test of idP to idP using testshib.org

[Bo Lorentsen]

Hi ...

I am I newbie to in all this, and learning how to use SSO is quite a 
challenge, and it has/is quite hard to get a grip of all the concepts, 
so please bear with me if my questions are too simple.

I have setup an SP (on a linux wheezy, using the offical package) and 
tested it against testshib.org, and this worked like a charm ! So I went 
on with may plan with renewed hope of success :-)

My next step was to try out to setup my own idP (I need to join a 
federation (MS AFDS 2) as my next/last step), and then setup 
testshib.org to be able to test it.

The setup seems find, after learning how to use apache2/tomcat6 and all 
this funny issues.

Now this did not work, when I use my SP and I end up with this error at 
my idP :

00:44:52.358 - DEBUG 
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] 
- No custom or group-based relying party configuration found for 
https://idp.moch.dk/idp/shibboleth. Using default relying party 
configuration.
00:44:52.358 - DEBUG 
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] - 
Checking child metadata provider for entity descriptor with entity ID: 
https://idp.moch.dk/idp/shibboleth
00:44:52.358 - DEBUG 
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] - 
Searching for entity descriptor with an entity ID of 
https://idp.moch.dk/idp/shibboleth
00:44:52.358 - DEBUG 
[org.opensaml.saml2.binding.AuthnResponseEndpointSelector:47] - Unable 
to select endpoint, no entity role metadata available.
00:44:52.358 - ERROR 
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429] 
- No return endpoint available for relying party 
https://idp.moch.dk/idp/shibboleth

I have added the testshib.org to my relay-party.xml file as described at 
the test site, and uploaded the idp-metadata.xml to the test system, but 
I end up here. I expected my idP to relay my auth request to the test 
server, but that seems not to happend. Are there some routing info I 
need to add, that I have not configured properly, yet ?

I tried to look for help in both the wiki and on Google, but I did not 
find anything useful, or maybe I don't know what to expect of the 
testshib.org.

Am I right to expect testshib.org to provide the authentication (in this 
simple setup), or will it simply send my request back to my own server 
and then expect this server to provide the authentication (if that is 
the case, the error is understandable).

Looking forward to some enlightenment :-)


Regards

Bo Lorentsen