Trouble debugging discovery issue

[Ken Weiss]

Hi,

I am trying to get the InCommon Discovery Service working. If I use a
separate EntityDescriptor in the InCommon metadata for each of my hosts it
works fine. However, since many of my hosts use the same policies, I
thought it made more sense to consolidate them into  a single
EntityDescriptor with multiple DiscoveryResponse and
AssertionConsumerService elements. So, for example, I have three
DiscoveryResponse elements:

<DiscoveryResponse 
xmlns="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Location="https://dmp-dev.cdlib.org/Shibboleth.sso/Login" index="1"/>
      <DiscoveryResponse
xmlns="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/Login" index="2"/>
      <DiscoveryResponse
xmlns="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Location="https://dmp2-development.cdlib.org/Shibboleth.sso/Login"
index="3"/>

My expectation was that if I started a session on
https://dmp2-dev.cdlib.org and got sent to the InCommon Discovery Service,
the second DiscoveryResponse element would ensure that I was returned to
the SP on https://dmp2-dev.cdlib.org. But this isn't happening. Instead
I'm getting the old 'Error: Invalid Query' response. Here is the URL that
I see on the InCommon site:


https://wayf.incommonfederation.org/DS/WAYF?entityID=https%3A%2F%2Fdmp-dev.
cdlib.org&return=https%3A%2F%2Fdmp2-dev.cdlib.org%2FShibboleth.sso%2FLogin%
3FSAMLDS%3D1%26target%3Dss%253Amem%253A471fca3e9cbe8283a9b16d8ea3c5af090c13
dc2f3907b6a62570641c08fbcff7


The embedded URL contains the correct entityID: https://dmp-dev.cdlib.org

It also contains the correct URL for the return:
https://dmp2-dev.cdlib.org.

So why isn't it working?

My metadata is here:
https://github.com/cckweiss/security_tools/blob/master/PublishedDMP-DEVMeta
data.xml

My shibboleth2.xml file is here:
https://github.com/cckweiss/security_tools/blob/master/shibboleth2.xml-inpr
ogress

Any ideas?

--Ken

------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612