No Peer Endpoint...
Dominic Forrest
dom.forrest at gmail.com
Fri Apr 5 14:56:53 EDT 2013
I've now reinstalled two VMs running CentOS6 with selinux and iptables both disabled with the names idp3 and sp3 following instructions from https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSPLocalTestInstall.
The only place I am aware I have deviated from the instructions is when told to:" Change the entityID on the Intranet <SessionInitiator Location="Login">to https://idp.machine/idp/shibboleth. This is your IdP's name, and will send users directly to your IdP's login service." This is referring to shibboleth2.xml on the SP but this section does not seem to exist. I have updated the SSO section as follows instead but would appreciate if someone could confirm if this is correct or not:
Configures SSO for a default IdP. To allow for >1 IdP, remove
entityID property and adjust discoveryURL to point to discovery service.
(Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
You can also override entityID on /Login query string, or in RequestMap/htaccess.
-->
<SSO entityID="https://idp3.martyforrest.com/idp/shibboleth"
discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
SAML2 SAML1
</SSO>
(The full config file is below).
I am not getting as far as before with the following error when browsing to https://sp3.martyforrest.com/secure:
opensaml::saml2md::MetadataException
The system encountered an error at Fri Apr 5 19:41:12 2013
To report this problem, please contact the site administrator at root at localhost.
Please include the following message in any email:
opensaml::saml2md::MetadataException at (https://sp3.martyforrest.com/secure)
Unable to locate metadata for identity provider (https://idp3.martyforrest.com/idp/shibboleth)
I cannot see any issued and would appreciate some help….
I have copied the shibboleth2.xml and the output from the remote metadata it used below…
Apologies for the length of the post.
Dom
shibboleth2.xml from SP
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<!--
By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
are used. See example-shibboleth2.xml for samples of explicitly configuring them.
-->
<!--
To customize behavior for specific resources on Apache, and to link vhosts or
resources to ApplicationOverride settings below, use web server options/commands.
See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help.
For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml
file, and the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo topic.
-->
<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
<ApplicationDefaults entityID="https://sp3.martyforrest.com/shibboleth"
REMOTE_USER="eppn persistent-id targeted-id">
<!--
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
You MUST supply an effectively unique handlerURL value for each of your applications.
The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
a relative value based on the virtual host. Using handlerSSL="true", the default, will force
the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
Note that while we default checkAddress to "false", this has a negative impact on the
security of your site. Stealing sessions via cookie theft is much easier with this disabled.
-->
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="false" cookieProps="http">
<!--
Configures SSO for a default IdP. To allow for >1 IdP, remove
entityID property and adjust discoveryURL to point to discovery service.
(Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
You can also override entityID on /Login query string, or in RequestMap/htaccess.
-->
<SSO entityID="https://idp3.martyforrest.com/idp/shibboleth"
discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
SAML2 SAML1
</SSO>
<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<!--
Allows overriding of error template information/filenames. You can
also add attributes with values that can be plugged into the templates.
-->
<Errors supportContact="root at localhost"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>
<!-- Example of remotely supplied batch of signed metadata. -->
<MetadataProvider type="XML" uri="https://idp3.martyforrest.com/idp/profile/Metadata/SAML"
backingFilePath="federation-metadata.xml" reloadInterval="7200">
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
</MetadataProvider>
<!-- Example of locally maintained metadata. -->
<!--
<MetadataProvider type="XML" file="partner-metadata.xml"/>
-->
<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<!-- Use a SAML query if no attributes are supplied during SSO. -->
<AttributeResolver type="Query" subjectMatch="true"/>
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
<!--
The default settings can be overridden by creating ApplicationOverride elements (see
the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
Resource requests are mapped by web server commands, or the RequestMapper, to an
applicationId setting.
Example of a second application (for a second vhost) that has a different entityID.
