shibboleth2.4 configuration error

[Juan Fu]

   		Hi  


We need to use SAML single sign on to the other company’s portal. They have simpleSAMLPhp SP. 


Our environment is J2ee. So we installed shibboleth2.4 on linux which is already hosting a Java/web application and followed  http://wiki.aaf.edu.au/tech-info/identity-provider/new-idp-install-guide-2-4-0-uApprove-2-5-0#TOC-Install-packages to install and configure IDP 


http://testidp.mycompany.com:8080/idp/Authn/UserPassword shows login screen 

http://testidp.mycompany.com:8080/idp/shibboleth shows metadata.xml 


Here some errors I am encountering: 


1.        I notice when I browsehttp://testidp.mycompany.com:8080/idp/shibboleth, I notice EntityID shown as https://testidp.mycompany.com:8080/idp/shibboleth, <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://testidp.mycompany.com/idp/profile/SAML2/POST/SLO" />, <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="http://testidp.mycompany.com/idp/profile/Shibboleth/SSO"/>

if I browse  https://testidp.mycompany.com:8080/idp/shibboleth, it shows certificate error and when I click continue, it shows error. 

2.       When I configure relying-party.xml 

a)      Add below code after </rp:DefaultRelyingParty>
<rp:RelyingParty id="http://remote simpleSAMLphp SP IP address" 

provider="http://testidp.mycompany.com:8080/idp/shibboteth"

defaultSigningCredentialRef="IdPCredential" >

<rp: ProfileConfiguration xsi:type="saml:SAML2SSOProfile" 

encryptNameIds="never" />

</rp: RelyingParty>


b)      Add <metadata:MetadataProvider id="TESTMD" xsi:type="metadata:FileBackedHTTPMetadataProvider" 

metadataURL="http://remote simplesamlphp SP IP address/simplesamlphp/www/module.php/saml/sp/metadata.php/default-sp" 

backingFile="/opt/shibboleth-idp/metadata/sp.xml" >

<metadata:MetadataFilter xsi:type="metadata:ChainingFilter">

<metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil" 

maxValidityInterval="P7D" />

<metadata:MetadataFilter xsi:type="metadata:SignatureValidation" 

trustEngineRef="shibboleth.MetadataTrustEngine" 

requireSignedMetadata="true" />

<metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList">

<metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>

</metadata:MetadataFilter>

</metadata:MetadataFilter>

</metadata:MetadataProvider>

Sp.xml is saved from metadatURL and put under credentials directory 

c)       Add below code for security configuration 

<security:Credential id="TESTMD" xsi:type="security:X509Filesystem">

<security:PrivateKey>/opt/shibboleth-idp/credentials/saml.key</security:PrivateKey>

<security:Certificate>/opt/shibboleth-idp/credentials/saml.crt</security:Certificate>

</security:Credential>



I restart the tomcat 6. I found /idp application on Tomcat manager did not start. And all http://testidp.mycompany.com:8080/idp/shibboleth not work, and I got the following error: 

10:17:34.552 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:158] - Loading new configuration for service shibboleth.RelyingPartyConfigurationManager 

10:17:34.579 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.RelyingPartyConfigurationManager service, error creating components.  The root cause of this error was: org.xml.sax.SAXParseException: Element or attribute do not match QName production: QName::=(NCName':')?NCName. 

Can anyone here tell me how to fix it?  

Thank you ahead. 
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131120/efc8c4d5/attachment.html