Shibd -check error

[Cantor, Scott]

On 7/25/12 2:03 PM, "Ordona, Kenneth C" <Kenneth.Ordona at pnnl.gov> wrote:

>I'm trying to register on the TestShib Two site now and I'm getting a
>denial message due to the fact that idp.example.org is already taken as a
>domain name(after un-checking the box that resolves domain name
>validity). Do you know how to get past this without having to reinstall
>my idp as a new unique name?

Use a made-up name in your own domain. The only place the IdP even knows
the name is in a few default settings and the metadata it generates and
you can trash that in two seconds and start over, or just s/old/new/g

>Also, regarding your question with metadata being confusing to users, I
>would say that there are many users that are asked to create a local test
>install of the Shibboleth IDP/SP on the same machine and that the
>IDPSPLocalTestInstall page, while very easy to understand in a
>step-by-step fashion, does not state how exactly to deal with problems
>that creating custom metadata.

The most that page could do is call out to the real documentation. There
is no answer other than "you must understand the metadata so you can
create the metadata you need". Not with the current state of the tools we
offer anyway.

> Not only that, but many of these users are pretty novice when it comes
>to altering or creating XML files(such as me), so when it comes down to
>the more advanced documentation, it goes straight over our heads.

Unfortunately, that's your step 1. If you don't know XML, that's going to
be a fundamental barrier, and picking up that knowledge is a prerequisite
to having a decent experience. We can't create documentation on an XML
mechanism (speaking not of SAML, but our configurations and the metadata
format) that doesn't assume working XML knowledge. It would be useless and
inaccurate.

> Of course, why novice users are attempting to create a local deployment
>of Shibboleth is another question entirely, but it just ends up being
>that way.

I think that novices *with strong XML basics* should be able to read the
metadata material and help identify the gaps (and there are many). I don¹t
have any doubt that without that foundation you'd be lost.

> Also, there are some times when the documentation(such as on the
>LocalTestInstall page) seems to diverge away from what is actually
>included in the installation(or that there are possibly implied steps
>that need to be explicit to us users).

I'm not shocked at that, which is why I'd suggest that you follow the
mainline docs for the IdP and SP separately. testshib's best asset is that
you can tackle one at a time, and then once you have basic grasp, hook
things together. But even without that part, it's still better to follow
the complete documentation.

-- Scott