<div dir="auto"><div dir="ltr"><span style="background-color:rgb(255,255,255)">Thanks for the suggestion Peter, </span></div><div dir="ltr"><span style="background-color:rgb(255,255,255)">We already have IDP V2, instead of upgrading to v 3.3 we are building it from scratch...</span></div><div dir="ltr"><span style="background-color:rgb(255,255,255)">So in the existing IDP we are using mod jk and other stuffs...So I have to follow the same flow...It's a requirement!!!</span></div><div dir="ltr"><br style="font-family:sans-serif;font-size:13.696px"><span style="font-family:sans-serif;font-size:13.696px">I'd start with "AuthType basic" and whatever provider you want, as to</span><br style="font-family:sans-serif;font-size:13.696px"><span style="font-family:sans-serif;font-size:13.696px">avoid any issues due to the way "AuthType forms" works??</span><br></div><div dir="ltr"><span style="font-family:sans-serif;font-size:13.696px"> <b>Yeah I tried using basic too. Apache is redirecting to IDP. But IDP is not able to recognise the incoming request.</b></span></div><div dir="ltr"><span style="font-family:sans-serif;font-size:13.696px"><b>I miss some configurations there..Like you have said about web.xml, etc.</b></span></div><div dir="ltr"><span style="font-family:sans-serif;font-size:13.696px"><br></span></div><div dir="ltr"><span style="font-family:sans-serif;font-size:13.696px">Anyway, with HTTP proxying you also need to change</span><br style="font-family:sans-serif;font-size:13.696px"><span style="font-family:sans-serif;font-size:13.696px">webapp/WEB-INF/web.xml, AFAIU, to make the IDP also use</span><br style="font-family:sans-serif;font-size:13.696px"><span style="font-family:sans-serif;font-size:13.696px">"checkHeaders", as per the Shib IDP RemoteUser authentication documentation??</span><span style="font-family:sans-serif;font-size:13.696px"><br></span></div><div dir="ltr"> So can you please tell me what are the changes I have to do in web.xml...</div><div dir="ltr">I saw in shib wiki pages, there they are discussing about remote user beans and server config...I am not very much clear about the configuration..Can you elaborate little bit on this ??</div><div dir="ltr">How do I make IDP to check headers during remote user authentication.</div><div dir="ltr"><br style="font-family:sans-serif;font-size:13.696px"><span style="font-family:sans-serif;font-size:13.696px">Whose access log??</span></div><div dir="ltr"><span style="font-family:sans-serif;font-size:13.696px"><b>It is httpd servers access_log file, after authentication I can see https is redirecting to IDP with principal name.</b></span></div><div dir="ltr"><br></div><div dir="ltr">Kindly share your suggestions, thanks in advance..</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 03-Aug-2017 6:01 PM, "Peter Schober" <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Satheesh Kumar <<a href="mailto:satheeshvsbk@gmail.com">satheeshvsbk@gmail.com</a>> [2017-08-03 14:09]:<br>
> I am trying to do "Remote user authentication" via apache http<br>
> server(form based authentication)<br>
<br>
What documentation are you following to achieve this and why<br>
specifically do you want to do this? The IDP provides a forms-based<br>
authentication mechanism out of the box. Also, RemoteUserInternal<br>
might be easier to get working.<br>
<br>
> 1. Apache config:<br>
> httpd.conf file:<br>
> added config for mod_jk:<br>
> <IfModule jk_module><br>
> JkWorkersFile conf/workers.properties<br>
> JkShmFile logs/mod_jk.shm<br>
> JkLogLevel info<br>
> JkOptions +ForwardURICompatUnparsed<br>
> </IfModule><br>
<br>
Why not mod_proxy_ajp, which comes with Apache httpd out of the box?<br>
(Not that any of this matters, as you state below you're not even<br>
using AJP. Whatever that means with all your mod_jk directices in<br>
place.)<br>
<br>
> SetHandler form-login-handler<br>
> AuthFormLoginRequiredLocation "<a href="http://www.testapp.com:8880/Login.html" rel="noreferrer" target="_blank">http://www.testapp.com:8880/<wbr>Login.html</a>"<br>
> AuthFormLoginSuccessLocation "<a href="http://www.testapp.com:8010/" rel="noreferrer" target="_blank">http://www.testapp.com:8010/</a><br>
> idp/Authn/RemoteUser" (I tried this and *<a href="http://host.name:8010/idp" rel="noreferrer" target="_blank">http://host.name:8010/idp</a><br>
> <<a href="http://host.name:8010/idp" rel="noreferrer" target="_blank">http://host.name:8010/idp</a>>* but it doesn't work...)<br>
<br>
I'd start with "AuthType basic" and whatever provider you want, as to<br>
avoid any issues due to the way "AuthType forms" works.<br>
<br>
> //actually it is not supporting AJP so changed the protocol to http like<br>
> this:<br>
> <Connector port="8010" protocol="HTTP/1.1" redirectPort="8443"<br>
> tomcatAuthentication="false" /><br>
<br>
What is the "it" that "it is not supporting AJP"? Below you write<br>
you're using Apache Tomcat and that certainly does support AJP.<br>
<br>
Anyway, with HTTP proxying you also need to change<br>
webapp/WEB-INF/web.xml, AFAIU, to make the IDP also use<br>
"checkHeaders", as per the Shib IDP RemoteUser authentication<br>
documentation.<br>
<br>
> In logs the idp prints "it will look for remote user details in<br>
> headers and attributes[]".<br>
<br>
IIRC the IDP always logs that, from its build-in ECP support.<br>
<br>
> 5. Added below config in relying party to support un verfied relying party:<br>
<br>
Now that has nothing to do with anything here (and of course there<br>
should be no need to ever to that).<br>
<br>
> So when I try to access the IDP via apache, IDP throws this error "*Web<br>
> Login Service - Stale Request*".<br>
> apache httpd server is sending* remote user name to tomca*t, I checked it<br>
> in the access logs.<br>
<br>
Whose access log?<br>
<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</blockquote></div></div>