New to shibboleth, so perhaps I'm missing something. Have read thru the
docs, followed (I thought) the instructions, but no joy using the testshib
IdP with my SP. Details:
*********** SP Config ******************
Redhat5 Linux running Apache 2.2.3
Installed 64-bit Shibboleth 2.5.2 via yum install
************* relevant part of apache .conf ***************
LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_22.so
Listen 192.168.10.36:443
<VirtualHost 192.168.10.36:443>
Enablesendfile Off
SSLEngine on
# Production certificate, key
SSLCertificateFile /etc/pki/tls/certs/lib.washington.edu.crt.NEW ###
our Thawte *.lib.washington.edu cert
SSLCertificateKeyFile /etc/pki/tls/private/lib.washington.edu.key.NEW
### our Thawte *.lib.washington.edu key)
SSLCertificateChainFile /etc/pki/tls/certs/intermediate.crt
DirectoryIndex index.html default.html index.jsp default.jsp index.php
DocumentRoot "/var/www/digital/shibtest"
Options +IncludesNOEXEC
ServerName sandbox.lib.washington.edu
UseCanonicalName On
<Location /Shibboleth.sso>
Satisfy Any
Allow from all
</Location>
Alias /shibboleth-sp/main.css /var/www/digital/shibtest/main.css
<Location /shibboleth-sp>
Satisfy Any
Allow from all
</Location>
<Location />
AuthType shibboleth
ShibRequestSetting requireSession 1
require valid-user
</Location>
</VirtualHost>
************ end of Apache .conf ***************
I followed (I thought) all the instructions for registering (went fine, my
metadata file seemed reasonable), configuring (swapped out my default
shibboleth2.xml for the one generated at testshib), but when I try to use it
I just get the "you didn't submit any metadata" error:
Error Message: SAML 2 SSO profile is not configured for relying party
https://sandbox.lib.washington.edu/shibboleth
The IdP error log just has these entries, which seem to also say that I
hadn't submitted my metadata:
15:26:29.793 - INFO [Shibboleth-Access:73] -
20131106T202629Z|128.95.104.78|idp.testshib.org:443|/profile/SAML2/Redirect/SSO|
15:26:29.794 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86]
- shibboleth.HandlerManager: Looking up profile handler for request path:
/SAML2/Redirect/SSO
15:26:29.794 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97]
- shibboleth.HandlerManager: Located profile handler of the following type
for the request path:
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
15:26:29.794 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:339] -
LoginContext key cookie was not present in request
15:26:29.794 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:188]
- Incoming request does not contain a login context, processing as first
leg of request
15:26:29.795 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:366]
- Decoding message with decoder binding
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
15:26:29.799 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128]
- Looking up relying party configuration for
https://sandbox.lib.washington.edu/shibboleth
15:26:29.799 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134]
- No custom relying party configuration found for
https://sandbox.lib.washington.edu/shibboleth, looking up configuration
based on metadata groups.
15:26:29.799 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157]
- No custom or group-based relying party configuration found for
https://sandbox.lib.washington.edu/shibboleth. Using default relying party
configuration.
15:26:29.800 - WARN
[org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] -
SPSSODescriptor role metadata for entityID
'https://sandbox.lib.washington.edu/shibboleth' could not be resolved
15:26:29.801 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:387]
- Decoded request from relying party
'https://sandbox.lib.washington.edu/shibboleth'
15:26:29.801 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:305]
- No metadata for relying party
https://sandbox.lib.washington.edu/shibboleth, treating party as anonymous
15:26:29.802 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:222]
- SAML 2 SSO profile is not configured for relying party
https://sandbox.lib.washington.edu/shibboleth
There are no entries in any of my shibd logs, the only entry in the http log
is:
128.95.104.78 - - [06/Nov/2013:12:26:26 -0800] "GET /secure/ HTTP/1.1" 302
892 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101
Firefox/25.0"
The only problem I can think of is if shibd is somehow grabbing the virtual
server's internal 192.168 ip address, but I have "UseCanonicalName On", and
AFAIKT all the traffic and metadata to/from testshib is properly using the
external ip address sandbox.lib.washington.edu. So what am I doing wrong?
The shibtest site isn't broken or anything, right?
Thanks for any help
Mike Reynolds
University of Washington