Turned around on SP metadata

[Stein, Eric]

Hi,

  I'm a little turned around on the SP metadata. I have an install of shibboleth-2.3.8 as my IdP. I want to protect some applications using shibboleth-sp (2.5.1). I got everything running against TestShib, which is good. When I tried protecting my applications, though, shibboleth is crapping out. The earliest issue is  this warning: 'SPSSODescriptor role metadata for entityID 'https://my.shibboleth.server.com/shibboleth' could not be resolved'.



  I *think* I need to set up a MetadataProvider in the IdP for the SP, as detailed here: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-DefinetheMetadataProvider. Does that seem correct? If so, this is what I have right now in relying-party.xml. I guess I'd add a file-backed HTTP metadata provider pointing to my SP?



<!-- MetadataProvider the combining other MetadataProviders -->

<metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider">



    <!-- Load the IdP's own metadata.  This is necessary for artifact support. -->

    <metadata:MetadataProvider id="IdPMD"

                               xsi:type="metadata:FilesystemMetadataProvider"

                               metadataFile="C:/shibboleth-2.3.8/metadata/idp-metadata.xml"

                               maxRefreshDelay="P1D" />

  </metadata:MetadataProvider>

  Do I need to set up Metadata for the SP as detailed on  https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP<https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP>? I'm a little surprised that the SP doesn't come with metadata already defined, but I may be grossly misunderstanding.



Thanks,

Eric Stein




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130318/248fe2d9/attachment.html