shibboleth2.4 configuration error

[jfu]

You are right. I did put my own metadataProvider outside of closing tag of id
ShibbnolethMetadata. Once I put it inside close tag, it worked. thanks.

However, I got another error.

1. metadataProvider

  <metadata:MetadataProvider id="SPMD"
xsi:type="metadata:FileBackedHTTPMetadataProvider" 
                         
metadataURL="http://SP_IPAddress/simplesamlphp/www/module.php/saml/sp/metadata.php/default-sp"
                         backingFile="/opt/shibboleth-idp/metadata/sp.xml" >
            <metadata:MetadataFilter xsi:type="metadata:ChainingFilter">
               
                <metadata:MetadataFilter
xsi:type="metadata:SignatureValidation" 
                               
trustEngineRef="shibboleth.SPMetadataTrustEngine" 
                                requireSignedMetadata="true" />
            </metadata:MetadataFilter>
        </metadata:MetadataProvider>


2.  Security Configuration: saml.pem and saml.crt are given by our SP 
<security:TrustEngine id="shibboleth.SPMetadataTrustEngine" 
xsi:type="security:StaticPKIXSignature">

       <security:ValidationInfo id="SPCredentials"
xsi:type="security:PKIXFilesystem">
             
<security:Certificate>/opt/shibboleth-idp/credentials/saml.crt</security:Certificate>
       </security:ValidationInfo>
    </security:TrustEngine>

3. restart tomcat 

4. idp cannot be started and error shown in idp-process.log 

11:54:55.414 - ERROR
[edu.internet2.middleware.shibboleth.common.config.BaseService:188] -
Configuration was not loaded for shibboleth.RelyingPartyConfigurationManager
service, error creating components.  The root cause of this error was:
org.opensaml.saml2.metadata.provider.FilterException: Signature trust
establishment failed for metadata entry. 


If I replace saml.crt with saml.pem, I got uninitialized keystore error.

Please help. Thank you. 
 





--
View this message in context: http://shibboleth.1660669.n2.nabble.com/shibboleth2-4-configuration-error-tp7591617p7591698.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.