Test Installation on Virtual PCs(Ken Ordona)
Ordona, Kenneth C
Kenneth.Ordona at pnnl.gov
Mon Jul 9 14:06:28 EDT 2012
I'm pretty new to this, so please bear with me: Do I have to go into the hosts file and create a new mapping of an IP address? And then use that IP address/host name when I install Shibboleth?
Thank you,
Ken
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of users-request at shibboleth.net
Sent: Monday, July 09, 2012 10:57 AM
To: users at shibboleth.net
Subject: users Digest, Vol 13, Issue 23
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific than "Re: Contents of users digest..."
Today's Topics:
1. Re: Invalid email (Paul Hethmon)
2. RE: Should IDP/SP metadata contain a roleDescriptor tag?
(Wessel, Keith William)
3. Re: Should IDP/SP metadata contain a roleDescriptor tag?
(Tom Scavo)
4. Re: Shibd crashing on LogoutRequest (Yannick B?ot)
5. Test Installation on Virtual PCs (Ordona, Kenneth C)
6. Re: Test Installation on Virtual PCs (Chad La Joie)
7. Re: Test Installation on Virtual PCs (David Langenberg)
8. RE: Should IDP/SP metadata contain a roleDescriptor tag?
(Wessel, Keith William)
----------------------------------------------------------------------
Message: 1
Date: Mon, 9 Jul 2012 16:37:13 +0000
From: Paul Hethmon <paul.hethmon at clareitysecurity.com>
Subject: Re: Invalid email
To: Shib Users <users at shibboleth.net>
Message-ID: <8312590B60F2E342A6E2A9D74C77EF081AD15DDE at MBX023-W1-CA-5>
Content-Type: text/plain; charset="us-ascii"
Make sure you are releasing a valid email address to Google. One that is associated with a Google account.
You should refer to Google's documentation on what to release to them and in what formats.
Paul
On 7/9/12 12:32 PM, "Prasanna" <PVBalachandar at imperosoftware.com> wrote:
>Scott,
>
>Can you give me some idea to resolve this issue.
>
>Thanks and Regards
>Prasanna
>
>-----
>Prasanna V B
>--
>View this message in context:
>http://shibboleth.1660669.n2.nabble.com/Invalid-email-tp7580484p7580493
>.ht
>ml
>Sent from the Shibboleth - Users mailing list archive at Nabble.com.
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net
------------------------------
Message: 2
Date: Mon, 9 Jul 2012 16:38:35 +0000
From: "Wessel, Keith William" <kwessel at illinois.edu>
Subject: RE: Should IDP/SP metadata contain a roleDescriptor tag?
To: Shib Users <users at shibboleth.net>
Message-ID:
<A1EB7EC659FA0F429A55865D5820006D2DCA8EF4 at CITESMBX1.ad.uillinois.edu>
Content-Type: text/plain; charset="us-ascii"
Thanks for the sanity check, Tom. This is exactly what I suspected was the case, but I needed to hear it from someone else.
Since we're not going to find roleDescriptor tags in the InCommon metadata but rather the derived tags for idpSSODescriptor and spSSODescriptor, I think the vendor's going to need to sort this out if, in fact, it does insist on roleDescriptor. That's still unclear.
At any rate, I appreciate the info... and the suggesting of running it through validation. By validation, I assume you're referring to xmlsectool, correct?
Keith
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: Monday, July 09, 2012 5:54 AM
To: Shib Users
Subject: Re: Should IDP/SP metadata contain a roleDescriptor tag?
Hi Keith,
On Sun, Jul 8, 2012 at 11:09 PM, Wessel, Keith William <kwessel at illinois.edu> wrote:
>
> The vendor claims that the XML generated by Shibboleth's metagen.sh is flawed because it doesn't contain a <roleDescriptor> tag. I argued back that roleDescriptor is abstract and not meant to be used literally; rather, spSSODescriptor or idpSSODescriptor should be used.
RoleDescriptor is indeed abstract but it can be used literally as long as a type is specified. Here's an example:
<md:RoleDescriptor
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:query="urn:oasis:names:tc:SAML:metadata:ext:query"
xsi:type="query:AttributeQueryDescriptorType"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol">
For details, see this spec that Scott and I co-authored a long time ago:
https://wiki.oasis-open.org/security/SstcSamlMetadataExtQuery
> The vendor responded, in explaining what was wrong with the metagen.sh generated metadata:
>
> The <RoleDescriptor> tag has to be in front of the "protocolSupportEnumeration" tag.
