R: TESTSHIB: unable to locate metadata for provider

[Mauro Minella]

Nate,
you've hit the nail on the head :).

Actually, I followed this guide http://www.microsoft.com/en-us/download/details.aspx?id=35464 that on page 47 says

a.          Type "idp0.shib.idmgt.archims.fr" in What is the DNS Name of this host? This value is used to name the Shibboleth 2 IdP endpoints in the generated metadata.

b.         Type "SHIB,DC=IDMGT,DC=ARCHIMS,DC=FR" in What is the name of the Active Directory Domain that this IdP will serve ? This is the name of the LDAP domain component from which the Shibboleth 2IdP will serve authentication and attributes. This value is primarily used to limit the search scope for LDAP lookups.

c.          Leave What scope will the IdP assert ? empty

d.         Click Next.

I will inform the authors, however I left an empty scope because I didn't want that some users were filtered out. In fact, even though my AD domain name is "shibbo-domain.local", I defined AD users like john.smith at eduteamit.net<mailto:john.smith at eduteamit.net>  and paul.brown at otherdomain.com<mailto:paul.brown at otherdomain.com> and so I didn't know what to write there, during Shibboleth installation. I probably misunderstood the point, but I supposed that my users' domain should match the scope I write there, shound't it?


Another QQ: where could I find the error you reported (Scope must have TextContent)? I could find only the other generic error "unable to locate metadata for provider".

Thank you so much,

Mauro


Da: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] Per conto di Nate Klingenstein
Inviato: domenica 6 gennaio 2013 01.21
A: Shib Users
Oggetto: Re: TESTSHIB: unable to locate metadata for provider

Mauro,

The Scope element in your metadata was null, which is not permitted.  The TestShib SP's logs will say this; just search for your metadata's file name in the logs.

2013-01-05 19:14:42 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (/opt/testshib-user-metadata/shibbo1233.xml)
2013-01-05 19:14:42 ERROR OpenSAML.MetadataProvider.XML : metadata intance failed manual validation checking: Scope must have TextContent.

I've changed it to "eduteamit.net<http://eduteamit.net>" and it works now.

Resolving this was challenging because you had uploaded a large number of files containing invalid metadata with the same entityID.  Please reuse the same filename if you are uploading new metadata for a known entity.

Thanks,
Nate.

On 5 Jan 2013, at 23:51, Mauro Minella <Mauro.Minella at microsoft.com<mailto:Mauro.Minella at microsoft.com>>
 wrote:


I'm getting crazy trying to understand where is the problem for this task that I did several times in the past.

I installed Shibboleth 2.3.8 and configured it to access my Active Directory.
Now, if I open https://shibbidp.eduteamit.net/idp/shibboleth, it correctly shows my metadata on a valid SSL channel (certificate is provided by GoDaddy).
The same files shows entityID="https://shibbidp.eduteamit.net/idp/shibboleth" in the EntityDescriptor node.

So I saved the XML file, uploaded it on https://www.testshib.org/metadata.html and finally tested it on https://sp.testshib.org/, where I enteredhttps://shibbidp.eduteamit.net/idp/shibboleth.

However, when I hit GO! I get the error

opensaml::saml2md::MetadataException at (https://sp.testshib.org/Shibboleth.sso/TestShib)

Unable to locate metadata for identity provider (https://shibbidp.eduteamit.net/idp/shibboleth)
And the last lines of the log say
2013-01-05 18:41:21 INFO OpenSAML.MetadataProvider.XML : reload thread finished
2013-01-05 18:41:21 INFO OpenSAML.MetadataProvider.XML : reload thread finished
2013-01-05 18:41:37 DEBUG Shibboleth.Listener [226]: dispatching message (default/TestShib::run::SAML2SI)
2013-01-05 18:41:37 WARN Shibboleth.SessionInitiator.SAML2 [226]: unable to locate metadata for provider (https://shibbidp.eduteamit.net/idp/shibboleth)
2013-01-05 18:41:51 DEBUG Shibboleth.Listener [227]: dispatching message (default/TestShib::run::SAML2SI)
2013-01-05 18:41:51 WARN Shibboleth.SessionInitiator.SAML2 [227]: unable to locate metadata for provider (https://shibbidp.eduteamit.net/idp/shibboleth)
2013-01-05 18:42:01 INFO OpenSAML.MetadataProvider.XML : reload thread finished
2013-01-05 18:42:01 INFO Shibboleth.SecurityPolicyProvider.XML : reload thread finished
2013-01-05 18:46:43 DEBUG Shibboleth.Listener [227]: dispatching message (default/TestShib::run::SAML2SI)
2013-01-05 18:46:43 WARN Shibboleth.SessionInitiator.SAML2 [227]: unable to locate metadata for provider (https://shibbidp.eduteamit.net/idp/shibboleth)

Any help is really appreciated

Mauro




--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130106/8d890b23/attachment-0001.html