ESOE Users Google Group

Re: [esoe-users] Re: ESOE manager & spep does not function after installation

s.mangelsd...@gmail.com (Shaun Mangelsdorf) — Tue, 24 Nov 2009 09:43:35 UT

2009/11/23 Martin Karlsson <martin.vanten.karls...@gmail. com>

In my experience file://${path} works fine, but the path needs to be
of the format c:/path/to/files - making the resulting URL look like:
file://c:/path/to/files

Is this not consistent with your deployment? I'd be keen to hear what

Re: ESOE manager & spep does not function after installation

martin.vanten.karls...@gmail.com (Martin Karlsson) — Mon, 23 Nov 2009 07:57:46 UT

I'm using windows and it does not work with two //, either use one or
three should do it.

Anyway, thanks for the replies. I've managed to sucessfuly deploy
root.war and also fix a second file:// in root/web-inf/
globalConfig.xml.
If I go to /signin i get redirected to web/login

All is fine except when i login I get redirected to a blank page /

Re: [esoe-users] ESOE manager & spep does not function after installation

lda...@gmail.com (Luke Daley) — Sat, 21 Nov 2009 08:18:50 UT

Why is this?

Re: [esoe-users] ESOE manager & spep does not function after installation

s.mangelsd...@gmail.com (Shaun Mangelsdorf) — Sat, 21 Nov 2009 04:21:32 UT

Hi Martin,

Do you have the ESOE war deployed (as ROOT.war) ?

What do you see if you hit [link] with your browser?

Shaun

2009/11/19 Martin Karlsson <martin.vanten.karls...@gmail. com>

ESOE manager & spep does not function after installation

martin.vanten.karls...@gmail.com (Martin Karlsson) — Thu, 19 Nov 2009 13:19:23 UT

Hi,

First, I would like to point out some errors in the existing
esoemanager.war & esoestartup.war:
In esoemanager; in web-inf/globalConfig.xml there is a misspelling;
value="file://${ should be value="file:/${. (notice that is should
only be one /).
Secondly; in esoestartup/web-inf/classes/lo g4j.xml; the logger should

Recent spam emails

s.mangelsd...@gmail.com (Shaun Mangelsdorf) — Sun, 20 Sep 2009 05:58:54 UT

Hi All,
Due to recent spam emails, I've changed the list settings so that email from
new members will be moderated. This means there will be a delay the first
time you post to either list, but will hopefully eliminate the spam we've
been seeing lately.
Regards,
Shaun

ESOE Project News - Releases, Git

s.mangelsd...@gmail.com (Shaun Mangelsdorf) — Tue, 11 Aug 2009 06:08:56 UT

Hi All,
After a long period of quiet, mostly due to the shifted priorities of our
development team, I'm glad to announce that the ESOE Project is back in
active development. We have some updates:
New site, new source control
In preparation for the move to Git source control, we migrated the ESOE
Project site to Redmine ([link]) back in April. We've now moved

Re: [esoe-users] ESOE specification

s.mangelsd...@gmail.com (Shaun Mangelsdorf) — Wed, 08 Apr 2009 22:20:47 UT

Hi Filipa,
2009/4/8 Filipa <filipa.mo...@alert.pt>
Yes, to both of these.
Currently the ESOE software does not support XACML. On the assumption that
you already have a XACML PEP implementation, you could ignore the
authorization components of ESOE and use what you have.
The core of ESOE is Java, so it will run anywhere Java runs. The SPEP

ESOE specification

filipa.mo...@alert.pt (Filipa) — Wed, 08 Apr 2009 09:12:22 UT

Hello,
i want to implement a SSO solution using SAML and i've been looking at
ESOE as a possible solution.. however i have some questions because
there are somethings i cant understand or cant find information for.

What i want to do is find a solution for SSO that uses SAML.. I have
my application which will be the starting point..assuming it's a web

ESOE specification

filipa.mo...@alert.pt (Filipa) — Wed, 08 Apr 2009 09:12:21 UT

What i want to do is find a solution for SSO that uses SAML.. I have
my application which will be the starting point..assuming it's a web

ESOE specification

filipa.mo...@alert.pt (Filipa) — Wed, 08 Apr 2009 09:12:20 UT

What i want to do is find a solution for SSO that uses SAML.. I have
my application which will be the starting point..assuming it's a web

Re: [esoe-users] Errors Running generate_db-mysql.sql

s.mangelsd...@gmail.com (Shaun Mangelsdorf) — Sat, 04 Apr 2009 04:42:11 UT

Hi,

I have seen this before, though a long time ago.