Resources on the vhost would map to an applicationId of "admin":
-->
<!--
<ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
-->
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<!-- Low-level configuration about protocols and bindings available for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
https://idp3.martyforrest.com/idp/profile/Metadata/SAML
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"entityID="https://idp3.martyforrest.com/idp/shibboleth">
<IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
<Extensions>
<shibmd:Scope regexp="false">martyforrest.com</shibmd:Scope>
</Extensions>
<KeyDescriptor>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIDPzCCAiegAwIBAgIUI62qgIbhVfiZdfyZGFxI6rGREhYwDQYJKoZIhvcNAQEF BQAwIDEeMBwGA1UEAxMVaWRwMy5tYXJ0eWZvcnJlc3QuY29tMB4XDTEzMDQwNTE1 NTE0N1oXDTMzMDQwNTE1NTE0N1owIDEeMBwGA1UEAxMVaWRwMy5tYXJ0eWZvcnJl c3QuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhDHis7lgZoph agviGBeUKWm4TNvAZtKeH8DqijCt69LuQxvcIUfOINyKZiBtwWT3fNzsRTNJFkoa U/2vkr8jOZhS3dWLI7WvCeBolF930feAGmwSR8S0cm6Ndls6QRx9O9A5Ng8nEaGS iFvddR8iDnmnQgXJ0VGnUE/6J6zqgSbPI3G58SieSwCwpTw5Aq5j3q469GaxULEw Oggls46XOsF7gb0j21RtvzGuX3h1kEIFemjw6Zan2ng7hlScVeTuZsWKv/Lz+t8f jO1McuuMPdFGA4JfPO5fHseCfkUW4nnV6rjPSw9AUXidcwzdVcTt8bj91Z+//2DM kcgglB4vxwIDAQABo3EwbzBOBgNVHREERzBFghVpZHAzLm1hcnR5Zm9ycmVzdC5j b22GLGh0dHBzOi8vaWRwMy5tYXJ0eWZvcnJlc3QuY29tL2lkcC9zaGliYm9sZXRo MB0GA1UdDgQWBBSgNBL8gHZ4tGxRXQBNAP9RHOj89TANBgkqhkiG9w0BAQUFAAOC AQEAP4KzSWGMZTxecA3akK/fiKvq1Hr1iqk2r7C2H/KK2HpUTgBJ2CHNEGzGp3Qx +nAFCTXjEwUmlHpmeiRX6mANfOTmZnKl2MD7O5apNIFS/xYdj3P5eKt7OYISGCjG 5zkXgWdGBkM+LaFiXBA2ZC/QnbSFupY2hGbO9EnoNynASwxmtwKoUElhqwZ5LsVW TYPHcvoFcwlNx8530Futj4ldlMUaNs4OuHxXIrQUg9gPFXLeKaceGD3DP/eJv7J6 9Xy/oEh87FUX0/gTRmfP9eewMBEbX0zrRxlo3VwsOcNMtHv1gLgAjfRfmbiOzBmu R4TQzLmCoAtjMz+PTtKIu8s0Wg==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"Location="https://idp3.martyforrest.com:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
<ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"Location="https://idp3.martyforrest.com:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/>
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
<NameIDFormat>
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
</NameIDFormat>
<SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"Location="https://idp3.martyforrest.com/idp/profile/Shibboleth/SSO"/>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"Location="https://idp3.martyforrest.com/idp/profile/SAML2/POST/SSO"/>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"Location="https://idp3.martyforrest.com/idp/profile/SAML2/POST-SimpleSign/SSO"/>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"Location="https://idp3.martyforrest.com/idp/profile/SAML2/Redirect/SSO"/>
</IDPSSODescriptor>
<AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
<Extensions>
<shibmd:Scope regexp="false">martyforrest.com</shibmd:Scope>
</Extensions>
<KeyDescriptor>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIDPzCCAiegAwIBAgIUI62qgIbhVfiZdfyZGFxI6rGREhYwDQYJKoZIhvcNAQEF BQAwIDEeMBwGA1UEAxMVaWRwMy5tYXJ0eWZvcnJlc3QuY29tMB4XDTEzMDQwNTE1 NTE0N1oXDTMzMDQwNTE1NTE0N1owIDEeMBwGA1UEAxMVaWRwMy5tYXJ0eWZvcnJl c3QuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhDHis7lgZoph agviGBeUKWm4TNvAZtKeH8DqijCt69LuQxvcIUfOINyKZiBtwWT3fNzsRTNJFkoa U/2vkr8jOZhS3dWLI7WvCeBolF930feAGmwSR8S0cm6Ndls6QRx9O9A5Ng8nEaGS iFvddR8iDnmnQgXJ0VGnUE/6J6zqgSbPI3G58SieSwCwpTw5Aq5j3q469GaxULEw Oggls46XOsF7gb0j21RtvzGuX3h1kEIFemjw6Zan2ng7hlScVeTuZsWKv/Lz+t8f jO1McuuMPdFGA4JfPO5fHseCfkUW4nnV6rjPSw9AUXidcwzdVcTt8bj91Z+//2DM kcgglB4vxwIDAQABo3EwbzBOBgNVHREERzBFghVpZHAzLm1hcnR5Zm9ycmVzdC5j b22GLGh0dHBzOi8vaWRwMy5tYXJ0eWZvcnJlc3QuY29tL2lkcC9zaGliYm9sZXRo MB0GA1UdDgQWBBSgNBL8gHZ4tGxRXQBNAP9RHOj89TANBgkqhkiG9w0BAQUFAAOC AQEAP4KzSWGMZTxecA3akK/fiKvq1Hr1iqk2r7C2H/KK2HpUTgBJ2CHNEGzGp3Qx +nAFCTXjEwUmlHpmeiRX6mANfOTmZnKl2MD7O5apNIFS/xYdj3P5eKt7OYISGCjG 5zkXgWdGBkM+LaFiXBA2ZC/QnbSFupY2hGbO9EnoNynASwxmtwKoUElhqwZ5LsVW TYPHcvoFcwlNx8530Futj4ldlMUaNs4OuHxXIrQUg9gPFXLeKaceGD3DP/eJv7J6 9Xy/oEh87FUX0/gTRmfP9eewMBEbX0zrRxlo3VwsOcNMtHv1gLgAjfRfmbiOzBmu R4TQzLmCoAtjMz+PTtKIu8s0Wg==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"Location="https://idp3.martyforrest.com:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>
<AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"Location="https://idp3.martyforrest.com:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
<NameIDFormat>
urn:oasis:names:tc:SAML:2.0:nameid-format:transient
</NameIDFormat>
</AttributeAuthorityDescriptor>
</EntityDescriptor>
On 5 Apr 2013, at 14:53, Dominic Forrest <dom.forrest at gmail.com> wrote:
>
> Thankyou. I think I'll go back to basics on this and start agin on CentOS…. I appreciate your help but fear I may have some future questions…
>
>
> Dom
>
>
> On 5 Apr 2013, at 14:51, Peter Schober <peter.schober at univie.ac.at> wrote:
>
>> I don't have an explanation yet. The snipplets you've sent so far seem
>> to be OK. The IdP seems to load the SP's metadata and vice versa. The
>> metadata for the SP looks fine.
>> So something in your deployment is off.
>>
>> Note that you're running on an unsupported (by the Shibboleth project)
>> platform and did not follow the locally installed documentation.
>> I'm pretty sure Ubuntu (taking it from Debian) mentions to run the
>> shib-keygen command after installation, in which case your SP's
>> metadata would have also contained its public key. Jfyi.
>>
>> * Dominic Forrest <dom.forrest at gmail.com> [2013-04-05 15:22]:
>>> <metadata:MetadataProvider id="URLMD" xsi:type="metadata:FileBackedHTTPMetadataProvider"
>>> metadataURL="https://sp.zzz.com/Shibboleth.sso/Metadata"
>>> backingFile="/opt/shibboleth-idp/metadata/some-metadata.xml">
>>> <metadata:MetadataFilter xsi:type="metadata:ChainingFilter">
>>> <metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList">
>>> <metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>
>>> </metadata:MetadataFilter>
>>> </metadata:MetadataFilter>
>>> </metadata:MetadataProvider>
>>
>> Jfyi, the metadata generated from the SP will never contain anything
>> else but an SPSSODescriptor, so you can remove the filter (and the
>> surrounding chaining filter as it would be empty then).
>>
>> Maybe the IdP is not yet actually using the changed relying-partyx.xml
>> config (requires a restart of the context or container) -- is the
>> backingFile specified above being generated properly?
>>
>>> <!--
>>> This is example metadata only. Do *NOT* supply it as is without review,
>>> and do *NOT* provide it in real time to your partners.
>>> -->
>>
>> Yes, so much for that.
>>
>> Note that your IdP logged:
>>
>> No return endpoint available for relying party https://sp.zzz.com
>>
>> but your SP config had:
>>
>> entityID="https://sp.xxx.com"
>>
>> I suppose that's just because you don't want to use RFC 2606 host
>> names in emails and you messed up the pseudonymization in your
>> examples. (The SP's metadata also had zzz.)
>>
>>> What I do not understand is how this is being generated by the SP
>>> however t appears I would be better saving this locally on the IDP
>>> and (with help) editing as appropriate?
>>
>> Not your issue currently and will only come up later. I thought there
>> was a wiki page for that (which then should be linked from that XML
>> comment) but can't fint it atm.
>> Ignore that for now, or search the list archives.
>> -peter
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130405/1a3ffc71/attachment-0001.html
More information about the users
mailing list