Remote IdP not responding?

[Roger Jagoda]

Shibboleth Users,

We have a strange situation that we could use some help with.

We host a Web Product for a remote College client on our datacenter
cluster. In-bound customers need to be able to authenticate to the
College's IdP via an SP installation he have completed recently.

The remote College is not Federated at all, but they do have a Meta
available with a URL similar to this:

https://shibboleth.testdb.idp2.edu

When I use that URL in a normal browser at my workstation (which is on
the pubic internet), we see the XML file. No problems.

However, when we try a protected page from our SP server, we see these errors:

shibd.log:

2013-06-27 18:42:07 ERROR Shibboleth.Listener [20846] shib_check_user:
socket call (unknown) resulted in error (32): no message
2013-06-27 18:42:07 ERROR Shibboleth.Listener [20846] shib_check_user:
remoted message returned an error: Unable to locate metadata for
identity provider (https://shibboleth.testdb.idp2.edu)
2013-06-27 18:42:07 ERROR Shibboleth.Apache [20846] shib_check_user:
Unable to locate metadata for identity provider
(https://shibboleth.testdb.idp2.edu)

and similar from the native.log:

2013-06-27 18:42:07 DEBUG Shibboleth.Listener [1]: dispatching message
(default/Login::run::SAML2SI)
2013-06-27 18:42:07 WARN Shibboleth.SessionInitiator.SAML2 [1]: unable
to locate metadata for provider ((https://shibboleth.testdb.idp2.edu)


>From our shibboleth2.xml file:

            <SSO entityID="https://shibboleth.testdb.idp2.edu)">
              SAML2 SAML1
            </SSO>


and the Provider lines:

        <MetadataProvider type="Chaining">
        <MetadataProvider type="XML"  uri="https://shibboleth.testdb.idp2.edu"
         backingFilePath="/tmp/shibboleth/testdb.idp2-metadat.xml"
maxRefreshDelay="86400">
        </MetadataProvider>
        <MetadataFilter type="EntityRoleWhiteList">
          <RetainedRole>md:IDPSSODescriptor</RetainedRole>
        </MetadataFilter>
        </MetadataProvider>


Just in case, we added the local MetaFile that we were able to
download from any browser:

        <MetadataProvider type="XML"
file="/tmp/shibboleth/testdb.idp2-metadat.xm"/>


The REALLY stange thing is that we can use CURL and still access the
remote meta from the SP Server itself:

SVR07  # curl -k -o ./testdb.idp2.meta.xml  https://shibboleth.testdb.idp2.edu
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  4753    0  4753    0     0   8283      0 --:--:-- --:--:-- --:--:-- 90673
CBRDWEBP07 BROWN # ls -la
total 16
drwxr-xr-x 2 root root 4096 Jun 27 19:06 .
drwxr-xr-x 4 root root 4096 Jun 27 19:05 ..
-rw-r--r-- 1 root root 4753 Jun 27 19:06 testdb.idp2.meta.xml
SVR07 #


So why can't we connect / authenticate to the remote IdP?


--RJ

====================================

Roger Jagoda
rberryj3 at gmail.com
==============================================