Setting up ECP in shibboleth SP
Anand Somani
meatforums at gmail.com
Wed Dec 21 08:24:45 GMT 2011
Hi
I am struggling to get the SP ECP binding working. Have looked at the email
threads, but am not able to make out what I am doing wrong. The shibd
process crashes when I send the curl command (as indicated by ecp.sh).
Maybe I have misconfigured something here, but am not able to make out, any
help is appreciated.
Thanks
Anand
Here is the last log message
2011-12-21 08:10:45 INFO Shibboleth.Listener : registered remoted message
endpoint (default::getHeaders::Application)
2011-12-21 08:10:45 INFO Shibboleth.Listener : listener service starting
2011-12-21 08:10:57 DEBUG Shibboleth.Listener [1]: dispatching message
(default/Login::run::SAML2SI)
2011-12-21 08:10:57 DEBUG XMLTooling.StorageService [1]: inserted record
(3ebec2baae691f7e09b4ef2959d5870a) in context (RelayState) with expiration
(1324455657)
2011-12-21 08:10:57 DEBUG OpenSAML.MessageEncoder.SAML2ECP [1]: validating
input
2011-12-21 08:10:57 DEBUG OpenSAML.MessageEncoder.SAML2ECP [1]: marshalling
the envelope
+++++++++++++++++++++++++++++++++
output from curl command
++++++++++++++++++++++++++++++++
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<link rel="stylesheet" type="text/css" href="/shibboleth-sp/main.css" />
<title>shibsp::ListenerException</title>
</head>
<body>
<img src="/shibboleth-sp/logo.jpg" alt="Logo" />
<h1>shibsp::ListenerException</h1>
<p>The system encountered an error at Wed Dec 21 08:10:57 2011
</p>
<p>To report this problem, please contact the site administrator at
<a href="mailto:root at localhost">root at localhost</a>.
</p>
<p>Please include the following message in any email:</p>
<p class="error">shibsp::ListenerException at (https://
m1234.lab.ppops.net/secure)</p>
<p>Failure receiving response to remoted message
(default/Login::run::SAML2SI).</p>
+++++++++++++++++++++++++++++++++
my shibboleth2.xml =>
+++++++++++++++++++++++++++++++++
<ApplicationDefaults entityID="https://m1234.lab.ppops.net/shibboleth"
REMOTE_USER="eppn persistent-id targeted-id">
<Sessions lifetime="28800" timeout="3600" checkAddress="false"
relayState="ss:mem" handlerSSL="false" cookieProps="; path=/; secure">
<SessionInitiator type="Chaining" Location="/Login" isDefault="true"
id="Intranet"
entityID="https://obelix.obelix.com/idp/shibboleth">
<SessionInitiator type="SAML2" ECP="true"
template="bindingTemplate.html"
ascIndex="3" acsByIndex="false" />
</SessionInitiator>
<LogoutInitiator type="Chaining" Location="/Logout">
<LogoutInitiator type="Local" />
</LogoutInitiator>
<md:AssertionConsumerService Location="/SAML2/POST" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
<md:AssertionConsumerService Location="/SAML2/POST-SimpleSign"
index="2"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
<md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
<md:AssertionConsumerService Location="/SAML2/ECP" index="4"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
<md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1"/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session"
showAttributeValues="false"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<!--
Allows overriding of error template information/filenames. You can
also add attributes with values that can be plugged into the
templates.
-->
<Errors supportContact="root at localhost"
logoLocation="/shibboleth-sp/logo.jpg"
styleSheet="/shibboleth-sp/main.css"/>
<!-- Example of remotely supplied batch of signed metadata. -->
<MetadataProvider type="XML" uri="
https://obelix.obelix.com/idp/profile/Metadata/SAML"
backingFilePath="federation-metadata.xml"
reloadInterval="7200">
<!--
<MetadataFilter type="RequireValidUntil"
maxValidityInterval="2419200"/>
-->
<!--<MetadataFilter type="Signature"
certificate="fedsigner.pem"/> -->
</MetadataProvider>
<AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>
<!-- Use a SAML query if no attributes are supplied during SSO. -->
<AttributeResolver type="Query" subjectMatch="true"/>
<!-- Default filtering policy for recognized attributes, lets other
data pass. -->
<AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/>
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem"
certificate="sp-cert.pem"/>
<!--
The default settings can be overridden by creating
ApplicationOverride elements (see
the
https://spaces.internet2.edu/display/SHIB2/NativeSPApplicationOverridetopic).
Resource requests are mapped by web server commands, or the
RequestMapper, to an
applicationId setting.
Example of a second application (for a second vhost) that has a
different entityID.
Resources on the vhost would map to an applicationId of "admin":
-->
<!--
<ApplicationOverride id="admin" entityID="
https://admin.example.org/shibboleth"/>
-->
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime
messages. -->
<SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>
<!-- Low-level configuration about protocols and bindings available for
use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>
</SPConfig>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111221/a878a60f/attachment.html
More information about the users
mailing list