<div dir="ltr"><div class="gmail_default" style>
<p class="" style="font-family:verdana,sans-serif;font-size:small"><span class="">I cannot duplicate our current IdP 2.4 configuration which uses </span><em style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;line-height:20px">/idpAuthn/RemoteUser </em>with Apache ajp_proxy to delegate authentication to our campus SSO portal as described here:</p><p class="" style><font face="verdana, sans-serif"><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthRemoteUser">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthRemoteUser</a></font><br></p><p class="" style><span style="font-family:verdana,sans-serif">In our test IdP v3, I have the following configuration:</span><br></p><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">/opt/shibboleth-idp/idp.properties<br></div><p class="" style="font-family:verdana,sans-serif;font-size:small"><span class="">
</span></p><p class="" style="font-family:verdana,sans-serif;font-size:small"></p><ul><li><span class="">idp.authn.flows</span><span class="">= </span><span class="">RemoteUser</span></li><li><span class="">idp.authn.flows.initial</span><span class=""> = </span><span class="">RemoteUser </span></li></ul><p></p></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Logs indicate REMOTE_USER is being used:</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><p class=""><span class="" style="background-color:rgb(217,234,211)">2015-05-16 17:37:05,610 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:135] - RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and headers []</span></p><p class=""><span class=""></span></p></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">But we get the following error:</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:271] - Profile Action SelectAuthenticationFlow: <span style="background-color:rgb(255,255,0)">No potential flows left to choose from, authentication will fail in the logs</span></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><span style="background-color:rgb(255,255,0)"><br></span></div><div class="gmail_default"><span style="background-color:rgb(255,255,255)"><font face="verdana, sans-serif">From the browser we see the following error:</font></span></div><div class="gmail_default"><span style="font-family:verdana,sans-serif;background-color:rgb(255,255,0)">Error from identity provider:</span></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
<p class=""><span class="" style="background-color:rgb(255,255,0)">Status: urn:oasis:names:tc:SAML:2.0:status:Requester</span></p>
<p class=""><span class="" style="background-color:rgb(255,255,0)">Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed</span></p>
<p class=""><span class="" style="background-color:rgb(255,255,0)">Message: An error occurred.</span></p></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">I've just attended the first IdP 3.0 Shib InstallFest and was unable to solve this issue during the class, although I was able to verify that our Tomcat and Apache httpd configuration (using ajp_proxy) is working correctly.</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Are there other files in /opt/shibboleth-idp/ I should update or other updates we are missing?</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Best,</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Kathy Wright</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">Clemson University</div><div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small"><p class=""><br></p><p class=""><span class=""><br></span></p><p class=""><span class=""><br></span></p><p class=""><span class=""><br></span></p></div>
</div>