Try dropping your database and creating it again with the "latin1" character
set, i.e.:
CREATE DATABASE esoe CHARACTER SET latin1;

After this, the creation script should work properly. The problem I had was
with the maximum width of a field that can be indexed by MySQL, since

Errors Running generate_db-mysql.sql

hodg...@gmail.com (hodgesz@gmail.com) — Sat, 04 Apr 2009 02:08:08 UT

I just attempted to run the script generate_db-mysql.sql and got the
following errors.

ERROR 1071 (42000): Specified key was too long; max key length is 767
bytes

ERROR 1005 (HY000): Can't create table 'esoe.#sql-228_f' (errno: 150)
ERROR 1005 (HY000): Can't create table 'esoe.#sql-228_f' (errno: 150)

Re: [esoe-users] Newbie question

bedd...@intient.com (Bradley Beddoes) — Fri, 06 Mar 2009 22:09:05 UT

Hi,

You'll probably find that ESOE is *way* to complicated for you needs
here.

To give ourselves a plug I'd suggest our commercial product GConnect [link]
which is easy to install, very cost effective and supported.

regards,
Bradley

Bradley Beddoes

Newbie question

fatimaaja...@gmail.com (fatima) — Fri, 06 Mar 2009 17:45:33 UT

I was looking for a solution to integrate Google Apps with our Active
Directory, it seems i need to implement SSO if i want to use the same
password, i am not sure if ESOE will be too complicated for this and
is meant for more complex problems, any suggestions?
also if this implementation would enable IMAP access to Google Apps

Re: [esoe-users] esoe install

bedd...@intient.com (Bradley Beddoes) — Mon, 23 Feb 2009 00:23:31 UT

Hi,

Check and make sure you don't have multiple / conflicting copies of
log4j.jar in your tomcat classpath and deployed webapps. Sounds quite
unusual don't think we've come across this one before...

Bradley

Bradley Beddoes
Lead Software Architect
Intient Pty Ltd

[link]

esoe install

cob...@hotmail.com (cobbds@hotmail.com) — Fri, 20 Feb 2009 15:43:08 UT

I am trying to install ESOE on a new installation of xampp. I have
followed the instructions, but when I try and start tomcat it attempts
to deploy the esoestartup.war file and i get and error message about
log4j to being able to create an appender. After this a bunch of
messages come up and it tells me to initialize the log4j system

Re: [esoe-users] Re: Active Directory problem

bedd...@intient.com (Bradley Beddoes) — Fri, 06 Feb 2009 06:50:51 UT

Michael,
Not being able to see the server I am not really sure what additional
suggestions I can make here. The 404 leads me to think that perhaps
you've not deployed the web.war file to your tomcat container.

/signin is published by the ROOT.war file so perhaps this is having an
issue deploying however from your previous emails this seems to not be

Re: Active Directory problem

michaelbli...@hotmail.com (Michael) — Fri, 06 Feb 2009 04:04:49 UT

See above, but also, I remembered something else I did differently to
the guide - when I copied ROOT.war into Tomcat, it would not deploy.
So I stopped Tomcat, moved the existing ROOT folder out, restarted and
then copied it in. Then it deployed okay, but now I can't go to the
usual Tomcat admin page.

Re: Active Directory problem

michaelbli...@hotmail.com (Michael) — Fri, 06 Feb 2009 03:52:51 UT

I am getting closer! I put in "adminUser-1=cn=TS
Admin,cn=users,dc=tsdev,dc=ins ide" and it seems to be progressing, but
it redirects to "[link]" which produces a 404.

Re: [esoe-users] Re: Active Directory problem

bedd...@intient.com (Bradley Beddoes) — Fri, 06 Feb 2009 00:21:02 UT

Hi
You're still missing the uid= or sAMAccountName= on the dn for you're
admin user based on the confit you've just provided

regards,
Bradley Beddoes
Lead Software Architect
Intient Pty Ltd

[link]

Re: Active Directory problem

michaelbli...@hotmail.com (Michael) — Fri, 06 Feb 2009 00:09:53 UT

Hello Bradley,

Thanks for your quick reply (I went off for a coffee). Yes, nslookup
does resolve correctly, as shown below. I have updated adminUser-1 to
"tsadmin,dc=tsdev,dc=inside" or "tsadmin,cn=users,dc=tsdev,dc= inside"
without luck.

