users Digest, Vol 23, Issue 66
Gilles Badouet
badouetg at uni.coventry.ac.uk
Wed May 22 13:17:14 EDT 2013
I am used the metadata from the system and I modified elements according to the instructions in https://wiki.shibboleth.net.
The files are all in my system. For example the idp-metadata.xml is in my C:\IDP_HOME\metadata.
I am using shibtest.example.com because it is the hostname I used when installing the IdP. However, I have been using localhost when it came to test installations.
I also used shibtest.example.com when installing the Idp because localhost was not accepted. I didnt fake anything actually.
It is because I didnt fake hostnames that I am encountering that issue?
Before going further in my experimentation I would have liked to test all in a single machine. Can you give me a suitable approach for that case?
I would also be very glad to read your recommendation regarding the best approach you advise me and.
Thanks
Kind regards
Gilles Rubens Badouet
Coventry University
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of users-request at shibboleth.net [users-request at shibboleth.net]
Sent: 22 May 2013 17:00
To: users at shibboleth.net
Subject: users Digest, Vol 23, Issue 66
Send users mailing list submissions to
users at shibboleth.net
To subscribe or unsubscribe via the World Wide Web, visit
http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
users-request at shibboleth.net
You can reach the person managing the list at
users-owner at shibboleth.net
When replying, please edit your Subject line so it is more specific
than "Re: Contents of users digest..."
Today's Topics:
1. RE: Shibboleth with Office 365 (Cantor, Scott)
2. Idp installation on Windows (Jim Hoy)
3. RE: Metadata issue (Cantor, Scott)
4. RE: using the SimpleAggregation AttributeResolver (Cantor, Scott)
5. RE: Idp installation on Windows (Rod Widdowson)
----------------------------------------------------------------------
Message: 1
Date: Wed, 22 May 2013 13:56:07 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: Shibboleth with Office 365
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D9491383945A7E8C at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> a) How many days it took for the testing to be completed?
> b) Any project plan? Our customer looking for Project Plan with time lines?
Unless you compare apples to apples with skill sets, that doesn't have any relevance. What would take me a day might take somebody else weeks (and vice versa if the skill set gap was reversed).
-- Scott
------------------------------
Message: 2
Date: Wed, 22 May 2013 13:54:38 +0000
From: Jim Hoy <jim.hoy at acatar.com>
Subject: Idp installation on Windows
To: "users at shibboleth.net" <users at shibboleth.net>
Message-ID:
<115654FD6303724494AD5FA3A96E3669C78889 at PGHXCH01.acatar.local>
Content-Type: text/plain; charset="us-ascii"
Hi all,
I'm really really new to Shibboleth and I'm running into installation issues that I can't solve. I'm attempting to install IDP version 2.4.0 via the instructions on the wiki at:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPQuickInstall
I get through step 6 (the actual install) and follow the instructions to test...
Step 1. Test the Tomcat install (https://<server>:<port>/<https://%3cserver%3e:%3cport%3e/>) and I get back my Tomcat welcome page.
Step 2. Test the IDP install (https://<server>:<port>/idp/status<https://%3cserver%3e:%3cport%3e/idp/status>) and I get a 404 not found tossed out by Tomcat.
I've not done servlets in a long time, but I recall how they work. I downloaded a very simple servlet added it and ran it properly, so I'm certain the problem isn't with the Tomcat installation itself... but when I try to access the IDP servlet at all, I'm 404'd...
I have no idea what to check or change. I've tried to change "setting A" and test, no luck, so I reset "setting A" and change "setting B" and test... no luck so I reset "setting B", etc... (A and B are arbitrary; hopefully you get my point though).
Any help would be very graciously accepted and helpful. Thanks you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130522/9bca37da/attachment-0001.html
------------------------------
Message: 3
Date: Wed, 22 May 2013 14:01:19 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: Metadata issue
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D9491383945A7EAE at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> Some precisions on my shibboleth2.xml and relying-party.xml basic
> configurations are as follow:
Don't try and automate metadata exchange like this, because you will get it wrong. Get the metadata from the systems, review it for correctness with regard to URLs, use of http vs https, etc., and then place it locally for consumption for testing.
> <MetadataProvider type="XML" uri="http://shibtest.example.com/idp-
> metadata.xml"
There is no metadata likely to be found at that URL, and the log probably says that. Also, that's not a real hostname unless you faked it (you don't say).
> metadataURL="http://sp.example.org/shibboleth.sso/Metadata"
Likewise there is no guarantee the metadata coming back from that has what you need in it, nor is it likely that sp.example.org would resolve at all unless you manipulated /etc/hosts.
You are doing the most difficult thing you can do to test this, using one machine for both and using fake names. That's just asking for confusion, so I don't recommend that approach.
-- Scott
------------------------------
Message: 4
Date: Wed, 22 May 2013 14:15:24 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
Subject: RE: using the SimpleAggregation AttributeResolver
To: Shib Users <users at shibboleth.net>
Message-ID:
<BA63CEAE152A7742B854C678D9491383945A7ED5 at CIO-KRC-D1MBX01.osuad.osu.edu>
Content-Type: text/plain; charset="us-ascii"
> If there's anyone using this plugin in production, I'd really like to
> hear about it.
I know SWITCH has used it.
> One question right off the top: If the attributeId XML attribute is
> omitted, will the plugin use the previously asserted SAML2 Persistent
> NameID? More generally, can the plugin be made to use the value of
> eduPersonTargetedID as the NameID?
attributeId (space-delimited list of strings)
Optional list of attribute IDs to search for a value to use as the identifier in the queries performed. The first attribute value found will be used as the value of the <NameID>. If this attribute is omitted, the original <NameID> supplied by the user's original IdP is simply copied directly.
When it's talking about "attribute" there, it means a decoded attribute inside the SP, which can come from anything you can extract into an attribute.
-- Scott
------------------------------
Message: 5
Date: Wed, 22 May 2013 15:16:10 +0100
From: "Rod Widdowson" <rdw at steadingsoftware.com>
Subject: RE: Idp installation on Windows
To: "'Shib Users'" <users at shibboleth.net>
Message-ID: <007d01ce56f6$ea879260$bf96b720$@steadingsoftware.com>
Content-Type: text/plain; charset="Windows-1252"
> Step 2. Test the IDP install (https://<server>:<port>/idp/status) and I
get a 404 not found tossed out by Tomcat.
This will be due to the IdP not starting correctly.
You will need to check the log (c:\program
files\Intrenet2\ShibIdP\logs\irp-process.log IIRC) to see why that happened.
Common cases are
1) Wrong password supplied for LDAP
2) You do not have the certificate for the AD store installed in you java
keystore.
(https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnec
tor see under Advanced Configuration Options/LDAP SSL-TLS Support )
But the log should point you right.
------------------------------
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
End of users Digest, Vol 23, Issue 66
*************************************
More information about the users
mailing list