Remote IdP not responding?

[Peter Schober]

* Roger Jagoda <rberryj3 at gmail.com> [2013-07-05 17:00]:
> We are setting up just the barest SP for their test:

I'd start with the default config and /only/ change what needs to be
changed from reading the NativeSPGettingStarted page.

> <ApplicationDefaults
> entityID="https://corpshibtest.ourcompany.com/Shibboleth.sso"
>         REMOTE_USER="ShibTest" eppn persistent-id targeted-id">

Jfyi, there's really no need to include "/Shibboleth.sso" there (which
is a httpd content handler for the Shib SP, while your entityID is a
/name/ to identify your deployment).

> The local metadata from the client (sent to us because of firewall
> issues, physical file in the server's file tree):
> 
>    <MetadataProvider type="XML" file="/etc/shibboleth/testdb-idp2-metadata.xml"
> backingFilePath="/var/cache/shibboleth/testdb-idp2-metadata.xml"
> maxRefreshDelay="86400">
>    </MetadataProvider>

That may work but I think it's a variant of something already
discussed earlier in that thread: A MetadataProvider/@file will be
looked for in /etc/shibboleth/ and by default any backup files in
backingFilePath will be created in /var/cache/shibboleth -- so adding
the path there will accomplish nothing the software wouldn't do
anyway (assuming rpm package file system layout).

Also with a file based MetadataProvider having a (file based) backup
copy of that file is pointless. Same with the maxRefreshDelay unless
you intend to modify the local metadata file on disc.

Here's an example for using local metadata, from the distributed
default shibboleth2.xml:

        <!-- Example of locally maintained metadata. -->
        <!--
        <MetadataProvider type="XML" file="partner-metadata.xml"/>
        -->

That's all that should be needed.

> Could they be involved in our error?

If the error still is "No default session initiator found, check
configuration." then no.

> The latest try (with the native.log error) was with the vhost change
> in the location block:
> 
> <Location /index.php.phpinfo>
>    AuthType shibboleth
>    ShibRequestSetting entityID https://sso.brown.edu/idp/shibboleth
>    ShibRequireSession On
>    require valid-user
>    ShibUseHeaders On
> </Location>

The IdP to initiate a session with (Brown's IdP, here) is not a "vhost
change". It has nothing to do with virtual hosts.

> We changed the above to another IdP (not supplied by local file but by
> the actual <SSO> URL):
> 
> 
>             <SSO entityID="https://shibboleth2.shidb.idp2.edu">
>               SAML2 SAML1
>             </SSO>
> 
> and everything works just fine.
> 
> Thoughts?

Can you write up as short as possible what config works and what
doesn't?
Are you saying you can put any IdP entityId into the SSO's entityID
attribut and it works, but putting that same entityId into httpd
directives (via ShibRequestSetting entityID) you get the "No default
session initiator found" error?
Or is it that you have a specific IdP entityId and wherever you put
that the error occurs?
Or something else?
-peter