<div dir="ltr"><div class="m_-5199599547815795679gmail_signature">Hi all,</div><div class="m_-5199599547815795679gmail_signature"> </div><div class="m_-5199599547815795679gmail_signature"> I am trying to do "Remote user authentication" via apache http server(form based authentication)</div><div class="m_-5199599547815795679gmail_signature"> Below are my configs:</div><div class="m_-5199599547815795679gmail_signature"> </div><div class="m_-5199599547815795679gmail_signature"> 1. Apache config: </div><div class="m_-5199599547815795679gmail_signature"> httpd.conf file:</div><div class="m_-5199599547815795679gmail_signature"> added config for mod_jk:</div><div class="m_-5199599547815795679gmail_signature"> <IfModule jk_module></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>JkWorkersFile conf/workers.properties</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>JkShmFile logs/mod_jk.shm</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>JkLogLevel info</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>JkOptions +ForwardURICompatUnparsed</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></IfModule></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>worker.properties:</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> ( basic config for tomcat & worker details )</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>2. enabled vhosts and added below configs:</div><div class="m_-5199599547815795679gmail_signature"> httpd-vhosts.conf:</div><div class="m_-5199599547815795679gmail_signature"> <VirtualHost *:8880></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>ServerName <a href="http://www.testapp.com" target="_blank">www.testapp.com</a></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> JkMount /idp/* worker1</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span><Location /idp></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>SetHandler form-login-handler</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>AuthFormLoginRequiredLocation "<a href="http://www.testapp.com:8880/Login.html" target="_blank">http://www.testapp.com:8880/<wbr>Login.html</a>"</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>AuthFormLoginSuccessLocation "<a href="http://www.testapp.com:8010/idp/Authn/RemoteUser" target="_blank">http://www.testapp.com:8010/<wbr>idp/Authn/RemoteUser</a>" (I tried this and <b><a href="http://host.name:8010/idp" target="_blank">http://host.name:8010/idp</a></b> but it doesn't work...)</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>AuthFormProvider file</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>AuthUserFile /conf/user.db</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>AuthType form</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>Session On</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>SessionCookieName session path=/</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>require valid-user</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>AuthName "admin"</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>#AuthUserFile conf/user.db</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>require valid-user</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></Location></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></VirtualHost></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>3. In server.xml file I uncommented the ajp port and enabled it and also tested the IDP status page via http port.</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>//actually it is not supporting AJP so changed the protocol to http like this:</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> <Connector port="8010" protocol="HTTP/1.1" redirectPort="8443" tomcatAuthentication="false" /></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> </div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>4. Enabled RemoteUser in idp.propertied file:</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> In logs the idp prints "it will look for remote user details in headers and attributes[]".</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>5. Added below config in relying party to support un verfied relying party:</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> </div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> <bean id="shibboleth.<wbr>UnverifiedRelyingParty" parent="RelyingParty"></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span><property name="profileConfigurations"></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span><list></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span><!-- <bean parent="SAML2.SSO" p:encryptAssertions="false" /> --></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> <ref bean="SAML2.ECP" /></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> <ref bean="SAML2.Logout" /></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> <ref bean="SAML2.AttributeQuery" /></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span><ref bean="SAML2.<wbr>ArtifactResolution" /></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></list></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></property></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></bean></div><div class="m_-5199599547815795679gmail_signature"><br></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>So when I try to access the IDP via apache, IDP throws this error "<b>Web Login Service - Stale Request</b>". </div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span>apache httpd server is sending<b> remote user name to tomca</b>t, I checked it in the access logs. But still IDP is not recognizing the <b>remote user login flow</b>. </div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> </div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> Do I miss any other configuration ?? Kindly let me know your suggestions and one more question, how I can preserve the incoming request URI in apache proxy and redirect it to tomcat after authentication is successful ?? Thanks in advance...</div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span></div><div class="m_-5199599547815795679gmail_signature"><span style="white-space:pre-wrap"> </span> </div><div class="m_-5199599547815795679gmail_signature"> </div><div class="m_-5199599547815795679gmail_signature"><br></div>
</div>