuillez nous en
aviser.<br>
<br>
NOTICE: This privileged and confidential email is intended
only for the individual or entity to whom it is addressed.
With regard to all others, any action related with this
email as well as any reading, reproduction, transmission
and/or dissemination in whole or in part of the
information included in this email is prohibited. If you
are not the addressee, immediately return the email to
sender prior to destroying all copies. Even if this email
is believed to be free from any virus, it is the
responsibility of the recipient to make sure that it is
virus exempt. Our communications to you may contain
confidential information or information protected under
solicitor-client privilege. Please advise if you wish us
to use a mode of communication other than regular,
unsecured e-mail in our communications with you.<br>
</span><span style="font-size:12.0pt;font-family:"Times
New
Roman","serif";mso-fareast-language:FR-CA"><br>
<br>
<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span
style="font-size:12.0pt;font-family:"Times New
Roman","serif";mso-fareast-language:FR-CA"><o:p> </o:p></span></p>
</div>
<br>
<hr> <font size="1" color="Gray" face="Arial">AVIS: Ce courriel
privilégié et confidentiel est destiné à la seule personne ou
entité à laquelle il est adressé. Pour toute autre personne,
toute action prise en rapport à ce courriel ainsi que toute
lecture, reproduction, transmission et/ou divulgation d'une
partie ou de l'ensemble de celui-ci est interdite. Si vous
n'êtes pas la personne autorisée à recevoir ce courriel, S.V.P.
le retourner à l'expéditeur et le détruire. Bien que ce courriel
ait été traité contre les virus, il est de la responsabilité du
destinataire de s'assurer que l'envoi en est exempt. Nos
communications avec vous peuvent contenir des renseignements
confidentiels ou protégés par le secret professionnel. Si vous
désirez que nous communiquions avec vous par un autre moyen de
transmission que le courrier électronique ordinaire non
sécurisé, veuillez nous en aviser.<br>
<br>
NOTICE: This privileged and confidential email is intended only
for the individual or entity to whom it is addressed. With
regard to all others, any action related with this email as well
as any reading, reproduction, transmission and/or dissemination
in whole or in part of the information included in this email is
prohibited. If you are not the addressee, immediately return the
email to sender prior to destroying all copies. Even if this
email is believed to be free from any virus, it is the
responsibility of the recipient to make sure that it is virus
exempt. Our communications to you may contain confidential
information or information protected under solicitor-client
privilege. Please advise if you wish us to use a mode of
communication other than regular, unsecured e-mail in our
communications with you.<br>
</font> <br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>