No Peer Endpoint...
Dominic Forrest
dom.forrest at gmail.com
Fri Apr 5 15:16:10 EDT 2013
I found the log file error on the SP:
==> shibd_warn.log <==
2013-04-05 20:11:05 ERROR XMLTooling.ParserPool : fatal error on line 0, column 0, message: unable to open primary document entity '/var/cache/shibboleth/federation-metadata.xml'
2013-04-05 20:11:05 ERROR OpenSAML.MetadataProvider.XML : error while loading resource (/var/cache/shibboleth/federation-metadata.xml): XML error(s) during parsing, check log for specifics
2013-04-05 20:11:05 CRIT OpenSAML.MetadataProvider.XML : maintaining existing configuration, error reloading resource (https://idp3.martyforrest.com/idp/profile/Metadata/SAML): XML error(s) during parsing, check log for specifics
2013-04-05 20:12:49 WARN Shibboleth.Application : insecure cookieProps setting, set to "https" for SSL/TLS-only usage
2013-04-05 20:12:49 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites
2013-04-05 20:12:49 WARN OpenSAML.MetadataProvider.XML : adjusted reload interval to 600 seconds
2013-04-05 20:12:49 WARN OpenSAML.MetadataProvider.XML : trying backup file, exception loading remote resource: Metadata did not include a validUntil attribute.
2013-04-05 20:12:49 ERROR XMLTooling.ParserPool : fatal error on line 0, column 0, message: unable to open primary document entity '/var/cache/shibboleth/federation-metadata.xml'
2013-04-05 20:12:49 ERROR OpenSAML.MetadataProvider.XML : error while loading resource (/var/cache/shibboleth/federation-metadata.xml): XML error(s) during parsing, check log for specifics
2013-04-05 20:12:49 CRIT Shibboleth.Application : error initializing MetadataProvider: XML error(s) during parsing, check log for specifics
The remote IDP metadata is in my previous email and I have pasted the relying_party from the IDP here.
Thankyou.
Dom
root at idp3 conf]# cat relying-party.xml
<?xml version="1.0" encoding="UTF-8"?>
<!--
This file is an EXAMPLE configuration file.
This file specifies relying party dependent configurations for the IdP, for example, whether SAML assertions to a
particular relying party should be signed. It also includes metadata provider and credential definitions used
when answering requests to a relying party.
-->
<rp:RelyingPartyGroup xmlns:rp="urn:mace:shibboleth:2.0:relying-party" xmlns:saml="urn:mace:shibboleth:2.0:relying-party:saml"
xmlns:metadata="urn:mace:shibboleth:2.0:metadata" xmlns:resource="urn:mace:shibboleth:2.0:resource"
xmlns:security="urn:mace:shibboleth:2.0:security" xmlns:samlsec="urn:mace:shibboleth:2.0:security:saml"
xmlns:samlmd="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mace:shibboleth:2.0:relying-party classpath:/schema/shibboleth-2.0-relying-party.xsd
urn:mace:shibboleth:2.0:relying-party:saml classpath:/schema/shibboleth-2.0-relying-party-saml.xsd
urn:mace:shibboleth:2.0:metadata classpath:/schema/shibboleth-2.0-metadata.xsd
urn:mace:shibboleth:2.0:resource classpath:/schema/shibboleth-2.0-resource.xsd
urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd
urn:mace:shibboleth:2.0:security:saml classpath:/schema/shibboleth-2.0-security-policy-saml.xsd
urn:oasis:names:tc:SAML:2.0:metadata classpath:/schema/saml-schema-metadata-2.0.xsd">
<!-- ========================================== -->
<!-- Relying Party Configurations -->
<!-- ========================================== -->
<rp:AnonymousRelyingParty provider="https://idp3.martyforrest.com/idp/shibboleth" defaultSigningCredentialRef="IdPCredential"/>
<rp:DefaultRelyingParty provider="https://idp3.martyforrest.com/idp/shibboleth" defaultSigningCredentialRef="IdPCredential">
<!--
Each attribute in these profiles configuration is set to its default value,
that is, the values that would be in effect if those attributes were not present.
