Hello, I am responding to this post as I am currently experiencing similar issues and have not been able to find an appropriate fix. I have tried everything suggested above and a number of other fixes/solutions that I have found online but still encounter an "Authentication Failed" page.
I have identified that Shibboleth is returning all Null values to DSpace for SHIB-NETID &, SHIB-MAIL, SHIB-GIVENNAME, & SHIB_SERNAME. I have checked and these values are being passed to Apache but not returned by Shibboleth. Below is what is displayed in the log: user-agent='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36' accept='text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' Sec-Fetch-Site='same-site' Sec-Fetch-Mode='navigate' referer='https://idp-test.ucs.ed.ac.uk/idp/profile/SAML2/Redirect/SSO?SAMLRequest=jZJdT8IwFIb%2FytL7rdtwIzRsCcKFJCiETS%2B8MV13kMaunT2dH%2F%2FewVDxhnjbvud5e550irxRLZt1bq%2B38NoBOu%2BjURrZ8SIjndXMcJTING8AmROsmN2uWByErLXGGWEU8WaIYJ00em40dg3YAuybFHC%2FXWVk71yLjFLFhQ8fvEHf9TWBxADqgIuge6HFXlaVUeD2AaKhh4aYbtZFSbxFn5WaH%2BC%2FKFm3A6QTZ5T%2BlPZv2kkFJ8QWamlBOFoUa%2BItFxl5qpMw5vF4JCbhro6SqErEKA2rlIvJJNqNoY8hdrDU6Lh2GYnDOPTDyI%2BuyihhScri9JF4m9Pq11LXUj9f9lQNIWQ3Zbnxh7UewOJxpT5A8unBNjsW2zP%2Fl7H8WzrJ%2F6EYfxRP6VnbUN2yux6%2FXGyMkuLTmyll3ucWuIOMRITmw8jff5J%2FAQ%3D%3D&RelayState=ss%3Amem%3A8e603a48b9c2cf217ea7ff095ed2bbd128ed057ff50014423e196398cd4bae59' Accept-Encoding='gzip, deflate, br' Accept-Language='en-GB,en-US;q=0.9,en;q=0.8' cookie='_ga=GA1.3.784570009.1579017373; _gid=GA1.3.1538566364.1579017373; _gat=1; JSESSIONID=0406C1F7CAA6E3EF0857590A2FBC34B8; _shibsession_64656661756c7468747470733a2f2f6c61632d6578616d732d746573742e69732e65642e61632e756b2f73686962626f6c657468=_7d78de158496be3215ce38a786bb5bd0' content-length='0' 2020-01-14 15:56:27,082 DEBUG org.dspace.authenticate.ShibAuthentication @ ShibAuthentication - attribute SHIB-NETID is empty! 2020-01-14 15:56:27,082 DEBUG org.dspace.authenticate.ShibAuthentication @ ShibAuthentication - attribute SHIB-MAIL is empty! 2020-01-14 15:56:27,082 ERROR org.dspace.authenticate.ShibAuthentication @ Shibboleth authentication was not able to find a NetId, Email, or Tomcat Remote user for which to indentify a user from. 2020-01-14 15:56:27,082 DEBUG org.dspace.authenticate.ShibAuthentication @ ShibAuthentication - attribute SHIB-NETID is empty! 2020-01-14 15:56:27,082 DEBUG org.dspace.authenticate.ShibAuthentication @ ShibAuthentication - attribute SHIB-MAIL is empty! 2020-01-14 15:56:27,082 DEBUG org.dspace.authenticate.ShibAuthentication @ ShibAuthentication - attribute SHIB-GIVENNAME is empty! 2020-01-14 15:56:27,082 DEBUG org.dspace.authenticate.ShibAuthentication @ ShibAuthentication - attribute SHIB-SURNAME is empty! 2020-01-14 15:56:27,082 ERROR org.dspace.authenticate.ShibAuthentication @ Unable to register new eperson because we are unable to find an email address along with first and last name for the user. NetId Header: 'SHIB-NETID'='null' (Optional) Email Header: 'SHIB-MAIL'='null' First Name Header: 'SHIB-GIVENNAME'='null' Last Name Header: 'SHIB-SURNAME'='null' As can be seen all the SHIB values are null where the Apache log displays the values are being passed through: 129.215.240.168|20200110T153650Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redir ect|_44d64eb1d92d4f9b4833f316c0570b40| https://lac-exams-test.is.ed.ac.uk/shibbol eth| http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp-test.ucs.ed. ac.uk/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_95975f17b03 <http://ac.uk/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_95975f17b03> a755517e8f4ff0104288a|bparkes|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordPro tectedTransport|eduPersonEntitlement,uid,mail,eduPersonScopedAffiliation,transie ntId,eduPersonTargetedID,displayName,surname,givenName,eduPersonPrincipalName,ed uPersonTargetedID.old|_9904207799d56669626b5dd11f0aea68|_447e062afa10fdecdf98db0 39fd2c551 Would anyone know why this might be as I have looked at the config of Shibboleth, DSpace, & Apache and cannot see anything out of the oridnary. Thanks, Ben On Tuesday, 28 February 2017 09:22:48 UTC, Tom Desair wrote: > > Hi Julie, > > I'm glad I could help and that you have