<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Verdana, Geneva, sans-serif; font-size: 10pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); --darkreader-inline-color:#e8e6e3; --darkreader-inline-bgcolor:#262a2b;" data-darkreader-inline-color="" data-darkreader-inline-bgcolor="">
Thank you Pete and Matthew!
<div><br>
</div>
<div>with that fix I am able to get an ECP reply from my IDP 4.1.5 server that I'm almost happy with. Only problem left is that the IDP 4.1.5 answers with a transient ID while I'm pretty sure Microsoft will require the same persistent nameID it also needs in
the browser based authentication.</div>
<div><br>
</div>
<div>I've adapted the request template to match the ECP requests I can see in my IDP 2.3.8 logs, but that doesn't contain any special request for the persistent nameID like I can see in the browser.</div>
<div><br>
</div>
<div>How can I make my IDP 4.1.5 server always use the persistent nameID no matter if requested or not? (This instance will only be used to serve Microsofts requests so it doesn't matter security / principle of data economy wise).</div>
<div><br>
</div>
<div>Thank you!</div>
<div>Kind regards,</div>
Thomas Käfer<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> Käfer Thomas <thomas.kaefer@fh-campuswien.ac.at><br>
<b>Gesendet:</b> Dienstag, 29. März 2022 12:41<br>
<b>An:</b> Shib Users <users@shibboleth.net><br>
<b>Betreff:</b> ECP: 401 error or application/vnd.paos+xml not supported?</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="font-family:Verdana,Geneva,sans-serif; font-size:10pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Hello everyone!
<div><br>
</div>
<div>I'm currently trying to configure an IDP 4.1.5 instance to work as a replacement for an IDP 2.3.8 instance that authenticates our users to Microsoft services.</div>
<div><br>
</div>
<div>The browser login flow seems to work quite well already, but I also need it to to handle ECP requests for IMAP & POP3 authentication.</div>
<div><br>
</div>
<div>I found this test script: https://github.com/unikent-ms1/simple-soap-ecp-test</div>
<div>which makes my IDP 2.3.8 instance reply with valid looking responses.</div>
<div><br>
</div>
<div>Before adapting the IDP 4.1.5 to work with ECP it produced this error upon receiving an ECP request:</div>
<div>MessageDecodingException: Content-Type 'application/vnd.paos+xml' was not a supported media type</div>
<div><br>
</div>
<div>After following this ECP guide for IDP 3.x (couldn't find one for IDP 4.x):</div>
<div>https://shibboleth.atlassian.net/wiki/spaces/IDP30/pages/2497773698/ECPConfiguration</div>
<div>I instead get an HTTP ERROR 401 Unauthorized response from jetty, without any output in the Shibboleth logs.</div>
<div>Only effect I could find on the server is this line:</div>
<div>[my-ip] - - [29/März/2022:10:07:51 +0000] "POST /idp/profile/SAML2/SOAP/ECP HTTP/1.1" 401 474
</div>
<div>in the jetty request.log.</div>
<div><br>
</div>
<div>Does anybody recognize a known problem and can give me a hint how to continue to get ECP working on IDP 4.1.5?</div>
<div>I guess otherwise my next steps will need to be to research how to make jetty log more verbose to find the reason for it's access denial.</div>
<div><br>
</div>
<div>Thank you,</div>
<div>kind regards,</div>
Thomas Käfer<br>
</div>
</div>
<div style="font-size:10pt; font-family: 'Verdana',sans-serif;">
<p>Informationen zum Datenschutz: www.fh-campuswien.ac.at/datenschutzerklaerung </p>
</div>
</body>
</html>