We list them here so that people are aware of them (since they seem reluctant to
read the documentation).
-->
<rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" includeAttributeStatement="false"
assertionLifetime="PT5M" signResponses="conditional" signAssertions="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile" assertionLifetime="PT5M"
signResponses="conditional" signAssertions="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile" signResponses="conditional"
signAssertions="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" includeAttributeStatement="true"
assertionLifetime="PT5M" assertionProxyCount="0"
signResponses="never" signAssertions="always"
encryptAssertions="conditional" encryptNameIds="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" includeAttributeStatement="true"
assertionLifetime="PT5M" assertionProxyCount="0"
signResponses="never" signAssertions="always"
encryptAssertions="conditional" encryptNameIds="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
assertionLifetime="PT5M" assertionProxyCount="0"
signResponses="conditional" signAssertions="never"
encryptAssertions="conditional" encryptNameIds="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile"
signResponses="never" signAssertions="always"
encryptAssertions="conditional" encryptNameIds="never"/>
</rp:DefaultRelyingParty>
<!-- ========================================== -->
<!-- Metadata Configuration -->
<!-- ========================================== -->
<!-- MetadataProvider the combining other MetadataProviders -->
<metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider">
<!-- Load the IdP's own metadata. This is necessary for artifact support. -->
<metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FilesystemMetadataProvider"
metadataFile="/opt/shibboleth-idp/metadata/idp-metadata.xml"
maxRefreshDelay="P1D" />
<!-- Example metadata provider. -->
<!-- Reads metadata from a URL and store a backup copy on the file system. -->
<!-- Validates the signature of the metadata and filters out all by SP entities in order to save memory -->
<!-- To use: fill in 'metadataURL' and 'backingFile' properties on MetadataResource element -->
<metadata:MetadataProvider id="URLMD" xsi:type="metadata:FileBackedHTTPMetadataProvider"
metadataURL="https://sp3.martyforrest.com/Shibboleth.sso/Metadata"
backingFile="/opt/shibboleth-idp/metadata/some-metadata.xml">
<metadata:MetadataFilter xsi:type="metadata:ChainingFilter">
<metadata:MetadataFilter xsi:type="metadata:SchemaValidation"/>
</metadata:MetadataFilter>
</metadata:MetadataProvider>
</metadata:MetadataProvider>
<!-- ========================================== -->
<!-- Security Configurations -->
<!-- ========================================== -->
<security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">
<security:PrivateKey>/opt/shibboleth-idp/credentials/idp.key</security:PrivateKey>
<security:Certificate>/opt/shibboleth-idp/credentials/idp.crt</security:Certificate>
</security:Credential>
<!-- Trust engine used to evaluate the signature on loaded metadata. -->
<!--
<security:TrustEngine id="shibboleth.MetadataTrustEngine" xsi:type="security:StaticExplicitKeySignature">
<security:Credential id="MyFederation1Credentials" xsi:type="security:X509Filesystem">
<security:Certificate>/opt/shibboleth-idp/credentials/federation1.crt</security:Certificate>
</security:Credential>
</security:TrustEngine>
-->
<!-- DO NOT EDIT BELOW THIS POINT -->
<!--
The following trust engines and rules control every aspect of security related to incoming messages.
Trust engines evaluate various tokens (like digital signatures) for trust worthiness while the
security policies establish a set of checks that an incoming message must pass in order to be considered
secure. Naturally some of these checks require the validation of the tokens evaluated by the trust
engines and so you'll see some rules that reference the declared trust engines.
