Centralized discovery service configuration

[Rod Widdowson]

I am pretty sure that this is an SP misconfiguration (but there are better SP experts out there), but from the CDS point of view:

The DS is approached by the SP with a request which returns a “and send me back to this address URL”.  In order to operate securely
the DS checks that the address it has been given is a real and  sensible URL.  These are listed in the metadata that the DS
consumes.

What that error means is that the DS has been given a URL which is not in the metadata.  I am guessing that when you look at the
metadata for the SP you will see something like

<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Location="https://SUBDOMAIN.SITENAME.COM/Shibboleth.sso?DS" index="1"/>

(note DS not LOGIN), so the SP has sent you from the wrong place.  

What do SP the SessionInitiators look like?

Also, any reason why you are using a CDS and not the EDS.  It is significantly easier to set up, does not suffer from metadata
drift, and is one less mission critical service to look after.

/Rod

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Badri
> Sent: 08 May 2012 10:10
> To: Shib Users
> Subject: Centralized discovery service configuration
> 
> Hi All,
> 
> The Shibboleth SSO is setup in our environment and now implementing centralized discovery service to
> let the users to select the IDP servers.
> 
> The discovery service is deployed in tomcat. When a shibboleth protected http site that is hosted in
> the SP is accessed, the user is redirected to the DS page (for IDP select list). But, when a
> shibboleth protected https site is accessed, we get the error below,
> 
> Discovery Service log content:
> 01:59:20.200 - INFO [edu.internet2.middleware.shibboleth.wayf.WayfService:260] - DS initialization
> completed.
> 
> 01:59:23.727 - INFO [edu.internet2.middleware.shibboleth.wayf.WayfService:272] - Handling DS request.
> 
> 01:59:23.853 - DEBUG [edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler:591] -
> Processing Idp Lookup for : http://SITENAME.COM/Shibboleth.sso/Metadata
> 
> 01:59:23.918 - ERROR [edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler:325] - Error
> processing DS request:
> edu.internet2.middleware.shibboleth.wayf.WayfException: Couldn't find endpoint
> https://SUBDOMAIN.SITENAME.COM/Shibboleth.sso/Login in metadata
>         at
> edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler.setupReturnAddress(DiscoveryServiceHa
> ndler.java:490)
>         at
> edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler.handleLookup(DiscoveryServiceHandler.
> java:599)
>         at
> edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler.doGet(DiscoveryServiceHandler.java:32
> 2)
>         at edu.internet2.middleware.shibboleth.wayf.WayfService.doGet(WayfService.java:280)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
>         at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
>         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
>         at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:224)
>         at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
>         at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
>         at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
>         at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
>         at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:928)
>         at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
>         at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
>         at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:987)
>         at
> org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:539)
>         at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:298)
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
>         at java.lang.Thread.run(Thread.java:679)
> 
> 01:59:23.919 - DEBUG [edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler:907] -
> Displaying WAYF error page.
> 
> 01:59:26.886 - TRACE [org.apache.struts.util.PropertyMessageResources:181] - Initializing,
> config='org.apache.struts.taglib.logic.LocalStrings', returnNull=true
> 
> 01:59:26.888 - INFO [org.apache.struts.util.PropertyMessageResources:209] - Operating in Default mode
> [null]
> 
> 01:59:26.897 - TRACE [org.apache.struts.util.PropertyMessageResources:181] - Initializing,
> config='org.apache.struts.taglib.LocalStrings', returnNull=true
> 
> 01:59:26.898 - INFO [org.apache.struts.util.PropertyMessageResources:209] - Operating in Default mode
> [null]
> 
> 01:59:26.901 - TRACE [org.apache.struts.util.PropertyMessageResources:181] - Initializing,
> config='org.apache.struts.taglib.bean.LocalStrings', returnNull=true
> 
> 01:59:26.904 - INFO [org.apache.struts.util.PropertyMessageResources:209] - Operating in Default mode
> [null]
> 
> 01:59:27.234 - TRACE [org.apache.struts.util.PropertyMessageResources:181] - Initializing,
> config='org.apache.struts.util.LocalStrings', returnNull=true
> 
> 01:59:27.234 - INFO [org.apache.struts.util.PropertyMessageResources:209] - Operating in Default mode
> [null]
> 
> 
> Any suggestions would be appreciated.
> 
> - Badri