<div dir="ltr"><div class="gmail_default"><font face="verdana, sans-serif"><font color="#000000">Thanks to all who responded and to Mark Mercado at UM-Flint and Walter</font> Hoehn at Memphis <span style="color:rgb(0,0,0)">for helping me finally get this working.</span></font></div><div class="gmail_default"><span style="color:rgb(0,0,0)"><font face="verdana, sans-serif"><br></font></span></div><div class="gmail_default"><font color="#000000" face="verdana, sans-serif">Our config contained trailing spaces after "RemoteUser" in </font><span style="font-family:verdana,sans-serif">%{idp.home}/conf/</span><span style="font-family:verdana,sans-serif">idp.</span><span style="font-family:verdana,sans-serif">properties. </span></div><div class="gmail_default">
<p></p><ul><li><font face="verdana, sans-serif"><span>idp.authn.flows</span><span>=</span><span>RemoteUser</span><br></font></li><li><font face="verdana, sans-serif"><span style="background-color:rgb(255,255,255)"><span>idp.authn.flows.initial</span><span>= </span><span>RemoteUser </span></span><br></font></li></ul><p></p><p><span><font face="verdana, sans-serif">
</font></span></p><p><span style="color:rgb(0,0,0);font-family:verdana,sans-serif">Extra white spaces are not trimmed from values entered into idp.properties. </span><font face="verdana, sans-serif">After eliminating the trailing spaces, the config worked.</font></p><p><span style="font-family:verdana,sans-serif">Our implementation uses Tomcat8/Java8/Apache-mod_ajp_proxy. </span></p><p><span style="font-family:verdana,sans-serif">Thanks to Walter for helping me identify our idp servlet was properly protected and sending Remote User</span><span style="font-family:verdana,sans-serif"> to the idp.</span><br></p></div><div class="gmail_extra"><div class="gmail_default"><br></div><div class="gmail_default"><font face="verdana, sans-serif">Best,</font></div><div class="gmail_default"><font face="verdana, sans-serif">Kathy</font></div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, May 18, 2015 at 8:22 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">* Kathy E. Wright <<a href="mailto:kewrig@clemson.edu" target="_blank">kewrig@clemson.edu</a>> [2015-05-17 01:01]:<br>
<span>> I cannot duplicate our current IdP 2.4 configuration which uses<br>
</span>> */idpAuthn/RemoteUser *with Apache ajp_proxy to delegate authentication to<br>
<span>> our campus SSO portal as described here:<br>
</span>[...]<br>
<span>> From the browser we see the following error:<br>
> Error from identity provider:<br>
><br>
> Status: urn:oasis:names:tc:SAML:2.0:status:Requester<br>
><br>
> Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed<br>
<br>
</span>Look at httpd's access log (for the correct vhost that proxies to your<br>
Java servlet container) to make sure REMOTE_USER is set. The value is<br>
written to the access log by default.<br>
<span><font color="#888888">-peter<br>
</font></span><div><div>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr">
<p><font face="verdana, sans-serif" size="2">Infrastructure & Ops<br></font><span style="font-family:verdana,sans-serif;font-size:small">CCIT, 340 Computer Court<br></span><span style="font-family:verdana,sans-serif;font-size:small">Anderson, SC 29625<br></span><a href="mailto:kewrig@clemson.edu" style="font-family:verdana,sans-serif;font-size:small" target="_blank">kewrig@clemson.edu</a><u><br></u><span style="font-family:verdana,sans-serif;font-size:small"><a href="tel:%28864%29%20656-8133" value="+18646568133" target="_blank">(864) 656-8133</a></span></p></div></div>
</div></div>