I also noticed the following in esoe-authn.log - is the lack of

Re: [esoe-users] Active Directory problem

bedd...@intient.com (Bradley Beddoes) — Thu, 05 Feb 2009 23:19:39 UT

Hi Michael,
This needs to be the server DNS entry does 'nslookup smstsdc01' resolve
in DNS for you?. If not you'll need something like smstsdc01.company.com
This needs to be a DN so something like
sAMAccountName=tsadmin,dc=tsde v,dc=inside - please adjust accordingly
for your environment.
sAMAccountName for AD is the best option, you can add the cn=users to

Active Directory problem

michaelbli...@hotmail.com (Michael) — Thu, 05 Feb 2009 23:13:19 UT

Hi All,

I have got past a few problems with installation, and have finally got
to the login page, but continually come up with a login failure. I
have tested my LDAP connection and credentials using an LDAP browser
and they work fine, but I am no expert here.

I have tried a few options by stopping Tomcat, changing the "## LDAP

Re: Duplicate entry

monico.bris...@gmail.com (monico.briseno@gmail.com) — Wed, 28 Jan 2009 15:21:17 UT

Hi, Bradley. First thanks for you sooner reply. I did exactly that you
write. However, I'm still in problems, because, when I finish the esoe
setup, appeared the following message:

Error Page
The application encountered an unexpected error.

I don't know what I did wrong. In this moment I have a screenshot with

Re: [esoe-users] Duplicate entry

bedd...@intient.com (Bradley Beddoes) — Tue, 27 Jan 2009 21:51:24 UT

Hi Moncio,

I'd recommend you drop your database and start with a clean environment
seems like something has gotten messed up there (did you run esoe
startup twice perhaps?)

Bradley
--
Bradley Beddoes
Lead Software Architect

Intient
[link]

Telephone
Australia: (07) 3102 4560

Duplicate entry

monico.bris...@gmail.com (monico.briseno@gmail.com) — Tue, 27 Jan 2009 21:24:59 UT

Hi, all. I setting up ESO, but in the final section of the procedure I
had the following
Error
While attempting to register the ESOE an error has occured,
preliminary details are listed below. For more information ensure
logging is set to debug and check your log files.

ESOEDAOException when attempting to configure ESOE details --- The

Re: [esoe-users] Feature question...er

bedd...@intient.com (Bradley Beddoes) — Thu, 20 Nov 2008 21:39:24 UT

Hi Enrique,

I'm sorry but I really don't understand what you mean by this. ESOE
works at the web tier providing SSO between web applications in your
environment.

Could you provide some more information about your question so we can
respond?

Feature question...er

het...@gmail.com (Enrique Tang) — Thu, 20 Nov 2008 16:41:27 UT

Hi there,
Trying to get clarified on the feature ESOE offer to help better design my
project implmentation...
My understanding is that ESOE supports SSO with Active Directory user
identity, but could AD OU or hostname info be used to set up this SSO too?
I'm pretty new to this realm so please excuse me and let me know if more

Re: [esoe-users] Re: How to SAML enable my JSP based application

bedd...@intient.com (Bradley Beddoes) — Mon, 03 Nov 2008 10:23:20 UT

Hi,
Answers inline.
No but we recommend it given the added security it does provide. In a
test environment I use http endpoints as does the rest of the team which
reduces complexity.
This is covered at
[link]
which assumes a totally stand alone application instance. Essentially

Re: [esoe-users] Re: How to SAML enable my JSP based application

elyas.moha...@gmail.com (Mohamed Elyas) — Mon, 03 Nov 2008 08:10:00 UT

Hi Bradely et all,
I have few queries.
1) Is it mandatory to have ESOE and SPEP URL's as https?
2) What are the essential components required at SPEP instance???
A) Only SPEP and SPEP filter jar???
B) SPEP, SPEP filter and esoemanager???
C) SPEP,SPEP filter,esoemanager and esoestartup??
3) If the answer for the above question can be A or B then how to just

Re: [esoe-users] Re: How to SAML enable my JSP based application

bedd...@intient.com (Bradley Beddoes) — Mon, 03 Nov 2008 01:07:54 UT

Hi,
Apologies for the delayed response here, we've all been very busy.
You've introduced a lot of variables of the standard deployment here and
I can't easily debug this kind of thing over email, it's more the sort
of task we'd work with you on as part of a professional services
package, whilst having actual access on the hosts themselves.

