<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
I used X509 Authn with following versions:<br>
<br>
- apache 2.2.22 (debian)<br>
- tomcat 8.0.18<br>
- mod jk: libapache2-mod-jk 1:1.2.37-1+deb<br>
<br>
Location configuration in apache:<br>
<br>
<Location /idp/Authn/X509><br>
SSLVerifyClient require<br>
SSLVerifyDepth 1<br>
SSLOptions -StdEnvVars +ExportCertData<br>
</Location><br>
<br>
One suggestion: When initially configuring the environment, I used a
little jsp (independent from IdP) for testing client certificate
authn and cert info passing from apache to tomcat. The jsp has some
code to verify that a servlet can access the certificate
information, it can be something like:<br>
<br>
<%@ page import = "java.security.cert.*" %><br>
<%@ page import = "javax.security.auth.x500.*" %><br>
<% <br>
X509Certificate certs[] =
(X509Certificate[])request.getAttribute("javax.servlet.request.X509Certificate");
<br>
X509Certificate clientCert = certs[0];<br>
X500Principal subjectDN = clientCert.getSubjectX500Principal();<br>
%><br>
DN: <%=subjectDN.getName() %><br>
<br>
<br>
Regards<br>
Emilio<br>
<br>
<br>
<br>
El 05/04/2016 21:54, Pradeep Jamble escribió:
<blockquote
cite="mid:CANBbAotNrBcU8rTn1ySJFrjWtm2aAJD6Uf+azB0d37vrknAa7Q@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>Hello,<br>
<br>
</div>
Has anyone setup X509 Authn in IDP v3 via Apache front-end?
I keep getting this exception in Tomcat logs but nothing in
the IdP logs (with debug logs enabled) to indicate where
it's failing.<br>
<br>
Apr 05, 2016 3:19:23 AM
org.apache.catalina.core.StandardWrapperValve invoke<br>
SEVERE: Servlet.service() for servlet [X509AuthHandler] in
context with path [/idp] threw exception [Error processing
external authentication request] with root cause<br>
net.shibboleth.idp.authn.ExternalAuthenticationException: No
conversation state found in session for key (e1s1)<br>
<br>
</div>
<div>Here's what I've setup so far with Apache and
Tomcat/Shibboleth on the same host.<br>
<br>
-Enabled the authn flow in idp.properties<br>
</div>
<div>-Configured Apache for client certificate authentication<br>
</div>
<div>-Enabled Apache to forward request headers as well as
'+ExportCertData'<br>
<br>
</div>
<div>In Apache SSL logs, I see the cert has been validated and
authorization granted. So, I'm not quite sure where it's
broken. Initially, I thought it was an issue with Apache not
being able to validate client cert but from the SSL logs
looks like it's not the issue.<br>
<br>
</div>
<div>Any troubleshooting or configuration guidance is greatly
appreciated.<br>
</div>
<div><br>
</div>
Thanks in advance,<br>
</div>
Pradeep</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>