'relying party' error

[Cantor, Scott]

On 8/26/14, 2:13 PM, "David Bantz" <dabantz at alaska.edu> wrote:
>
>I¹m integrating my IdP with a vendor¹s Shibboleth SP.  I¹m puzzled by the
>error he reports is triggered after receiving my IdP¹s SAML:

You're just confused because he's wrong. That's your IdP throwing the
usual "I have no metadata for the SP" error. He's not receiving anything
from you by that point.

>1) The entity in the Error Message is the vendor¹s entityID as per the
>metadata provided me.
>What would trigger the SP to request relying party configuration for
>itself?

Nothing, because that isn't the issue.

>2) the entityID of my IdP is  urn:mace:incommon:alaska.edu but apart from
>the amusing typo,
>why would Apache on the service side need my IdP¹s entityID?

To avoid discovery, you give it the IdP to use.

>3) The first attempt of the vendor to provide their SP metadata at
>http://vendor-server/Shibboleth.sso/Metadata
>mysteriously had the entityID of my IdP.    That particular problem has
>been corrected by the vendor at my insistence, but I wonder if there
>could be some systematic confusion of IdP and SP on their part.

At some point clearly, but that's not the cause here unless the metadata
you loaded still has the broken entityID in it. In any case, what you have
doesn't match the entityID he's using.

-- Scott