Shibboleth newbie question [GishPuppy]

[Peter Schober]

* shibboleth.92j at gishpuppy.com <shibboleth.92j at gishpuppy.com> [2013-10-02 11:06]:
> i have a non-productive shibboleth-environment. as tutorial i used
> https://wiki.library.ucsf.edu/display/~234877@ucsf.edu/Running+Shibboleth+IDP+and+SP+Locally+in+Windows. 

You'll have to ask the authors of the documentation to provide
support. The official documentation is linked from http://shibboleth.net
>From the omissions in your configuration (or the ones from the above
guide, which I can't be bothered to proof read) I suggest reading up
on several things, starting at
https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration

-> IdP: Communicate with a New Service Provider 
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSPCommunicate

-> SP: Talk to a New Identity Provider
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddIdP

> When i enter 'http://127.0.0.1:4443/secure' shows the browser: 
> 
> opensaml::saml2md::MetadataException at (http://10.0.20.128/secure) 
> 
> Unable to locate metadata for identity provider (http://10.0.20.128/idp/shibboleth) 
> 
> where is the error? 

It means what it says, the SP does not have metadata for the IdP with
with it tried to establish a session when you accessed that resource.
Likewise the IdP needs metadata about the SP (an error you have not
yet encounterd because of the error at the SP).

>         <RequestMap> 
>             <Host name="10.0.20.128:8080"> 
>                 <Path name="secure" authType="shibboleth" requireSession="true"/> 
>             </Host> 
>         </RequestMap> 

1. Use native (Apache httpd) directives with httpd
2. None of this makes much sense for a server listening on port 4443,
   I think.

Start here:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarted

>         <ApplicationDefaults entityID="https://shibboleth.aforms2web.com:5553/shibboleth" 
>                          REMOTE_USER="eppn persistent-id targeted-id"> 

aforms2web get's SAML support via Shibboleth?
The Spring SAML extension stuff did suck quite a bit. ;)

> <SSO entityID="http://10.0.20.128/idp/shibboleth" 
>                  discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF"> 
>               SAML2 SAML1 
>             </SSO> 

This is where you name the default IdP (the one from the error message).

> <MetadataProvider type="XML" file="C:/Program Files (x86)/Apache Software Foundation/Apache2.2/shibboleth-users/users"/> 

This is where you should have loaded SAML metadata about the IdP. It's
not obvious to me that this file system path is referncing an XML
*file* containing SAML metadata.

If that is a folder (not a file) containing SAML metadata files use
"path" instead of "file". "file" is a single file.
The documentation is here
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider#NativeSPMetadataProvider-FolderMetadataProviderVersion25andAbove
but from the "guide" you're using you installed an older version (SP
2.4.x) that does not yet have support for loading XML files from a
directory. So use "file" with an actual file.

>     <rp:AnonymousRelyingParty provider="https://10.0.20.128:4443/idp/shibboleth" defaultSigningCredentialRef="IdPCredential"/> 
>     
>     <rp:DefaultRelyingParty provider="https://10.0.20.128:4443/idp/shibboleth" defaultSigningCredentialRef="IdPCredential"> 

In the SP config you referenced an IdP whose name is
"http://10.0.20.128/idp/shibboleth".
In the IdP's relying-party.xml you call your IdP
"https://10.0.20.128:4443/idp/shibboleth"
As names go, these are not the same. So what is the name of your IdP?
Leave out the port in the latter and change it everywhere.

>     <!-- MetadataProvider the combining other MetadataProviders --> 
>     <metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider"> 
>     
>             <!-- Load the IdP's own metadata.  This is necessary for artifact support. --> 
>         <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:FilesystemMetadataProvider" 
>                                    metadataFile="c:/users/brummst/shibboleth/shibboleth-idp/metadata/idp-metadata.xml" 
>                                    maxRefreshDelay="P1D" /> 
>         
>         <!-- Example metadata provider. --> 
>         <!-- Reads metadata from a URL and store a backup copy on the file system. --> 
>         <!-- Validates the signature of the metadata and filters out all by SP entities in order to save memory --> 
>         <!-- To use: fill in 'metadataURL' and 'backingFile' properties on MetadataResource element --> 
>         <!-- 
>         <metadata:MetadataProvider id="URLMD" xsi:type="metadata:FileBackedHTTPMetadataProvider" 
>                           metadataURL="http://example.org/metadata.xml" 
>                           backingFile="c:\users\brummst\shibboleth\shibboleth-idp/metadata/some-metadata.xml"> 
>             <metadata:MetadataFilter xsi:type="metadata:ChainingFilter"> 
>                 <metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil" 
>                                 maxValidityInterval="P7D" /> 
>                 <metadata:MetadataFilter xsi:type="metadata:SignatureValidation" 
>                                 trustEngineRef="shibboleth.MetadataTrustEngine" 
>                                 requireSignedMetadata="true" /> 
>                     <metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList"> 
>                     <metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole> 
>                 </metadata:MetadataFilter> 
>             </metadata:MetadataFilter> 
>         </metadata:MetadataProvider> 
>         --> 
>         
>     </metadata:MetadataProvider> 

You're not loading SAML metadata for the SP anywhere. Once you make
the SP load metadata for the IDP and fix the IdP's name this is the
next error you'll get. Fix it by following the documentation links I
sent at the very top.
-peter