Initial Setup -- Cannot Get SP and IDP Talking

[Cantor, Scott]

On 11/27/13, 2:54 AM, "Sam Agnew" <saa2012 at qatar-med.cornell.edu> wrote:
>
>Here is what makes me think it is correct:
>
>On the SP the shibboleth2.xml file directs the SP to load the IDP
>metadata from the IDP via URL
>(https://idpt.qatar-med.cornell.edu/idp/profile/Metadata/SAML). I can see
>that this
> is successful in the shibd.log file:

That doesn't make any metadata correct, it simply means it loaded.
Metadata is information. Just because it's syntactically correct doesn't
make it true for the purposes of operating successfully.

The most likely reason for the error is having the wrong public key in the
metadata you gave it. If that's not the cause, I have no other earthly
idea. The assertion was clearly signed and successfully decrypted, so
there's no reason for it to fail other than a bad key.

>On the IDP the metadata is loaded from file according to idp-process.log:

The IdP doesn't use its own metadata for anything relevant to this problem.

>Comparing a cURL of the xml from that URL
>(https://idpt.qatar-med.cornell.edu/idp/profile/Metadata/SAML) to the
>data in the file (/opt/shibboleth-idp/metadata/idp-metadata.xml)
> reveals that they match.

That also means nothing. That's generated at install time. If the keypair
were changed for some reason after installation, it wouldn't match and it
wouldn't be right.

>What I need to do is find out how to get to the bottom of the issue.
>Where should I look?

You'll have to compare the credentials on the IdP to the message in the
log and to what's in the metadata you gave the SP.

You should also make sure to turn all the logging categories up high on
the SP.

-- Scott