users Digest, Vol 23, Issue 66

[Cantor, Scott]

Please don't respond to digests.

> I am used the metadata  from the system and I modified elements according
> to the instructions in https://wiki.shibboleth.net.

You have to understand what you're changing, you can't follow anything literally or you will just waste your time.

> The files are all in my system. For example the idp-metadata.xml is in my
> C:\IDP_HOME\metadata.

That isn't how you're loading it into the SP, and the way you did so is incorrect. As your logs would tell you, so you need to look at them. In this case the shibd log would indicate that it can't load the metadata from the URL you gave it.

You shouldn't need to use a URL at all, you should copy the metadata to the etc/shibboleth directory in the SP and load it locally. That's after making sure it contains what it should contain regarding the IdP entityID, and the URLs of the various endpoints.

> I am using shibtest.example.com because it is the hostname I used when
> installing the IdP. However, I have been using localhost when it came to test
> installations.

Using localhost is confusing, and not relevant to real world use. Using fake names like example.com and example.org only works if you manipulate hosts files to make them work.
 
> I also used shibtest.example.com when installing the Idp because localhost
> was not accepted. I didnt fake anything  actually.

So you own the example.com domain? If not, you're faking and you have to manipulate /etc/hosts to reflect that.

> It is because I didnt fake hostnames that I am encountering that issue?

You have multiple issues, partly due to using incorrect locations and partly because of faking names.

> Before going further in my experimentation   I would have liked to test all in a
> single machine. Can you give me a suitable approach for that case?

I don't know what to tell you other than "the settings have to be right and if they're wrong you need to use your logs". I can answer questions like "what does this message mean?".

> I would also be very glad to read your recommendation regarding the best
> approach you advise me and.

I did so. Use real machines, real hostnames, and keep the two halves separate. And don't load metadata directly from the the opposite peer. Extract it or copy it, review it for correctness regarding entityID, hostnames, http vs. https, etc. and then install it locally for direct loading.

-- Scott