StatusResponseType must have Status. / xmltooling::ValidationException at (https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST)

[Peter Schober]

* Stefan König <s.koenig at uni-tuebingen.de> [2012-02-21 19:04]:
> The SP issues the following AuthnRequest (or equivalent):
[...]
> AssertionConsumerServiceURL="https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST"
> Destination="https://idefix.worldtalk.de/idp/profile/SAML2/Redirect/SSO"
> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idefix.worldtalk.de/sp</saml:Issuer>
[...]
> It gets a Destination="https://idefix.worldtalk.de/idp/profile/SAML2/Redirect/SSO",
> so it knows the Profile Binding to be used for receiption (from it's
> own metadata, as defined in
> C:/opt/shibboleth-idp/metadata/idp-metadata.xml):

There is no such thing as a "Profile Binding" and the "Protocol
Binding" is included in the authentication request you cite above.
Also the default reply-party.xml has this commend to offer:

<!--
Load the IdP's own metadata. This is necessary for artifact support.
-->

Unless you're dealing with Artifacts (which you are not, based on the
above) the IdP does /not/ need access to its own metadata and so this
is not where the info comes from.

> So the question is, weather I should (or better: need) to change
> something in the relying-party.xml at all.

Dpends on what you're trying to achive. Usually the only thing to
change is to add new metadata provider. Sometimes you'll also need
special arrangements for specific SPs.

> The problem: When I comment out everything I added to the
> relying-party.xml I'm getting the error message:
> —
> Error Message: SAML 2 SSO profile is not configured for relying
> party https://idefix.worldtalk.de/sp

Start with the default config, not with your butchered version
thereof.

> 18:18:10.128 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:287]
> - No metadata for relying party https://idefix.worldtalk.de/sp,
> treating party as anonymous
[...]
> This at least states, that the IdP wants the access the service
> provider's metadata. The only way to give it that metadata reference
> was for me to add the definitions in relying-party.xml.

Documentation https://wiki.shibboleth.net/confluence/display/SHIB2/
->
"Configure" https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration
->
"Communicate with a New Service Provider"
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSPCommunicate
->
"Loading its Metadata"
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider

So add a metadata provider to your relying-party.xml (check the
existing example, the huge block marked "Metadata Configuration") and
leave idp-metadata.xml alone, that's the metadata describing the IdP
(so you can give it to the SP).
-peter