ESOE Users Google Group

Re: [esoe-users] Feature question...er

bedd...@intient.com (Bradley Beddoes) — Thu, 20 Nov 2008 21:39:24 UT

Hi Enrique,

I'm sorry but I really don't understand what you mean by this. ESOE
works at the web tier providing SSO between web applications in your
environment.

Could you provide some more information about your question so we can
respond?

Feature question...er

het...@gmail.com (Enrique Tang) — Thu, 20 Nov 2008 16:41:27 UT

Hi there,
Trying to get clarified on the feature ESOE offer to help better design my
project implmentation...
My understanding is that ESOE supports SSO with Active Directory user
identity, but could AD OU or hostname info be used to set up this SSO too?
I'm pretty new to this realm so please excuse me and let me know if more

Re: [esoe-users] Re: How to SAML enable my JSP based application

bedd...@intient.com (Bradley Beddoes) — Mon, 03 Nov 2008 10:23:20 UT

Hi,
Answers inline.
No but we recommend it given the added security it does provide. In a
test environment I use http endpoints as does the rest of the team which
reduces complexity.
This is covered at
[link]
which assumes a totally stand alone application instance. Essentially

Re: [esoe-users] Re: How to SAML enable my JSP based application

elyas.moha...@gmail.com (Mohamed Elyas) — Mon, 03 Nov 2008 08:10:00 UT

Hi Bradely et all,
I have few queries.
1) Is it mandatory to have ESOE and SPEP URL's as https?
2) What are the essential components required at SPEP instance???
A) Only SPEP and SPEP filter jar???
B) SPEP, SPEP filter and esoemanager???
C) SPEP,SPEP filter,esoemanager and esoestartup??
3) If the answer for the above question can be A or B then how to just

Re: [esoe-users] Re: How to SAML enable my JSP based application

bedd...@intient.com (Bradley Beddoes) — Mon, 03 Nov 2008 01:07:54 UT

Hi,
Apologies for the delayed response here, we've all been very busy.
You've introduced a lot of variables of the standard deployment here and
I can't easily debug this kind of thing over email, it's more the sort
of task we'd work with you on as part of a professional services
package, whilst having actual access on the hosts themselves.

Re: [esoe-users] Re: Getting the big picture

bedd...@intient.com (Bradley Beddoes) — Mon, 03 Nov 2008 00:58:43 UT

Hi Phil,
Does your browser redirect to:
[link].<site>.<domain>.com/spep/sso? redirectURL=aHR0cDovL2Vzb2Uuc3 RyYXRoLmFjZ2VkdS5jb20vZXNvZW1h bmFnZXIvbWFuYWdlci9pbmRleC5odG 0=
If so where does the browser end up before it stops? (I assume your
describing a scenario where the browser loop is stalling at some location).

Re: Getting the big picture

noemailspa...@gmail.com (Phil Gates) — Mon, 03 Nov 2008 00:16:23 UT

I have installed ESOE on a test server but I am having issues getting
into the service manager. It is authenticating correctly using either
LDAP or SPNEGO, but isn't redirecting and doesn't appear to be
creating any cookies. The only error messages I can see in the logs
are:

2008-10-30 10:55:14,782 DEBUG

SPEP Error with different esoe instance

elyas.moha...@gmail.com (elyas) — Tue, 28 Oct 2008 07:05:07 UT

spep.config in SPEP instance jboss
------------------------------ ---

Point (SPEP) global configuration file
operates in production, please change with

keystorePath=${spep.data}/conf ig/spepKeystore.ks
keystorePassword=54019a6fc983e bc01e55
spepKeyAlias=388408730a414003
spepKeyPassword=e5b42af6606c57 366884

Re: How to SAML enable my JSP based application

elyas.moha...@gmail.com (elyas) — Tue, 28 Oct 2008 06:59:30 UT

Hi Brad/Shaun,

I tried to do the setup the explained stuff in a separate jboss
instance (SPEP instance) but unfortunately not able to succeed.

I tried to install just spep war on a separate jboss instance. but not
able to do it because some spep startup error occurred.
Tried installing both esoemanager.war and spep.war on jboss instance

Re: [esoe-users] Re: How to SAML enable my JSP based application

bedd...@intient.com (Bradley Beddoes) — Mon, 20 Oct 2008 21:48:33 UT

Hello,
I assume you mean you want to only run the core ESOE service on the
tomcat instance?. If so yes you'll need to put ESOE Manager and a SPEP
instance on JBoss.
Normally we'd see most deployments putting the ESOE core service and
ESOE Manager (plus it's SPEP) on the one Tomcat. Other SPEP instances

Re: How to SAML enable my JSP based application

elyas.moha...@gmail.com (elyas) — Mon, 20 Oct 2008 14:23:36 UT

Hi,

Need one calrification -

I am doing the setup with 2 different app server instanace(one with
tomcat for idp and the other with jboss for SPEP)

I could do the basic setup for tomcat instance.

1) What components do i need to install on jboss SPEP side??
esoemanager, spep anything else??

Installing the SPEP on jboss

elyas.moha...@gmail.com (elyas) — Tue, 07 Oct 2008 14:06:31 UT

Dear All,

Does anybody has any idea about installing the spep on app servers
other than tomcat. Basically i am confused where to place spep-
endorsed.tar.gz in jboss app server?

Thanks,
Elyas

Re: [esoe-users] Re: shibdelegator logging issues

bedd...@intient.com (Bradley Beddoes) — Tue, 07 Oct 2008 10:42:50 UT

Hi,
In short yes. The delegator should be protected by the standard
shibboleth 1.x SP software.
We weren't about to try and write our own software to support this
shibboleth profiles when this was already done.
Essentially the shibboleth process happens as per usual to a shib SP.
The delegator then reads all the details about the shib user from the

Re: [esoe-users] shibdelegator logging issues

nicola...@lycos.co.uk (Bruge) — Tue, 07 Oct 2008 08:24:02 UT

Hi Bradley,

I'm a little confused by Shibboleth Authentication Delegator
documentation and would like some clarification as I may have
completely missed the point. Under the User Interaction section you
say "This redirection is configured as part of your shibboleth SP".
Does this mean that the shibdelegator is dependant on some third party

Re: [esoe-users] shibdelegator logging issues

bedd...@intient.com (Bradley Beddoes) — Wed, 01 Oct 2008 01:06:25 UT

Hi,
Checkout the file log4j.xml in $tomcat/shibdeleg/WEB-INF/clas ses and try
setting a value directly in there for path to see if that helps.
Apart from that all I can really think of is that some other component
is hosing your SLF4j/Log4j setup, possibly jars in common/lib or
shared/lib of Tomcat.