Re: [esoe-users] Re: Getting the big picture

bedd...@intient.com (Bradley Beddoes) — Mon, 03 Nov 2008 00:58:43 UT

Hi Phil,
Does your browser redirect to:
[link].<site>.<domain>.com/spep/sso? redirectURL=aHR0cDovL2Vzb2Uuc3 RyYXRoLmFjZ2VkdS5jb20vZXNvZW1h bmFnZXIvbWFuYWdlci9pbmRleC5odG 0=
If so where does the browser end up before it stops? (I assume your
describing a scenario where the browser loop is stalling at some location).

Re: Getting the big picture

noemailspa...@gmail.com (Phil Gates) — Mon, 03 Nov 2008 00:16:23 UT

I have installed ESOE on a test server but I am having issues getting
into the service manager. It is authenticating correctly using either
LDAP or SPNEGO, but isn't redirecting and doesn't appear to be
creating any cookies. The only error messages I can see in the logs
are:

2008-10-30 10:55:14,782 DEBUG

SPEP Error with different esoe instance

elyas.moha...@gmail.com (elyas) — Tue, 28 Oct 2008 07:05:07 UT

spep.config in SPEP instance jboss
------------------------------ ---

Point (SPEP) global configuration file
operates in production, please change with

keystorePath=${spep.data}/conf ig/spepKeystore.ks
keystorePassword=54019a6fc983e bc01e55
spepKeyAlias=388408730a414003
spepKeyPassword=e5b42af6606c57 366884

Re: How to SAML enable my JSP based application

elyas.moha...@gmail.com (elyas) — Tue, 28 Oct 2008 06:59:30 UT

Hi Brad/Shaun,

I tried to do the setup the explained stuff in a separate jboss
instance (SPEP instance) but unfortunately not able to succeed.

I tried to install just spep war on a separate jboss instance. but not
able to do it because some spep startup error occurred.
Tried installing both esoemanager.war and spep.war on jboss instance

Re: [esoe-users] Re: How to SAML enable my JSP based application

bedd...@intient.com (Bradley Beddoes) — Mon, 20 Oct 2008 21:48:33 UT

Hello,
I assume you mean you want to only run the core ESOE service on the
tomcat instance?. If so yes you'll need to put ESOE Manager and a SPEP
instance on JBoss.
Normally we'd see most deployments putting the ESOE core service and
ESOE Manager (plus it's SPEP) on the one Tomcat. Other SPEP instances

Re: How to SAML enable my JSP based application

elyas.moha...@gmail.com (elyas) — Mon, 20 Oct 2008 14:23:36 UT

Hi,

Need one calrification -

I am doing the setup with 2 different app server instanace(one with
tomcat for idp and the other with jboss for SPEP)

I could do the basic setup for tomcat instance.

1) What components do i need to install on jboss SPEP side??
esoemanager, spep anything else??

Installing the SPEP on jboss

elyas.moha...@gmail.com (elyas) — Tue, 07 Oct 2008 14:06:31 UT

Dear All,

Does anybody has any idea about installing the spep on app servers
other than tomcat. Basically i am confused where to place spep-
endorsed.tar.gz in jboss app server?

Thanks,
Elyas

Re: [esoe-users] Re: shibdelegator logging issues

bedd...@intient.com (Bradley Beddoes) — Tue, 07 Oct 2008 10:42:50 UT

Hi,
In short yes. The delegator should be protected by the standard
shibboleth 1.x SP software.
We weren't about to try and write our own software to support this
shibboleth profiles when this was already done.
Essentially the shibboleth process happens as per usual to a shib SP.
The delegator then reads all the details about the shib user from the

Re: [esoe-users] shibdelegator logging issues

nicola...@lycos.co.uk (Bruge) — Tue, 07 Oct 2008 08:24:02 UT

Hi Bradley,

I'm a little confused by Shibboleth Authentication Delegator
documentation and would like some clarification as I may have
completely missed the point. Under the User Interaction section you
say "This redirection is configured as part of your shibboleth SP".
Does this mean that the shibdelegator is dependant on some third party

