Shibboleth newbie question [GishPuppy]
shibboleth.92j at gishpuppy.com
shibboleth.92j at gishpuppy.com
Wed Oct 2 05:06:24 EDT 2013
Hi,
i have a non-productive shibboleth-environment. as tutorial i used https://wiki.library.ucsf.edu/display/~234877@ucsf.edu/Running+Shibboleth+IDP+and+SP+Locally+in+Windows.
my changes are the ip's and as ports i have '4443' instead '443' and '5553' instead '553'.
When i enter 'http://127.0.0.1:4443/secure' shows the browser:
opensaml::saml2md::MetadataException at (http://10.0.20.128/secure)
Unable to locate metadata for identity provider (http://10.0.20.128/idp/shibboleth)
where is the error?
Part of shibboleth2.xml:
-----------------------------------
<RequestMapper type="Native">
<RequestMap>
<!--
The example requires a session for documents in /secure on the containing host with http and
https on the default ports. Note that the name and port in the <Host> elements MUST match
Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element above.
-->
<!-- <Host name="10.0.20.128:8080">
<Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>
--> <Host name="10.0.20.128:8080">
<Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>
<!--
<Host name="shibboleth.aforms2web.com">
<Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>
--> <!-- Example of a second vhost mapped to a different applicationId. -->
<!--
<Host name="admin.example.org" applicationId="admin" authType="shibboleth" requireSession="true"/>
-->
</RequestMap>
</RequestMapper>
<ApplicationDefaults entityID="https://shibboleth.aforms2web.com:5553/shibboleth"
REMOTE_USER="eppn persistent-id targeted-id">
.
.
.
<SSO entityID="http://10.0.20.128/idp/shibboleth"
discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
SAML2 SAML1
</SSO>
.
.
.
<MetadataProvider type="XML" file="C:/Program Files (x86)/Apache Software Foundation/Apache2.2/shibboleth-users/users"/>
<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<!-- Use a SAML query if no attributes are supplied during SSO. -->
<AttributeResolver type="Query" subjectMatch="true"/>
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
<!--
The default settings can be overridden by creating ApplicationOverride elements (see
the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic).
Resource requests are mapped by web server commands, or the RequestMapper, to an
applicationId setting.
Example of a second application (for a second vhost) that has a different entityID.
Resources on the vhost would map to an applicationId of "admin":
-->
<!--
<ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
-->
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<!-- Low-level configuration about protocols and bindings available for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
-------------------------------------------------------------------------------------------------------------------------------
part of relying-party.xml
<!-- ========================================== -->
<!-- Relying Party Configurations -->
<!-- ========================================== -->
<rp:AnonymousRelyingParty provider="https://10.0.20.128:4443/idp/shibboleth" defaultSigningCredentialRef="IdPCredential"/>
<rp:DefaultRelyingParty provider="https://10.0.20.128:4443/idp/shibboleth" defaultSigningCredentialRef="IdPCredential">
<!--
Each attribute in these profiles configuration is set to its default value,
that is, the values that would be in effect if those attributes were not present.
We list them here so that people are aware of them (since they seem reluctant to
read the documentation).
-->
<rp:ProfileConfiguration xsi:type="saml:ShibbolethSSOProfile" includeAttributeStatement="false"
assertionLifetime="PT5M" signResponses="conditional" signAssertions="never"
includeConditionsNotBefore="true"/>
<rp:ProfileConfiguration xsi:type="saml:SAML1AttributeQueryProfile" assertionLifetime="PT5M"
signResponses="conditional" signAssertions="never"
includeConditionsNotBefore="true"/>
<rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile" signResponses="conditional"
signAssertions="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" includeAttributeStatement="true"
assertionLifetime="PT5M" assertionProxyCount="0"
signResponses="never" signAssertions="always"
encryptAssertions="conditional" encryptNameIds="never"
includeConditionsNotBefore="true"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile" includeAttributeStatement="true"
assertionLifetime="PT5M" assertionProxyCount="0"
signResponses="never" signAssertions="always"
encryptAssertions="conditional" encryptNameIds="never"
includeConditionsNotBefore="true"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2AttributeQueryProfile"
assertionLifetime="PT5M" assertionProxyCount="0"
signResponses="conditional" signAssertions="never"
encryptAssertions="conditional" encryptNameIds="never"
includeConditionsNotBefore="true"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile"
signResponses="never" signAssertions="always"
encryptAssertions="conditional" encryptNameIds="never"/>
<rp:ProfileConfiguration xsi:type="saml:SAML2LogoutRequestProfile"
signResponses="conditional"/>
</rp:DefaultRelyingParty>
<!-- ========================================== -->
<!-- Metadata Configuration -->
<!-- ========================================== -->
<!-- MetadataProvider the combining other MetadataProviders -->
<metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider">
<!-- Load the IdP's own metadata. This is necessary for artifact support. -->
<metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FilesystemMetadataProvider"
metadataFile="c:/users/brummst/shibboleth/shibboleth-idp/metadata/idp-metadata.xml"
maxRefreshDelay="P1D" />
<!-- Example metadata provider. -->
<!-- Reads metadata from a URL and store a backup copy on the file system. -->
<!-- Validates the signature of the metadata and filters out all by SP entities in order to save memory -->
<!-- To use: fill in 'metadataURL' and 'backingFile' properties on MetadataResource element -->
<!--
<metadata:MetadataProvider id="URLMD" xsi:type="metadata:FileBackedHTTPMetadataProvider"
metadataURL="http://example.org/metadata.xml"
backingFile="c:\users\brummst\shibboleth\shibboleth-idp/metadata/some-metadata.xml">
<metadata:MetadataFilter xsi:type="metadata:ChainingFilter">
<metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil"
maxValidityInterval="P7D" />
<metadata:MetadataFilter xsi:type="metadata:SignatureValidation"
trustEngineRef="shibboleth.MetadataTrustEngine"
requireSignedMetadata="true" />
<metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList">
<metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>
</metadata:MetadataFilter>
</metadata:MetadataFilter>
</metadata:MetadataProvider>
-->
</metadata:MetadataProvider>
<!-- ========================================== -->
<!-- Security Configurations -->
<!-- ========================================== -->
<security:Credential id="IdPCredential" xsi:type="security:X509Filesystem">
<security:PrivateKey>c:\users\brummst\shibboleth\shibboleth-idp/credentials/idp.key</security:PrivateKey>
<security:Certificate>c:\users\brummst\shibboleth\shibboleth-idp/credentials/idp.crt</security:Certificate>
</security:Credential>
Steffen Brumm
Gishpuppy | To change the delivery settings for this email, click here:
http://www.gishpuppy.com/cgi-bin/edit.py?email=shibboleth.92j@gishpuppy.com
More information about the users
mailing list