help setting up testshib proof of concept

[Jonathan Sabo]

List,

I'm just getting started with Shibboleth and I'm trying to test my
service provider with Testshib.   So far I've had some issues....  I
see these in the logs.

14:58:55.796 INFO [Shibboleth-Access:73] -
20120620T185855Z|96.255.220.50|idp.testshib.org:443|/profile/SAML2/Redirect/SSO|
14:58:55.797 DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:85]
- shibboleth.HandlerManager: Looking up profile handler for request
path: /SAML2/Redirect/SSO
14:58:55.797 DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:93]
- shibboleth.HandlerManager: Located profile handler of the following
type for the request path:
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
14:58:55.797 DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:142]
- Incoming request does not contain a login context, processing as
first leg of request
14:58:55.798 DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:282]
- Decoding message with decoder binding
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
14:58:55.801 DEBUG [PROTOCOL_MESSAGE:91] -
<?xml version="1.0" encoding="UTF-8"?>
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://www.dev.careverge.com/Shibboleth.sso/SAML2/POST"
Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
ID="_1837dc0083362d5a3b814ac909609035"
IssueInstant="2012-06-20T18:58:55Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0">
   <saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://www.dev.careverge.com/shibboleth</saml:Issuer>
   <samlp:NameIDPolicy AllowCreate="1"/>
</samlp:AuthnRequest>

14:58:55.802 DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:126]
- Looking up relying party configuration for
https://www.dev.careverge.com/shibboleth
14:58:55.802 DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:132]
- No custom relying party configuration found for
https://www.dev.careverge.com/shibboleth, looking up configuration
based on metadata groups.
14:58:55.804 DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:155]
- No custom or group-based relying party configuration found for
https://www.dev.careverge.com/shibboleth. Using default relying party
configuration.
14:58:55.805 DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:303]
- Decoded request from relying party
'https://www.dev.careverge.com/shibboleth'
14:58:55.807 WARN
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:256]
- No metadata for relying party
https://www.dev.careverge.com/shibboleth, treating party as anonymous
14:58:55.808 WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:173]
- SAML 2 SSO profile is not configured for relying party
'https://www.dev.careverge.com/shibboleth'

My current configuration is attached.   I'm not sure what I'm missing yet....

I'm also curious how I can configure this so that I can have multiple
identity providers with their own shared metadata.   How does
shibboleth know which one to use based on where they are coming from?

Thanks,

Jonathan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: shibboleth2.xml.pub
Type: application/octet-stream
Size: 9714 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20120620/04d893ef/attachment.obj