Initial Setup -- Cannot Get SP and IDP Talking

[Sam Agnew]

Speaking personally, the big huge problem with being a new-to-Shibboleth team implementing a new Shibboleth installation is the sheer scope of the configuration parameters.

When our installation didn't work we were left questioning where we had gone wrong in a range of xml files, certificates, keys and services (shibd, tomcat, httpd) across two boxes. Because of the interaction between the components it wasn't even always obvious where to look. I'm speaking as someone new to the solution here.

TestShib is a fantastic resource but it wasn't at first obvious that we could use it for servers that were not public on the internet. The two essential services that TestShib provided were both equally valuable:
1. Telling us one line in one file to modify to work with their SP or IDP. This alone very helpfully reduced the scope of things we needed to look at
2. Providing isolation to enable us to know which element (SP or IDP) was the source of the fault

Just sharing our experience here. So much of the online documentation is so thorough that it can be unclear what you need for basic functionality and what are simply advanced optional options for certain setups. The other key thing was finding the "DEBUG" option for logging.

We would not have had a pre-2.5 config or something because our whole implementation is new and the whole technology is new to us. However, we have been a month trying to get things working and when someone says, "Make sure the metadata is correct" or, "make sure you are using the right certificate" it isn't always obvious to someone new to the technology where to do these things. entityID alone was something that took time for us to understand and I can see that attribute collection and exchange will be our next hurdle now that basic authentication is working. Testshib gave us the first clear indication that if we were starting from scratch with default files and changed a certain value in a certain file it should work. This gave us the indication that a fresh set of config files on the SP should enable us to achieve a working setup. Once we had an SP and an IDP that both worked with Testshib it was a fairly basic matter to change the relevant values (which we were now more familiar with) to point to each other instead.

So I'm no wiser than you what precisely was broken.

We will now be documenting and replicating this build on new systems. Following that we will have to progress to pulling the attributes we need from AD and handing them back to the application as well as working with multiple IDPs. As far as I can see we should be using this "Embedded DS" for that.

Thanks for all the help!

Sam



On Dec 4, 2013, at 6:15 PM, Cantor, Scott wrote:

On 12/4/13, 3:34 AM, "Sam Agnew" <saa2012 at qatar-med.cornell.edu<mailto:saa2012 at qatar-med.cornell.edu>> wrote:

This was finally the missing link. I moved my old /etc/shibboleth and
reinstalled which gave me new default config files. I then copied the
sp-cert and sp-key from old install to match anything I might have
configured on idp that pointed to the old sp. I then
tracked down all occurrences of the old entityID
(https://unixadmin.qatar-med.cornell.edu) and swapped with the new one
(https://unixadmin.qatar-med.cornell.edu/shibboleth).
I used the shibboleth2.xml generated by testshib as my starting point.

Can you elaborate on what the actual problem was?

I guess you're saying that the old config was in fact in a pre-2.5 state.
That shouldn't matter, but obviously it was also broken in some way.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


--
Sam Agnew
System Administrator
IT Department
Weill Cornell Medical College in Qatar



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131205/ce954238/attachment.html