Error after succeeded authentication

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2013-07-09 17:11]:
> * Gilles Badouet <badouetg at uni.coventry.ac.uk> [2013-07-09 16:59]:
> > I did the configuration as you  recommended. There is no more error
> > in idp-process.log after restarting and authentication. When I
> > restart the shibd daemon, sp logs also show that the Idp metadata
> > has been loaded successfully.
> 
> If that's the case than what's in that metadata doesn't match what the
> IdP is sending:
> 
> > 2013-07-09 15:48:52 WARN OpenSAML.MessageDecoder.SAML2 [2]: no metadata found, can't establish identity of issuer (https://amlib.co.uk/idp:8443/shibboleth)
> > 2013-07-09 15:48:52 WARN Shibboleth.SSO.SAML2 [2]: no metadata found, can't establish identity of issuer (https://amlib.co.uk/idp:8443/shibboleth)
> > 2013-07-09 15:48:52 WARN Shibboleth.SSO.SAML2 [2]: detected a
> > problem with assertion: Unable to establish security of incoming
> > assertion.
> 
> So what is the IdP's entityID according to the IdP configuration
> (relying-party.xml), according to the protocol message (shibd.log on
> DEBUG) and according to the SAML metadata on disk at the SP?

The entityID from the protocol message is the one listed above
(twice) which will also be what the IdP thinks of itself, and we know
that and that it's not what the SP has in metadata on disk.
The easy answer is to fix what the SP has on disk.

E.g. if you just copied what the IDP created duting install (frmo
$IDP_HOME/metadata/idp-metadata.xml) but changed that later in
relying-party.xml then the file idp-metadata.xml did not reflect those
changes (it's only generated once during install as a starting point).
-peter