Initial Setup -- Cannot Get SP and IDP Talking

[Sam Agnew]

This was finally the missing link. I moved my old /etc/shibboleth and reinstalled which gave me new default config files. I then copied the sp-cert and sp-key from old install to match anything I might have configured on idp that pointed to the old sp. I then tracked down all occurrences of the old entityID (https://unixadmin.qatar-med.cornell.edu) and swapped with the new one (https://unixadmin.qatar-med.cornell.edu/shibboleth). I used the shibboleth2.xml generated by testshib as my starting point.

Now that I have a working setup I am going to rebuild and document. Thanks so much for all the help. Next step will be building a Discovery Service and integrating that into the setup.

Thanks!

Sam


On Dec 3, 2013, at 5:42 PM, Cantor, Scott wrote:

On 12/3/13, 4:40 AM, "Sam Agnew" <saa2012 at qatar-med.cornell.edu<mailto:saa2012 at qatar-med.cornell.edu>> wrote:

That is extremely helpful!
So, I have done the testshib tests and my IDP gets a green light.

On SP I am getting the following:

So we've apparently established that in fact nothing works on your system.
I still have no idea why, but that certainly points to something
fundamentally wrong with your install. What is the platform here and how
is the install being done?

I am interested in:
2013-12-03 10:46:24 DEBUG XMLTooling.CredentialCriteria [2]: key
algorithm didn't match ('AES' != 'RSA')
but that message is only at DEBUG level

Which is why it has nothing to do with the problem.

Do you know where I should look next?

I would suggest raising the logging level of the
XMLTooling.Signature.Debugger category so we can determine if the
signature is even being evaluated.

To be clear, you haven't touched the security-policy.xml file, right? And
this is a fresh install of 2.5.x, no legacy configuration, or some old
generator of configuration material that uses old syntax? Some campuses do
that.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


--
Sam Agnew
System Administrator
IT Department
Weill Cornell Medical College in Qatar



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131204/33ecbed9/attachment.html