-->
<security:TrustEngine id="shibboleth.SignatureTrustEngine" xsi:type="security:SignatureChaining">
<security:TrustEngine id="shibboleth.SignatureMetadataExplicitKeyTrustEngine" xsi:type="security:MetadataExplicitKeySignature" metadataProviderRef="ShibbolethMetadata"/>
<security:TrustEngine id="shibboleth.SignatureMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXSignature" metadataProviderRef="ShibbolethMetadata"/>
</security:TrustEngine>
<security:TrustEngine id="shibboleth.CredentialTrustEngine" xsi:type="security:Chaining">
<security:TrustEngine id="shibboleth.CredentialMetadataExplictKeyTrustEngine" xsi:type="security:MetadataExplicitKey" metadataProviderRef="ShibbolethMetadata"/>
<security:TrustEngine id="shibboleth.CredentialMetadataPKIXTrustEngine" xsi:type="security:MetadataPKIXX509Credential" metadataProviderRef="ShibbolethMetadata"/>
</security:TrustEngine>
<security:SecurityPolicy id="shibboleth.ShibbolethSSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay" required="false"/>
<security:Rule xsi:type="samlsec:IssueInstant" required="false"/>
<security:Rule xsi:type="samlsec:MandatoryIssuer"/>
</security:SecurityPolicy>
<security:SecurityPolicy id="shibboleth.SAML1AttributeQuerySecurityPolicy" xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay"/>
<security:Rule xsi:type="samlsec:IssueInstant"/>
<security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine"/>
<security:Rule xsi:type="samlsec:MandatoryIssuer"/>
<security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
</security:SecurityPolicy>
<security:SecurityPolicy id="shibboleth.SAML1ArtifactResolutionSecurityPolicy" xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay"/>
<security:Rule xsi:type="samlsec:IssueInstant"/>
<security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine"/>
<security:Rule xsi:type="samlsec:MandatoryIssuer"/>
<security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
</security:SecurityPolicy>
<security:SecurityPolicy id="shibboleth.SAML2SSOSecurityPolicy" xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay"/>
<security:Rule xsi:type="samlsec:IssueInstant"/>
<security:Rule xsi:type="samlsec:SAML2AuthnRequestsSigned"/>
<security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:MandatoryIssuer"/>
</security:SecurityPolicy>
<security:SecurityPolicy id="shibboleth.SAML2AttributeQuerySecurityPolicy" xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay"/>
<security:Rule xsi:type="samlsec:IssueInstant"/>
<security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine"/>
<security:Rule xsi:type="samlsec:MandatoryIssuer"/>
<security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
</security:SecurityPolicy>
<security:SecurityPolicy id="shibboleth.SAML2ArtifactResolutionSecurityPolicy" xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay"/>
<security:Rule xsi:type="samlsec:IssueInstant"/>
<security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine"/>
<security:Rule xsi:type="samlsec:MandatoryIssuer"/>
<security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
</security:SecurityPolicy>
<security:SecurityPolicy id="shibboleth.SAML2SLOSecurityPolicy" xsi:type="security:SecurityPolicyType">
<security:Rule xsi:type="samlsec:Replay"/>
<security:Rule xsi:type="samlsec:IssueInstant"/>
<security:Rule xsi:type="samlsec:ProtocolWithXMLSignature" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:SAML2HTTPRedirectSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="samlsec:SAML2HTTPPostSimpleSign" trustEngineRef="shibboleth.SignatureTrustEngine"/>
<security:Rule xsi:type="security:ClientCertAuth" trustEngineRef="shibboleth.CredentialTrustEngine"/>
<security:Rule xsi:type="samlsec:MandatoryIssuer"/>
<security:Rule xsi:type="security:MandatoryMessageAuthentication"/>
</security:SecurityPolicy>
</rp:RelyingPartyGroup>
On 5 Apr 2013, at 20:09, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> On 4/5/13 2:56 PM, "Dominic Forrest" <dom.forrest at gmail.com> wrote:
>
>> The only place I am aware I have deviated from the instructions is when
>> told to:" Change
>> the entityID on
>> the Intranet <SessionInitiator Location="Login">to
>> https://idp.machine/idp/shibboleth.
>> This is your IdP's name, and will send users directly to your IdP's
>> login service." This is referring to shibboleth2.xml on the SP but this
>> section does not seem to exist. I have updated the
>> SSO section as follows instead but would appreciate if someone could
>> confirm if this is correct or not:
>
> I updated the page, it's out of date.
>
>> I have copied the shibboleth2.xml
>> and the output from the remote metadata it used belowŠ
>
> That all looks correct, which means I guarantee you have an error sitting
> in the SP log that would tell you the underlying problem. It's failing
> during startup most likely with an error loading the metadata you think
> it's using.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list