<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>I put something together related to IDP 3.0 ECP using REMOTE_USER and Apache-managed authentication at</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/IDP30/IDP3+ECP+with+Tomcat+and+Apache-Managed+Authentication">https://wiki.shibboleth.net/confluence/display/IDP30/IDP3+ECP+with+Tomcat+and+Apache-Managed+Authentication</a></div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>"Kathy E. Wright" <<a href="mailto:kewrig@clemson.edu">kewrig@clemson.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Saturday, May 16, 2015 at 6:00 PM<br>
<span style="font-weight:bold">To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>How to /Authn/RemoteUser with IdP 3.0<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div class="gmail_default" style="">
<p class="" style="font-family:verdana,sans-serif;font-size:small"><span class="">I cannot duplicate our current IdP 2.4 configuration which uses </span><em style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;line-height:20px">/idpAuthn/RemoteUser </em>with
Apache ajp_proxy​ to delegate authentication to our campus SSO portal as described here:</p>
<p class="" style=""><font face="verdana,sans-serif"><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthRemoteUser">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthRemoteUser</a></font><br>
</p>
<p class="" style=""><span style="font-family: verdana, sans-serif;">In our test IdP v3, I have the following configuration:</span><br>
</p>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
/opt/shibboleth-idp/idp.properties<br>
</div>
<p class="" style="font-family:verdana,sans-serif;font-size:small"><span class=""></span></p>
<p class="" style="font-family:verdana,sans-serif;font-size:small"></p>
<ul>
<li><span class="">idp.authn.flows</span><span class="">= </span><span class="">RemoteUser</span></li><li><span class="">idp.authn.flows.initial</span><span class=""> = </span><span class="">RemoteUser </span></li></ul>
<p></p>
</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
Logs indicate REMOTE_USER is being used:</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
<p class=""><span class="" style="background-color:rgb(217,234,211)">2015-05-16 17:37:05,610 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:135] - RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and headers []</span></p>
<p class=""><span class=""></span></p>
</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
But we get the following error:</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:271] - Profile Action SelectAuthenticationFlow: <span style="background-color:rgb(255,255,0)">No potential flows left to choose from, authentication will fail in the logs</span></div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
<span style="background-color:rgb(255,255,0)"><br>
</span></div>
<div class="gmail_default"><span style="background-color:rgb(255,255,255)"><font face="verdana,sans-serif">From the browser we see the following error:</font></span></div>
<div class="gmail_default"><span style="font-family: verdana, sans-serif; background-color: rgb(255, 255, 0);">Error from identity provider:</span></div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
<p class=""><span class="" style="background-color:rgb(255,255,0)">Status: urn:oasis:names:tc:SAML:2.0:status:Requester</span></p>
<p class=""><span class="" style="background-color:rgb(255,255,0)">Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed</span></p>
<p class=""><span class="" style="background-color:rgb(255,255,0)">Message: An error occurred.</span></p>
</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
<br>
</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
I've just attended the first IdP 3.0 Shib InstallFest and was unable to solve this issue during the class, although I was able to verify that our Tomcat and Apache httpd configuration (using ajp_proxy) is working correctly.</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
<br>
</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
Are there other files in /opt/shibboleth-idp/ I should update or other updates we are missing?</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
<br>
</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
Best,</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
Kathy Wright</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
Clemson University</div>
<div class="gmail_default" style="font-family:verdana,sans-serif;font-size:small">
<p class=""><br>
</p>
<p class=""><span class=""><br>
</span></p>
<p class=""><span class=""><br>
</span></p>
<p class=""><span class=""><br>
</span></p>
</div>
</div>
</div>
</div>
</span>
</body>
</html>