To be precise, <RoleDescriptor> is an element and protocolSupportEnumeration is an XML attribute, but no, you shouldn't use RoleDescriptor to denote an IdP or an SP. You should use IDPSSODescriptor and SPSSODescriptor for that.
I suppose you *could* write the equivalent of IDPSSODescriptor and SPSSODescriptor in terms of RoleDescriptor, but I haven't tried that.
My guess is that it would be schema-valid.
> This is because EntityDescriptor is picking up the SAML 1.1 version
> for the EntityId since there is nothing in front of those white space separated protocols listed in the "protocolSupportEnumeration" signifying it is not part of EntityID but should be part of the RoleDescriptor.
I have no idea what that sentence is trying to say.
> Personally, I don't think the vendor's statement explains why they need roleDescriptor with spSSODescriptor is already there. The issue that generated all of this is that the vendor, acting as an IDP, is reading in metadata on one of our SPs and recognizing it as only SAML 1.1 capable which it, obviously, is more than that.
Well then they're doing something wrong.
> Can someone more well-versed in SAML help me out here?
It's a simple matter to show whether a SAML metadata file is schema-valid. Instructions for showing InCommon metadata to be schema-valid are in the spaces wiki (https://spaces.internet2.edu/x/JwQjAQ). There's even a set of schema files attached to that page.
There's no point in wasting cycles debating whether or not a chunk of code is valid. Just run it through the validator and see what happens.
Hope this helps,
Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
------------------------------
Message: 3
Date: Mon, 9 Jul 2012 12:45:27 -0400
From: Tom Scavo <trscavo at gmail.com>
Subject: Re: Should IDP/SP metadata contain a roleDescriptor tag?
To: Shib Users <users at shibboleth.net>
Message-ID:
<CAEtu=dNzVZedg--DFYGqaY3A=wPTssN-OW2dv6gCybVJjvxU0g at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
On Mon, Jul 9, 2012 at 12:38 PM, Wessel, Keith William <kwessel at illinois.edu> wrote:
>
> Since we're not going to find roleDescriptor tags in the InCommon metadata but rather the derived tags for idpSSODescriptor and spSSODescriptor, I think the vendor's going to need to sort this out if, in fact, it does insist on roleDescriptor. That's still unclear.
May I ask, is this AD FS? I recall seeing this kind of thing in the AD FS docs.
> At any rate, I appreciate the info... and the suggesting of running it through validation. By validation, I assume you're referring to xmlsectool, correct?
Yes, xmlsectool is what we use. There is a set of schema files on the previously mentioned wiki page that lets you do offline schema validation. (If you try to schema validate without them, the network might get in your way.)
Tom
------------------------------
Message: 4
Date: Mon, 9 Jul 2012 19:01:18 +0200
From: Yannick B?ot <yannick.beot at gmail.com>
Subject: Re: Shibd crashing on LogoutRequest
To: Shib Users <users at shibboleth.net>
Message-ID:
<CAMer1X4Wa1Can-TgboomcATETT3PiFV77D-hmLCJJsjEwBWZ9A at mail.gmail.com>
Content-Type: text/plain; charset="iso-8859-1"
I cannot open a issue on JIRA. I can not see Shibboleth SP C++.
I tried the request on another system : I got a 'expiration message'
exception, which means that the decoding part is OK.
But I tested it again on the production and it crashed :(
Unfortunately, I can not get a core dump yet...
I will work on that.
Best Regards,
Yannick
On Mon, Jul 9, 2012 at 6:28 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 7/9/12 12:21 PM, "Yannick B?ot" <yannick.beot at gmail.com> wrote:
> >
> >I do not have core dumps for the moment. I will work on it but it is
> >a production environment.
> >
> >Do you see a test to perform?
>
> File a bug, and I'll attempt to feed something resembling the message
> into a Windows version that I can debug and see if it crashes. If you
> can get a stack trace you can attach that to the bug.
>
> I doubt very much that the crash is in the decode step.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120709/9df57714/attachment-0001.html
------------------------------
Message: 5
Date: Mon, 9 Jul 2012 10:51:15 -0700
From: "Ordona, Kenneth C" <Kenneth.Ordona at pnnl.gov>
Subject: Test Installation on Virtual PCs
To: "users at shibboleth.net" <users at shibboleth.net>
Message-ID:
<6778DE83AB681D49BFC2CD850610FEB1018F1932C633 at EMAIL04.pnl.gov>
Content-Type: text/plain; charset="us-ascii"
This is probably a pretty basic question but here goes:
I'm currently trying to create a test installation of the Shibboleth IDP/SP on two separate virtual PCs(IDP on one, SP on the other).
