test of idP to idP using testshib.org

[Bo Lorentsen]

On 2012-09-18 15:33, Paul Hethmon wrote:
> It's a bit unclear on what exactly you've done, but comments/questions
> inline.
Sorry, I will try to explain to my best of knowledge, but thanks for the 
very quick answer !
> The setup seems find, after learning how to use apache2/tomcat6 and all
> this funny issues.
> So, at this point, your Linux SP is working against your copy of
> Shibboleth IdP? Normally you would not use Apache2 in combination with the
> IdP software and this can sometimes lead to set up complications. Not that
> it cannot work, it is just more complicated.
Yeps, my SP first worked directly against the testshib.org, and I 
changed it to use my newly installed shibboleth idP, using the meta data 
found on this new idP.

I can see the it redirect from my SP to my idP as I expected it to do, 
but I did expect my idP to relay this request to the testshib.org 
server, but instead in seems to fail on looking for a authentication 
mechanism on my idP with I have not provided at the moment (did not 
think it was necessary yet)

I know apache make things more complicated but, I really need to use 
this due to other requirements outside the scope of this setup, and I 
believe that I understand the apache part of the problem :-)
> So this error means that the IdP does not know where to send the SAML
> Response to. It could mean that your SAML Authn Request did not contain an
> AssertionConsumerService URL, or that the metadata you loaded onto your
> IdP for your SP does not have ACS endpoints listed.
Will the testshib.org not qualify for a ACS ? In the log file snip i 
found that it was complaining about :

No custom or group-based relying party configuration found for 
https://idp.moch.dk/idp/shibboleth. Using default relying party 
configuration.

Does this mean that in ignore my testshib entry in the relay-party file ?
> So how does testshib.org fit into testing between an IdP and SP on 
> your systems? Or am I misunderstanding your setup? Paul -- To 
> unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net 
Hmm, the setup is like this :

SP (linux service : https://lue.dk/sso) -> idP (idp.moch.dk) -> idP 
(testshib.org)

Again thanks for your fast relay, I am already full of renewed hope :-)

/BL