Re: [esoe-users] shibdelegator logging issues

bedd...@intient.com (Bradley Beddoes) — Wed, 01 Oct 2008 01:06:25 UT

Hi,
Checkout the file log4j.xml in $tomcat/shibdeleg/WEB-INF/clas ses and try
setting a value directly in there for path to see if that helps.
Apart from that all I can really think of is that some other component
is hosing your SLF4j/Log4j setup, possibly jars in common/lib or
shared/lib of Tomcat.

shibdelegator logging issues

nicola...@lycos.co.uk (Bruge) — Mon, 29 Sep 2008 11:02:37 UT

Hi Bradley/Shaun,

I'm currently trying to configure the shibdelegator to work with a
WAYF downloaded from shibboleth. I've tried configuring the log4j.xml
as per your instructions but no shib.log is being generated.

Currently I have a variable set as -Dshibdeleg.data=/home/esoe/op t/
esoe/shibdelegator in the JAVA_OPTS, and I assume this is correct as

Re: [esoe-users] Getting the big picture

bedd...@intient.com (Bradley Beddoes) — Fri, 26 Sep 2008 04:09:44 UT

Hi Phil,
Sounds like a large interesting project.
There is essentially a 1:1 mapping between SPEP and application (though
you can configure a single SPEP to reside over multiple WAR files in a
tomcat instance for example). Each SPEP instance can then have multiple
policy files to enforce access constraints as required.

Getting the big picture

noemailspa...@gmail.com (Phil Gates) — Fri, 26 Sep 2008 02:36:52 UT

I'm currently looking into implementing SSO for a wide range of web
sites such as Blackboard, Google Apps, Outlook Web Access and a
growing number of in house Ruby on Rails sites. These sites are
accessed both internally and externally by staff/students with AD
accounts and parents/agents with login details stored in various

Re: [esoe-users] How to SAML enable my JSP based application

bedd...@intient.com (Bradley Beddoes) — Wed, 24 Sep 2008 21:56:53 UT

Hi,
The easiest method is to deploy the Java SPEP and SPEP filter which is
the client side code you can use to handle all communication with the
central ESOE deployment on your behalf.
This takes care of all redirections, authentication, attribute exchange
and policy enforcement. You then simply need to write what we call an

How to SAML enable my JSP based application

elyas.moha...@gmail.com (elyas) — Wed, 24 Sep 2008 13:42:52 UT

Dear All,

I have a JSP application which need to be SAML enabled.

Whenever my application URL is accessed I could redirect to eso login
page and redirect back to the original application page. However i
couldn't do anything further bacuse of lacl of knowledge.

1 )What do I need to include in my application code to enable SAML

Re: esoemanager and ROOT contexts fail to start

elyas.moha...@gmail.com (elyas) — Wed, 17 Sep 2008 14:53:37 UT

Hi,

I have also come across this sort of error in windows environment.

This might help -

Go to webapps\ROOT\WEB-INF\globalCon fig.xml and add one more / in the
location property value (file:///${esoe.data) like the following one -

<bean id="globalConfig"

class="org.springframework.bea ns.factory.config.PropertyPlac eholderConfigurer">

Re: esoemanager and ROOT contexts fail to start

aggelos.karal...@gmail.com (Aggelos Karalias) — Wed, 17 Sep 2008 00:56:05 UT

I did test the user dn and the password with ldp.exe of Microsoft tools
and it can search correctly.
The strange thing is that i have the user in AD and when i am running
the ktpass then i cannot bind the user (from the ldp.exe for example)
and it can only be bound if i reset his password. I cannot get this.

Re: [esoe-users] Re: esoemanager and ROOT contexts fail to start

bedd...@intient.com (Bradley Beddoes) — Wed, 17 Sep 2008 00:35:38 UT

Hi,
Lets start by disabling SPNEGO and just getting the plain LDAP
authentication against your AD instance working.

To do this remove spengo as a value of activeAuthnPlugins in esoe.config
(requires a restart).

Secondly specify an admin user DN and password for binding to AD and set
recursive searching to be true. I would then manually test accessing AD