However, I am currently barred from using my dns in the installation due to security reasons. Is there any way that I can get the IDP and SP to communicate with each other without using the DNS of my organization(PNNL)?
Thank you for helping me,
Ken Ordona
------------------------------
Message: 6
Date: Mon, 9 Jul 2012 13:54:17 -0400
From: Chad La Joie <lajoie at itumi.biz>
Subject: Re: Test Installation on Virtual PCs
To: Shib Users <users at shibboleth.net>
Message-ID:
<CACTY7uDzLh2pzR=ToFzqRfTeDqT3hE-mHyXpA_=+ksVFyv4_ng at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Use your /etc/hosts file?
On Mon, Jul 9, 2012 at 1:51 PM, Ordona, Kenneth C <Kenneth.Ordona at pnnl.gov> wrote:
> This is probably a pretty basic question but here goes:
>
> I'm currently trying to create a test installation of the Shibboleth IDP/SP on two separate virtual PCs(IDP on one, SP on the other).
> However, I am currently barred from using my dns in the installation due to security reasons. Is there any way that I can get the IDP and SP to communicate with each other without using the DNS of my organization(PNNL)?
>
> Thank you for helping me,
> Ken Ordona
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
--
Chad La Joie
www.itumi.biz
trusted identities, delivered
------------------------------
Message: 7
Date: Mon, 9 Jul 2012 11:54:19 -0600
From: David Langenberg <davel at uchicago.edu>
Subject: Re: Test Installation on Virtual PCs
To: Shib Users <users at shibboleth.net>
Message-ID:
<CACrmAWO+ssMJwApCvXLbSn05fHZxWOCGJio+4FM8mkMTbq2+3g at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
You could use local hosts files. http://en.wikipedia.org/wiki/Hosts_(file)
We use this method to test new production IdP/SPs which will be used
to replace existing services without affecting DNS.
Dave
On Mon, Jul 9, 2012 at 11:51 AM, Ordona, Kenneth C
<Kenneth.Ordona at pnnl.gov> wrote:
> This is probably a pretty basic question but here goes:
>
> I'm currently trying to create a test installation of the Shibboleth IDP/SP on two separate virtual PCs(IDP on one, SP on the other).
> However, I am currently barred from using my dns in the installation due to security reasons. Is there any way that I can get the IDP and SP to communicate with each other without using the DNS of my organization(PNNL)?
>
> Thank you for helping me,
> Ken Ordona
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
David Langenberg
Identity & Access Management
The University of Chicago
------------------------------
Message: 8
Date: Mon, 9 Jul 2012 17:56:39 +0000
From: "Wessel, Keith William" <kwessel at illinois.edu>
Subject: RE: Should IDP/SP metadata contain a roleDescriptor tag?
To: Shib Users <users at shibboleth.net>
Message-ID:
<A1EB7EC659FA0F429A55865D5820006D2DCA8FDE at CITESMBX1.ad.uillinois.edu>
Content-Type: text/plain; charset="us-ascii"
Thanks, Tom. Yes, we already grabbed the off-line schema files a while back for our own validation purposes. Thanks for mentioning it, though.
And no, this is CA Siteminder, not AD FS.
Keith
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: Monday, July 09, 2012 11:45 AM
To: Shib Users
Subject: Re: Should IDP/SP metadata contain a roleDescriptor tag?
On Mon, Jul 9, 2012 at 12:38 PM, Wessel, Keith William <kwessel at illinois.edu> wrote:
>
> Since we're not going to find roleDescriptor tags in the InCommon metadata but rather the derived tags for idpSSODescriptor and spSSODescriptor, I think the vendor's going to need to sort this out if, in fact, it does insist on roleDescriptor. That's still unclear.
May I ask, is this AD FS? I recall seeing this kind of thing in the AD FS docs.
> At any rate, I appreciate the info... and the suggesting of running it through validation. By validation, I assume you're referring to xmlsectool, correct?
Yes, xmlsectool is what we use. There is a set of schema files on the previously mentioned wiki page that lets you do offline schema validation. (If you try to schema validate without them, the network might get in your way.)
Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 13, Issue 23
*************************************
More information about the users
mailing list