Initial Setup -- Cannot Get SP and IDP Talking

[Sam Agnew]

Thanks for the help! I wonder if you or someone can just clarify a few things for me?

Sent from my iPad

> On 27 Nov 2013, at 17:59, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> 
>> On 11/27/13, 2:54 AM, "Sam Agnew" <saa2012 at qatar-med.cornell.edu> wrote:
>> 
>> Here is what makes me think it is correct:
>> 
>> On the SP the shibboleth2.xml file directs the SP to load the IDP
>> metadata from the IDP via URL
>> (https://idpt.qatar-med.cornell.edu/idp/profile/Metadata/SAML). I can see
>> that this
>> is successful in the shibd.log file:
> 
> That doesn't make any metadata correct, it simply means it loaded.
> Metadata is information. Just because it's syntactically correct doesn't
> make it true for the purposes of operating successfully.
> 
> The most likely reason for the error is having the wrong public key in the
> metadata you gave it. If that's not the cause, I have no other earthly
> idea. The assertion was clearly signed and successfully decrypted, so
> there's no reason for it to fail other than a bad key.

Is there a way I can check? I'm pretty sure I verified that the cert in the metadata matches the cert file.

> 
>> On the IDP the metadata is loaded from file according to idp-process.log:
> 
> The IdP doesn't use its own metadata for anything relevant to this problem.
> 

Good to know.

>> Comparing a cURL of the xml from that URL
>> (https://idpt.qatar-med.cornell.edu/idp/profile/Metadata/SAML) to the
>> data in the file (/opt/shibboleth-idp/metadata/idp-metadata.xml)
>> reveals that they match.
> 
> That also means nothing. That's generated at install time. If the keypair
> were changed for some reason after installation, it wouldn't match and it
> wouldn't be right.
> 

I'm pretty sure that isn't the case but is there a way to "reset" the situation? Can I run the installer again? If so, what will I need to reconfigure on IDP and SP afterwards?

>> What I need to do is find out how to get to the bottom of the issue.
>> Where should I look?
> 
> You'll have to compare the credentials on the IdP to the message in the
> log and to what's in the metadata you gave the SP.
> 

In this context, what do we mean by credentials?

> You should also make sure to turn all the logging categories up high on
> the SP.
> 

Yup. Got them both on debug. Been following them as well as I can.

> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net