<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Hi, I was trying to get ECP working with Shibboleth IDPv3 and wanted to see if I was correct about the basic idea. Ultimately, I’d like to use Kerberos authentication, which should be supported via the Apache web server as well as Tomcat.</div>
<div><br>
</div>
<div>First, set up the endpoint /profile/SAML2/SOAP/ECP in the web.xml file, maybe like this:</div>
<div><br>
</div>
<div>
<div> <security-constraint></div>
<div> <display-name>Shibboleth IdP</display-name></div>
<div> <web-resource-collection></div>
<div> <web-resource-name>ECP</web-resource-name></div>
<div> <url-pattern>/profile/SAML2/SOAP/ECP</url-pattern></div>
<div> <http-method>GET</http-method></div>
<div> <http-method>POST</http-method></div>
<div> </web-resource-collection></div>
<div> <auth-constraint></div>
<div> <role-name>*</role-name></div>
<div> </auth-constraint></div>
<div> <user-data-constraint></div>
<div> <transport-guarantee>CONFIDENTIAL</transport-guarantee></div>
<div> </user-data-constraint></div>
<div> </security-constraint></div>
<div> <login-config></div>
<div> <auth-method>BASIC</auth-method></div>
<div> </login-config></div>
</div>
<div><br>
</div>
<div>Similar to the example at <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPEnableECP</a> except we won’t be hitting an LDAP server</div>
<div><br>
</div>
<div>Protect the endpoint in the Apache httpd configuration, sort of like:</div>
<div><br>
</div>
<div>
<div><Location /idp/profile/SAML2/SOAP/ECP></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>AuthType Kerberos</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>AuthName "ECP Shibboleth Identity Provider - ECP profile"</div>
<div> <span class="Apple-tab-span" style="white-space:pre"></span>KrbMethodNegotiate on</div>
<div> <span class="Apple-tab-span" style="white-space:pre"></span>KrbMethodK5Passwd off</div>
<div> <span class="Apple-tab-span" style="white-space:pre"></span>KrbAuthRealms ourrealm.edu</div>
<div> <span class="Apple-tab-span" style="white-space:pre"></span>Krb5Keytab "/path/to/krb5.keytab"</div>
<div> AuthName "ECP Shibboleth Identity Provider - ECP profile"</div>
<div> Require valid-user</div>
<div></Location></div>
</div>
<div><br>
</div>
<div>We want Apache to use Kerberos authentication and to allow any valid user in.</div>
<div><br>
</div>
<div>Assuming we get the "REMOTE_USER" successfully set, use the RemoteUserInternalAuthn configuration defined in IDP v3. See </div>
<div><a href="https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserInternalAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserInternalAuthnConfiguration</a></div>
<div><br>
</div>
<div>Is this the right idea?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Wendy</div>
</body>
</html>