Error after succeeded authentication

[Peter Schober]

* Gilles Badouet <badouetg at uni.coventry.ac.uk> [2013-07-09 14:32]:
> Just before your email, I noticed in wiki documentation that it is
> preferable to use uri="http..." instead of ssl based (
> uri="https...") in the metadata provider element of
> shibboleth2.xml. I did that and noticed therefore that the sp loaded
> successfully the IdP metadata. However, I still have the same error
> message after the authentication.

Using TLS/SSL for fetching metadata in a local test deployment may
cause some issues (e.g. with all components on one host and when
accessing the webserver via the loopback interface) but mostly this is
to make clear that fetching metadata this way (i.e., with TLS/SSL or
without TLS/SSL) does *not* provide trustworthy metadata.

So don't fetch metadata via HTTP (or HTTPS, for that matter) and you
rid yourself of all those issues.

>  When I check the sp metadata (some-metadata.xml) loaded by the IdP,
>  I noticed that the endpoint URL  in <md:AssertionConsumerService
>  Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location
>  is effectively "http://ans.247lib.com/Shibboleth.sso/SAML2/POST"
>  index="1" instead of what it is supposed to be as stated in the
>  error ( https://ans.247lib.com/Shibboleth.sso/SAML2/POST'). How can
>  I first access and modify the sp metadata. I cant see it when
>  browsing the sp sub-folders.

That's a consequence of (a) fetching metadata directly from the SP,
which is discouraged (with a comment at the very beginning of that
metadata), and (b) switching the protocol you fetch that metadata with
from https to http, which will then give you http on all included
endpoints.
So, again, don't do that.

> Below is the my metadata provider elements within the relying-party.xml to load the sp metadata.
> 
> <metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider" 
>                           xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
> 						  
> <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FilesystemMetadataProvider"                           
>                                    metadataFile="C:\IDP\metadata\idp-metadata.xml"
>                                    maxRefreshDelay="P1D" />
> 
> <metadata:MetadataProvider id="_7be67ad6e799cc5fdf9631f8904e15120bc0400c" xsi:type="metadata:FileBackedHTTPMetadataProvider"
> 		                  xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>                           metadataURL="http://ans.247lib.com/Shibboleth.sso/Metadata"
>                           backingFile="C:\IDP\metadata\some-metadata.xml" />

Copy the SP's metadata to C:\IDP\metadata\some-metadata.xml and change
the metadata:MetadataProvider to look like this (or the example I
already posted in my previous email):

  <metadata:MetadataProvider id="SomeSP" xsi:type="metadata:FilesystemMetadataProvider"
                             metadataFile="C:\IDP\metadata\some-metadata.xml"                                                                                                                         
                             maxRefreshDelay="P1D" />

> And to add the IdP metadata to the sp:
> 
> <MetadataProvider type="XML" uri="http://amlib.co.uk:8080/idp/profile/Metadata/SAML"
>               backingFilePath="C:\opt\shibboleth-sp\idp_metadata\amlibmetadata.xml" reloadInterval="7200">

Same here: Copy the IDP's metadata to C:\opt\shibboleth-sp\amlibmetadata.xml
directory (which should be C:\opt\shibboleth-sp in your case) and
refer to it with a MetadataProvider via
file="C:\opt\shibboleth-sp\amlibmetadata.xml"

Pointing to http(s) URLs does not solve any of your problems, in fact
it causes them all.
-peter