help setting up testshib proof of concept

[Jonathan Sabo]

Never mind... I forgot to register my certs and stuff....   I'll be
back with more questions shortly :P

On Wed, Jun 20, 2012 at 3:05 PM, Jonathan Sabo <jsabo at criminal.org> wrote:
> List,
>
> I'm just getting started with Shibboleth and I'm trying to test my
> service provider with Testshib.   So far I've had some issues....  I
> see these in the logs.
>
> 14:58:55.796 INFO [Shibboleth-Access:73] -
> 20120620T185855Z|96.255.220.50|idp.testshib.org:443|/profile/SAML2/Redirect/SSO|
> 14:58:55.797 DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:85]
> - shibboleth.HandlerManager: Looking up profile handler for request
> path: /SAML2/Redirect/SSO
> 14:58:55.797 DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:93]
> - shibboleth.HandlerManager: Located profile handler of the following
> type for the request path:
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
> 14:58:55.797 DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:142]
> - Incoming request does not contain a login context, processing as
> first leg of request
> 14:58:55.798 DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:282]
> - Decoding message with decoder binding
> 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
> 14:58:55.801 DEBUG [PROTOCOL_MESSAGE:91] -
> <?xml version="1.0" encoding="UTF-8"?>
> <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
> AssertionConsumerServiceURL="https://www.dev.careverge.com/Shibboleth.sso/SAML2/POST"
> Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
> ID="_1837dc0083362d5a3b814ac909609035"
> IssueInstant="2012-06-20T18:58:55Z"
> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> Version="2.0">
>   <saml:Issuer
> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://www.dev.careverge.com/shibboleth</saml:Issuer>
>   <samlp:NameIDPolicy AllowCreate="1"/>
> </samlp:AuthnRequest>
>
> 14:58:55.802 DEBUG
> [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:126]
> - Looking up relying party configuration for
> https://www.dev.careverge.com/shibboleth
> 14:58:55.802 DEBUG
> [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:132]
> - No custom relying party configuration found for
> https://www.dev.careverge.com/shibboleth, looking up configuration
> based on metadata groups.
> 14:58:55.804 DEBUG
> [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:155]
> - No custom or group-based relying party configuration found for
> https://www.dev.careverge.com/shibboleth. Using default relying party
> configuration.
> 14:58:55.805 DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:303]
> - Decoded request from relying party
> 'https://www.dev.careverge.com/shibboleth'
> 14:58:55.807 WARN
> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:256]
> - No metadata for relying party
> https://www.dev.careverge.com/shibboleth, treating party as anonymous
> 14:58:55.808 WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:173]
> - SAML 2 SSO profile is not configured for relying party
> 'https://www.dev.careverge.com/shibboleth'
>
> My current configuration is attached.   I'm not sure what I'm missing yet....
>
> I'm also curious how I can configure this so that I can have multiple
> identity providers with their own shared metadata.   How does
> shibboleth know which one to use based on where they are coming from?
>
> Thanks,
>
> Jonathan