Can't get testshib to work with my new SP

[Mike Reynolds]

Actually, I just noticed that the web page that steered me wrong isn't from 
Univ of Washington, but is a Shibboleth page:

    https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxInstall

In there, they say you're ready to test your site against the TestShib IdP 
once you've done the install and initial testing.  But that is incorrect --  
you need to change your entityID *first*, as explained in the next step in 
setup in

    https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarted

Probably no big deal to shibboleth experts, who will say "well, of course!". 
But if you're rote beginner like me and rigorously following the 
instructions....

--Mike Reynolds from Univ of Washington


-----Original Message----- 
From: Mike Reynolds
Sent: Wednesday, November 06, 2013 2:06 PM
To: Shib Users
Subject: Re: Can't get testshib to work with my new SP

thank you, thank you!  I see the problem was that the docs for Univ of
Washington said I was configured enough to try out shibtest, but in fact I
needed to set my entityID first.  Works great now.

--Mike Reynolds

-----Original Message----- 
From: Kevin P. Foote
Sent: Wednesday, November 06, 2013 12:46 PM
To: Shib Users
Subject: Re: Can't get testshib to work with my new SP


On Wed, 6 Nov 2013, Mike Reynolds wrote:

>
> The only problem I can think of is if shibd is somehow grabbing the 
> virtual
> server's internal 192.168 ip address, but I have "UseCanonicalName On", 
> and
> AFAIKT all the traffic and metadata to/from testshib is properly using the
> external ip address sandbox.lib.washington.edu.  So what am I doing wrong?
> The shibtest site isn't broken or anything, right?


TestShib is not broken.. The error message is correct.

The entityID on your file is such ...

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_657cf08a6730ac2e70ce094b8262cdf79ce25120"
entityID="https://sp.example.org/shibboleth">

You need to fix up your entityID

A) so it is unique :-)

B) so the IdP knows what metadata to use when communicating with your
service.

------
thanks
  kevin.foote
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net