<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?avatarId=10202" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="lpn21gf1zqxox2a5ku6+txn8kw8=@https://idp.gakunin.nii.ac.jp/idp/shibboleth" id="email_lpn21gf1zqxox2a5ku6+txn8kw8=@https://idp.gakunin.nii.ac.jp/idp/shibboleth" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=lpn21gf1zqxox2a5ku6%2Btxn8kw8%3D%40https%3A%2F%2Fidp.gakunin.nii.ac.jp%2Fidp%2Fshibboleth" style="color:#326ca6;">Takeshi Nishimura</a>
commented on <img src="https://issues.shibboleth.net/jira/images/icons/issuetypes/improvement.png" height="16" width="16" border="0" align="absmiddle" alt="Improvement"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/JOWS-39'>JOWS-39</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/JOWS-39'><strong>HTTPS scheme in FileBackedHTTPMetadataProvider does not perform hostname verification</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td colspan="2" style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 16px 0;width:100%;">
<div class="comment-block" style="background-color:#edf5ff;border:1px solid #dddddd;color:#000000;padding:12px;"><p>The followings may be the evidence of my attempt.</p>
<p>My environment:</p>
<ul class="alternate" type="square">
<li>OS : CentOS 5.9</li>
<li>Oracle JDK : 1.6.0_45</li>
<li>Tomcat : 6.0.37</li>
</ul>
<p><a href="https://157.1.72.50/gakunin-test-metadata.xml" class="external-link">https://157.1.72.50/gakunin-test-metadata.xml</a> - OK</p>
<p>relying-party.xml:</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="code-java"> <metadata:MetadataProvider id=<span class="code-quote">"ShibbolethMetadata"</span> xsi:type=<span class="code-quote">"metadata:ChainingMetadataProvider"</span>>
:
<MetadataProvider id=<span class="code-quote">"URLMD-testfed"</span> xsi:type=<span class="code-quote">"FileBackedHTTPMetadataProvider"</span> xmlns=<span class="code-quote">"urn:mace:shibboleth:2.0:metadata"</span>
metadataURL=<span class="code-quote">"https:<span class="code-comment">//157.1.72.50/gakunin-test-metadata.xml"</span>
</span> backingFile=<span class="code-quote">"/opt/env5/idp-<span class="code-keyword">default</span>/metadata/gakunin-test-metadata.xml"</span>>
<MetadataFilter xsi:type=<span class="code-quote">"ChainingFilter"</span> xmlns=<span class="code-quote">"urn:mace:shibboleth:2.0:metadata"</span>>
<MetadataFilter xsi:type=<span class="code-quote">"RequiredValidUntil"</span> xmlns=<span class="code-quote">"urn:mace:shibboleth:2.0:metadata"</span>
maxValidityInterval=<span class="code-quote">"1296000"</span> />
<MetadataFilter xsi:type=<span class="code-quote">"SignatureValidation"</span> xmlns=<span class="code-quote">"urn:mace:shibboleth:2.0:metadata"</span>
trustEngineRef=<span class="code-quote">"shibboleth.MetadataTrustEngine-testfed"</span>
requireSignedMetadata=<span class="code-quote">"<span class="code-keyword">true</span>"</span> />
<MetadataFilter xsi:type=<span class="code-quote">"EntityRoleWhiteList"</span> xmlns=<span class="code-quote">"urn:mace:shibboleth:2.0:metadata"</span>>
<RetainedRole>samlmd:SPSSODescriptor</RetainedRole>
</MetadataFilter>
</MetadataFilter>
</MetadataProvider>
</metadata:MetadataProvider>
<security:TrustEngine id=<span class="code-quote">"shibboleth.MetadataTrustEngine-testfed"</span> xsi:type=<span class="code-quote">"security:StaticExplicitKeySignature"</span>>
<security:Credential id=<span class="code-quote">"MyFederation1Credentials-testfed"</span> xsi:type=<span class="code-quote">"security:X509Filesystem"</span>>
<security:Certificate>/opt/env-common/shibboleth-idp/credentials/gakunin-test-signer-2011.cer</security:Certificate>
</security:Credential>
</security:TrustEngine>
</pre>
</div></div>
<p>idp-process.log:</p>
<div class="preformatted panel" style="border-width: 1px;"><div class="preformattedContent panelContent">
