Initial Setup -- Cannot Get SP and IDP Talking

[Sam Agnew]

Peter,

Thank you for your help!

On Nov 5, 2013, at 11:59 AM, Peter Schober wrote:



2013-11-05 10:19:59 ERROR XMLTooling.libcurl.InputStream : error
while fetching https://unixadmin.qatar-med.cornell.edu: (22) The
requested URL returned error: 403 Forbidden

If that is the entityID (or the URL for metadata) of the IdP then it
does not match the above entityID which ends in "/idp/shibboleth".

OK. I found that indeed the URL was wrong in /etc/shibboleth/shibboleth2.xml. I corrected the URL based on the example to:
https://unixadmin.qatar-med.cornell.edu/idp/profile/Metadata/SAML

This got me to the login window for the IDP. We are authenticating via LDAP. I managed to get the CA trusted via the Java keystore.
When authentication succeeds, however, I now get an error about the return path:

Error Message: No peer endpoint available to which to send SAML response

Looking in shibd_warn.logs I see:
2013-11-05 14:23:17 ERROR XMLTooling.libcurl.InputStream : error while fetching https://unixadmin.qatar-med.cornell.edu/idp/profile/Metadata/SAML: (22) The requested URL returned error: 404 Not Found
2013-11-05 14:23:17 ERROR XMLTooling.ParserPool : fatal error on line 0, column 0, message: internal error in NetAccessor
2013-11-05 14:23:17 ERROR OpenSAML.MetadataProvider.XML : error while loading resource (https://unixadmin.qatar-med.cornell.edu/idp/profile/Metadata/SAML): XML error(s) during parsing, check log for specifics
2013-11-05 14:23:17 WARN OpenSAML.MetadataProvider.XML : adjusted reload interval to 600 seconds
2013-11-05 14:23:17 WARN OpenSAML.MetadataProvider.XML : trying backup file, exception loading remote resource: XML error(s) during parsing, check log for specifics
2013-11-05 14:27:15 WARN Shibboleth.Application : insecure cookieProps setting, set to "https" for SSL/TLS-only usage
2013-11-05 14:27:15 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites

Although actually visiting the URL (https://unixadmin.qatar-med.cornell.edu/idp/profile/Metadata/SAM) does show me XML output in a web browser.

Looking in idp-process.log I see:
14:27:58.505 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID 'https://unixadmin.qatar-med.cornell.edu/idp/shibboleth' could not be resolved
14:29:03.613 - INFO [Shibboleth-Access:73] - 20131105T112903Z|207.162.244.209|unixadmin.qatar-med.cornell.edu:443|/profile/SAML2/Redirect/SSO|
14:29:03.620 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party https://unixadmin.qatar-med.cornell.edu/idp/shibboleth
14:30:18.031 - INFO [Shibboleth-Access:73] - 20131105T113018Z|207.162.244.209|unixadmin.qatar-med.cornell.edu:443|/profile/SAML2/Redirect/SSO|
14:30:18.035 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID 'https://unixadmin.qatar-med.cornell.edu/idp/shibboleth' could not be resolved
14:30:28.671 - INFO [Shibboleth-Access:73] - 20131105T113028Z|207.162.244.209|unixadmin.qatar-med.cornell.edu:443|/profile/SAML2/Redirect/SSO|
14:30:28.672 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party https://unixadmin.qatar-med.cornell.edu/idp/shibboleth
14:42:49.400 - INFO [Shibboleth-Access:73] - 20131105T114249Z|207.162.244.209|unixadmin.qatar-med.cornell.edu:443|/profile/Metadata/SAML|
14:53:46.252 - INFO [Shibboleth-Access:73] - 20131105T115346Z|207.162.244.209|unixadmin.qatar-med.cornell.edu:443|/profile/Metadata/SAML|

I'm not sure how to resolve this.

Thanks!

Sam




--
Sam Agnew
System Administrator
IT Department
Weill Cornell Medical College in Qatar



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131105/844bf8f7/attachment-0001.html