Shibboleth up and running now. > > There is also an (undocumented) property called "default-roles" in which > you can define a set of fallback roles in case no applicable roles were > found for a user. So if you want to assign each user that authenticates > through Shibboleth to the ETDR_AUTO group, you can put this in > the authentication-shibboleth.cfg file: > > default-roles = internal >> role.internal = ETDR_AUTO > > > Best regards, > Tom > > [image: logo] Tom Desair > 250-B Suite 3A, Lucius Gordon Drive, West Henrietta, NY 14586 > Esperantolaan 4, Heverlee 3001, Belgium > www.atmire.com > <http://atmire.com/website/?q=services&utm_source=emailfooter&utm_medium=email&utm_campaign=tomdesair> > > 2017-02-27 20:33 GMT+01:00 J Bell <[email protected] <javascript:>>: > >> >> For future: >> >> I did also figure out being able to add a default group to shibboleth by >> using our domain name rather than affiliations - works great! >> >> >> # The shibboleth header to do role-based mappings >> role-header = email >> >> # Whether to ignore the attribute's scope or value. >> role-header.ignore-scope = false >> role-header.ignore-value = true >> >> # Default mappings of roles values to a comma separated list of DSpace >> group >> # names (Case Sensitive). >> role.xxxx.edu = ETDR_AUTO >> role.xxxx.edu = ETDR_AUTO >> >> >> >> >> >> On Tuesday, February 21, 2017 at 4:51:31 PM UTC-6, J Bell wrote: >>> >>> >>> We are moving to Shibboleth and I am having a problem figuring out where >>> my configuration is not set correctly to allow the actual authentication to >>> occur. This is working in other instances we have running - only dSpace >>> is not yet configured properly. Would anyone have some input as to where >>> I have wandered into the weeds? >>> >>> Notes about our configuration: >>> >>> I have the IDP and my local *SP (shibboleth 2.5.2) * configured and >>> talking as I would expect. >>> >>> We are using *mod_ajp* for the proxy (this did not work under regular >>> proxy either - I have tried both ways). My *shibboleth2.xml* configuration >>> looks like this: >>> >>> <ApplicationDefaults entityID="https://xxx.xxx.net/shibboleth"; >>> id="default" policyId="default" >>> REMOTE_USER="eppn persistent-id targeted-id" >>> signing="false" encryption="false" >>> attributePrefix="AJP_"> >>> >>> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" >>> checkAddress="false" handlerSSL="false" >>> cookieProps="https"> >>> >>> <SSO entityID="https://alpha.signin.xxx.edu/idp/shibboleth"; >>> Location="/Login" >>> discoveryProtocol="SAMLDS" discoveryURL=" >>> https://ds.example.org/DS/WAYF";> >>> SAML2 SAML1 >>> </SSO> >>> >>> >>> >>> My *attribute-map.xml* has the following attributes mapped - which >>> come back as expected: >>> >>> <Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"/> >>> <Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="email"/> >>> <Attribute name="urn:oid:2.5.4.3" id="cn"/> >>> <Attribute name="urn:oid:2.5.4.4" id="sn"/> >>> <Attribute name="urn:oid:2.5.4.42" id="givenName"/> >>> <Attribute name="urn:oid:2.16.840.1.113730.3.1.241" >>> id="displayName"/> >>> >>> >>> >>> */Shibboleth.sso/Session *returns this: >>> >>> >>> Miscellaneous >>> Session Expiration (barring inactivity): 476 minute(s) >>> Client Address: xxx.xxx.xxx.xxx >>> SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol >>> Identity Provider: https://alpha.signin.xxx.edu/idp/shibboleth >>> Authentication Time: 2017-02-20T17:31:43.925Z >>> Authentication Context Class: >>> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport >>> Authentication Context Decl: (none) >>> >>> Attributes >>> cn: jbell >>> displayName: Julie Bell >>> email: [email protected] <javascript:> >>> givenName: Julie >>> ksuPersonWildcatId: xxxxxxxx >>> sn: Bell >>> telephoneNumber: xxxxxxxxx >>> uid: jbell >>> >>> >>> After proper authentication the service is returned to: >>> >>> https://test-dspace.xxx.net//dspace/shibboleth-login >>> >>> and: >>> Authentication Failed >>> >>> The* dspace log *responds with this: >>> >>> 2017-02-21 19:42:04,972 INFO >>> org.dspace.app.xmlui.aspect.artifactbrowser.CommunityBrowser @ >>> anonymous:session_id=DDFBE06E3003021B702DF0A1310B4816:ip_addr=xxx.xxx.xxx.xxx:view_community_list: >>> 2017-02-21 19:42:04,973 INFO >>> org.dspace.app.xmlui.aspect.discovery.SidebarFacetsTransformer @ facets >>> for scope, null: 3 >>> 2017-02-21 19:42:05,677 INFO >>> org.dspace.app.xmlui.aspect.artifactbrowser.CommunityBrowser @ >>> anonymous:session_id=DDFBE06E3003021B702DF0A1310B4816:ip_addr=xxx.xxx.xxx.xxx:view_community_list: >>> 2017-02-21 19:42:05,678 INFO >>> org.dspace.app.xmlui.aspect.discovery.SidebarFacetsTransformer @ facets >>> for scope, null: 3 >>> 2017-02-21 19:42:27,872 ERROR org.dspace.authenticate.ShibAuthentication >>> @ Shibboleth authentication was not able to find a NetId, Email, or Tomcat >>> Remote user for which to indentify a user from. >>> 2017-02-21 19:42:27,872 ERROR org.dspace.authenticate.ShibAuthentication >>> @ Unable to register new eperson because we are unable to find an email >>> address along with first and last name for the user. >>> NetId Header: 'null'='null' (Optional) >>> Email Header: 'email'='null' >>> First Name Header: 'givenName'='null' >>> Last Name Header: 'sn'='null' >>> 2017-02-21 19:42:27,872 INFO org.dspace.app.xmlui.utils.AuthenticationUtil >>> @ >>> anonymous:session_id=01CF256229E776009AE83845CF4341A2:ip_addr=xxx.xxx.xxx.xxx:failed_login:email=null, >>> >>> realm=null, result=4 >>> 2017-02-21 19:42:28,444 INFO >>> org.dspace.app.xmlui.aspect.artifactbrowser.CommunityBrowser @ >>> anonymous:session_id=01CF256229E776009AE83845CF4341A2:ip_addr=xxx.xxx.xxx.xxx:view_community_list: >>> 2017-02-21 19:42:28,444 INFO >>> org.dspace.app.xmlui.aspect.discovery.SidebarFacetsTransformer @ facets >>> for scope, null: 3 >>> >>> The *shibboleth* log responds with: >>> >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: New session (ID: >>> _7aa0bd831d4bbfd9e852e1d24414b924) with (applicationId: default) for >>> principal from (IdP: https://alpha.signin.xxx.edu/idp/shibboleth) at >>> (ClientAddress: xxx.xxx.xxx.xxx) with (NameIdentifier: >>> _19a0b33cc94439c79fc401cf9cc63200) using (Protocol: >>> urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: >>> _147bb17c58c8c230f513f12d154c3489) >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: Cached the >>> following attributes with session (ID: _7aa0bd831d4bbfd9e852e1d24414b924) >>> for (applicationId: default) { >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: uid (1 values) >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: displayName (1 >>> values) >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: sn (1 values) >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: givenName (1 >>> values) >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: cn (1 values) >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: email (1 values) >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: telephoneNumber >>> (1 values) >>> 2017-02-21 22:37:17 INFO Shibboleth-TRANSACTION [2]: } >>> >>> >>> >>> *Apache 2.4.25 configuration* looks like: >>> >>> <ifModule mod_shib> >>> UseCanonicalName On >>> <Location /> >>> AuthType Shibboleth >>> ShibRequireSession Off >>> Require shibboleth >>> </Location> >>> <Location "/shibboleth-login"> >>> AuthType shibboleth >>> ShibRequireSession On >>> # Require shib-user ~ ^.+@(xxx|yyy)\.edu$ (was trying this >>> out but it did not work either) >>> Require valid-user >>> </Location> >>> <Location "/Shibboleth.sso"> >>> Require all granted >>> SetHandler shib >>> </Location> >>> </IfModule> >>> >>> this is also in the configuration file, just below this stanza: >>> >>> ProxyPass /Shibboleth.sso ! >>> ProxyPass / "ajp://localhost:8009/" >>> >>> >>> >>> >>> -- >> You received this message because you are subscribed to the Google Groups >> "DSpace Technical Support" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> To post to this group, send email to [email protected] >> <javascript:>. >> Visit this group at https://groups.google.com/group/dspace-tech. >> For more options, visit https://groups.google.com/d/optout. >> > > -- All messages to this mailing list should adhere to the DuraSpace Code of Conduct: https://duraspace.org/about/policies/code-of-conduct/ --- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/dspace-tech/1e81a1e8-ec2c-44ea-bb4b-894ae9a052a3%40googlegroups.com.
