<div dir="ltr">If there is a question of whether the WAR file is current, a rebuild would (never) hurt -- twice is better than not at all.<div><br></div><div>Installing the module does not automatically make it part of the login process. Unless you are ONLY going to allow X509 certificate authentication, you would need to configure the <a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534/MultiFactorAuthnConfiguration">authn/MFA</a> flow to manage multiple authentication options.</div><div><br></div><div>Steve.</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Thu, May 22, 2025 at 1:30 PM o haya via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi,</div><div><br></div><div>I want to try to enable X509 authentication on the Shibbleth IdP that I have, and I've tried to follow the information at:</div><div><br></div><div><a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506319/X509AuthnConfiguration#General-Configuration" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506319/X509AuthnConfiguration#General-Configuration</a></div><div><br></div><div>I've run the module command as described:</div><div><br></div><div>
<span><code style="white-space:pre-wrap"><span>bin/module.sh -t idp.authn.X509 || bin/module.sh -e idp.authn.X509</span></code></span> <br></div><div><br></div><div>and got:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">./module.sh -t idp.authn.X509 || ./module.sh -e
idp.authn.X509<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/admin/admin.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/authn/authn.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/c14n/subject-c14n.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/saml-nameid.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/services.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/ldap.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/admin/admin.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/authn/authn.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/c14n/subject-c14n.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/saml-nameid.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/services.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">INFO<span> </span>- Including
auto-located properties in ./../conf/ldap.properties<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">Enabling idp.authn.X509...<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif""><span>
</span>edit-webapp/x509-prompt.jsp created<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif"">[OK]<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,"sans-serif""><span> </span></p>
<span style="font-size:11pt;font-family:Calibri,"sans-serif"">Customize edit-webapp/x509-prompt.jsp
and rebuild war to deploy.</span>
<br></blockquote><div><br></div><div>So far, I haven't added the TrustEngine as shown on that page because it sounds like that is optional(?).</div><div><br></div><div>Also, this page:</div><div><br></div><div><a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500577/Installation#Rebuilding-the-WAR-file" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500577/Installation#Rebuilding-the-WAR-file</a></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Installing plugins automatically performs this step, but should you need
to rebuild the WAR file yourself, you can run the build command line
utility (<em>bin/build.sh</em> or <em>bin\build.bat</em>) from the installation directory<code>(idp.home</code>).
<br></blockquote><div><br></div><div>so I haven't rebuilt the WAR (yet).</div><div><br></div><div>I rebooted the IdP machine and did a test request, but the IdP seems to behaving exactly like before I performed those steps.</div><div><br></div><div>Do I have to rebuild the WAR file maybe?</div><div><br></div><div>Thanks,</div><div>Jim</div><div> <br></div></div><div id="m_250734351106095585DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style="border-top:1px solid rgb(211,212,222)"><tbody><tr><td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td><td style="width:470px;padding-top:12px;color:rgb(65,66,78);font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" style="color:rgb(68,83,234)" target="_blank">www.avast.com</a></td></tr></tbody></table><a href="#m_250734351106095585_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>