<pre>11:50:05.283 - DEBUG [edu.internet2.middleware.shibboleth.common.config.metadata.HTTPMetadataProviderBeanDefinitionParser:110] - Metadata provider 'URLMD-testfed' disregards server SSL certificate: false
<...snip...>
11:50:05.601 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1410] - Invoking init method 'initialize' on bean with name 'URLMD-testfed'
11:50:05.602 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:253] - Beginning refresh of metadata from 'https://157.1.72.50/gakunin-test-metadata.xml'
11:50:05.651 - DEBUG [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:249] - Attempting to fetch metadata document from 'https://157.1.72.50/gakunin-test-metadata.xml'
11:50:05.659 - DEBUG [org.apache.commons.httpclient.MultiThreadedHttpConnectionManager:412] - HttpConnectionManager.getConnection: config = HostConfiguration[host=https://157.1.72.50], timeout = 0
11:50:05.660 - DEBUG [org.apache.commons.httpclient.MultiThreadedHttpConnectionManager:760] - Allocating new connection, hostConfig=HostConfiguration[host=https://157.1.72.50]
11:50:05.664 - DEBUG [org.apache.commons.httpclient.HttpConnection:692] - Open connection to 157.1.72.50:443
11:50:05.844 - DEBUG [httpclient.wire.header:70] - >> "GET /gakunin-test-metadata.xml HTTP/1.1[\r][\n]"
11:50:05.844 - DEBUG [org.apache.commons.httpclient.HttpMethodBase:1352] - Adding Host request header
11:50:05.857 - DEBUG [httpclient.wire.header:70] - >> "Connection: close[\r][\n]"
11:50:05.857 - DEBUG [httpclient.wire.header:70] - >> "Accept-Encoding: gzip,deflate[\r][\n]"
11:50:05.857 - DEBUG [httpclient.wire.header:70] - >> "User-Agent: Jakarta Commons-HttpClient/3.1[\r][\n]"
11:50:05.858 - DEBUG [httpclient.wire.header:70] - >> "Host: 157.1.72.50[\r][\n]"
11:50:05.858 - DEBUG [httpclient.wire.header:70] - >> "[\r][\n]"
11:50:05.860 - DEBUG [httpclient.wire.header:70] - << "HTTP/1.1 200 OK[\r][\n]"
11:50:05.861 - DEBUG [httpclient.wire.header:70] - << "HTTP/1.1 200 OK[\r][\n]"
11:50:05.862 - DEBUG [httpclient.wire.header:70] - << "Date: Thu, 19 Sep 2013 02:50:05 GMT[\r][\n]"
11:50:05.862 - DEBUG [httpclient.wire.header:70] - << "Server: Apache/2.2.3 (CentOS)[\r][\n]"
11:50:05.863 - DEBUG [httpclient.wire.header:70] - << "Last-Modified: Wed, 18 Sep 2013 04:06:10 GMT[\r][\n]"
11:50:05.863 - DEBUG [httpclient.wire.header:70] - << "ETag: "df849f-1dbad4-4e6a08eb19080"[\r][\n]"
11:50:05.863 - DEBUG [httpclient.wire.header:70] - << "Accept-Ranges: bytes[\r][\n]"
11:50:05.864 - DEBUG [httpclient.wire.header:70] - << "Content-Length: 1948372[\r][\n]"
11:50:05.864 - DEBUG [httpclient.wire.header:70] - << "Connection: close[\r][\n]"
11:50:05.864 - DEBUG [httpclient.wire.header:70] - << "Content-Type: text/xml[\r][\n]"
11:50:05.864 - DEBUG [httpclient.wire.header:70] - << "[\r][\n]"
11:50:05.866 - DEBUG [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:334] - Attempting to extract metadata from response to request for metadata from 'https://157.1.72.50/gakunin-test-metadata.xml'
11:50:05.877 - DEBUG [httpclient.wire.content:70] - << "<?xml version="1.0" encoding="UTF-8"?><EntitiesDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="GakuNin-test" validUntil="2013-10-02T14:00:00Z"><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">[\n]"
11:50:05.878 - DEBUG [httpclient.wire.content:70] - << "<ds:SignedInfo>[\n]"
11:50:05.878 - DEBUG [httpclient.wire.content:70] - << "<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>[\n]"
11:50:05.878 - DEBUG [httpclient.wire.content:70] - << "<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>[\n]"
11:50:05.878 - DEBUG [httpclient.wire.content:70] - << "<ds:Reference URI="">[\n]"
<...snip...>
</pre>
</div></div>
<p>I will provide any other information you need.</p></div>
<div style="color:#505050;padding:4px 0 0 0;"> </div>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->