Centralized Discovery Service - "The Discovery Service should not be called directly"
Christian Munive
christian.munive at gmail.com
Wed Jul 23 13:22:15 EDT 2014
Hi everyone. I'm new to the user list. I'm trying to set up a federation in
my country; I've succesfully installed a test IdP and a test SP (with
embedded DS)... but I'm having problems setting up a centralized discovery
service.
My IdP and my SP work fine with each other, either directly or with the
embedded DS.
I've set up the CDS on a Ubuntu 14.04 virtual server. The installation
procedure was very similar to the the IdP. I set a federation XML available
there, with only my IdP's and SP's. Here it is (trimmed for space reasons,
I can post it complete to a PasteBin-like site if necessary):
<EntitiesDescriptor Name="
https://cdsserver.inca.net.pe/metadata/inca-federation.xml"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<!-- Actual providers go here. -->
<!-- Start: idpserver.entidad.edu.pe -->
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="https://idpserver.entidad.edu.pe/idp/shibboleth"
[TRIMMED]
</EntityDescriptor>
<!-- End: idpserver.entidad.edu.pe -->
<!-- Start: idp.instituto.edu.pe -->
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="https://idp.instituto.edu.pe/idp/shibboleth"
[TRIMMED]
</EntityDescriptor>
<!-- End: idp.instituto.edu.pe -->
<!-- Start: spserver.redprivada.com.pe -->
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_2f88be8f2520ab67291aa6e18c80c1e3c015bcdf"
entityID="https://spserver.redprivada.com.pe/shibboleth">
[TRIMMED]
</md:EntityDescriptor>
<!-- End: spserver.redprivada.com.pe -->
</EntitiesDescriptor>
Here's the content of the wayfconfig.xml file:
<?xml version="1.0" encoding="UTF-8"?>
<WayfConfig xmlns="urn:mace:shibboleth:wayf:config:1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<Default jspFile="wayf.jsp"
errorJspFile="wayferror.jsp"
provideList="true"
provideListOfList="false"
warnOnBadBinding="false"
warnOnNoSAML2="false"
showUnusableIdPs="false">
<SearchIgnore>
<IgnoreText>Institution</IgnoreText>
<IgnoreText>University</IgnoreText>
<IgnoreText>State </IgnoreText>
<IgnoreText>School</IgnoreText>
</SearchIgnore>
</Default>
<MetadataProvider
displayName="IDP Classic"
identifier="https://idpserver.entidad.edu.pe"
backingFile="/opt/shibboleth-ds/metadata/idpserver.entidad.edu.pe-metadata.xml"
url="https://idpserver.entidad.edu.pe/idp/profile/Metadata/SAML"/>
<MetadataProvider
displayName="SP Classic"
identifier="https://spserver.redprivada.com.pe"
url="file:/opt/shibboleth-ds/metadata/spserver.redprivada.com.pe-metadata.xml"/>
<Plugin identifier="CookiePlugin"
type="edu.internet2.middleware.shibboleth.wayf.plugins.provider.SamlCookiePlugin"
alwaysFollow="FALSE"
deleteCookie="FALSE"
cacheExpiration="604800"/>
<Plugin identifier="DeleteCookiePlugin"
type="edu.internet2.middleware.shibboleth.wayf.plugins.provider.SamlCookiePlugin"
alwaysFollow="FALSE"
deleteCookie="TRUE"
cacheExpiration="604800"/>
<DiscoveryServiceHandler location=".+/WAYF" default="true">
<PluginInstance identifier="CookiePlugin"/>
</DiscoveryServiceHandler>
<DiscoveryServiceHandler location=".+/ClearCache.wayf">
<PluginInstance identifier="DeleteCookiePlugin"/>
</DiscoveryServiceHandler>
</WayfConfig>
Now, on the side of the SP, this is the content of the shibboleth2.xml file:
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<ApplicationDefaults entityID="
https://spserver.redprivada.com.pe/shibboleth"
homeURL="
https://spserver.redprivada.com.pe/Shibboleth.sso/Session"
REMOTE_USER="eppn persistent-id targeted-id"
signing="back"
requireTransportAuth="false">
<Sessions lifetime="28800"
timeout="3600"
relayState="ss:mem"
checkAddress="true"
handlerSSL="true"
cookieProps="https">
<SSO discoveryProtocol="SAMLDS"
discoveryURL="
https://cdsserver.inca.net.pe/cds/index.htm">
SAML2 SAML1
</SSO>
<Logout>SAML2 Local</Logout>
<Handler type="MetadataGenerator"
Location="/Metadata"
signing="false"/>
<Handler type="Status"
Location="/Status"
acl="127.0.0.1 ::1"/>
<Handler type="Session"
Location="/Session"
showAttributeValues="false"/>
<Handler type="DiscoveryFeed"
Location="/DiscoFeed"/>
</Sessions>
<Errors supportContact="root at localhost"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML"
validate="true"
uri="
https://cdsserver.inca.net.pe/metadata/inca-federation.xml"
backingFilePath="/etc/shibboleth/metadata/inca-federation.xml"
reloadInterval="3600">
<MetadataFilter type="RequireValidUntil"
maxValidityInterval="604800"/>
<MetadataFilter type="Signature"
certificate="/etc/shibboleth/certificate-data/inca.crt"/>
</MetadataProvider>
<AttributeExtractor type="XML"
validate="true"
reloadChanges="false"
path="attribute-map.xml"/>
<AttributeResolver type="Query"
subjectMatch="true"/>
<AttributeFilter type="XML"
validate="true"
path="attribute-policy.xml"/>
<CredentialResolver type="File"
key="sp-key.pem"
certificate="sp-cert.pem"/>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML"
validate="true"
path="security-policy.xml"/>
<ProtocolProvider type="XML"
validate="true"
reloadChanges="false"
path="protocols.xml"/>
</SPConfig>
When I try to access a Shibboleth-protected resource on my SP, a page from
the CDS server comes up saying:
Inter-institutional Access System Failure
The inter-institutional access system experienced a technical failure.
Please email administrator's name and include the following error message:
The Discovery Service should not be called directly
All my logs are set to "DEBUG", but I can't find anything on them pointing
me to an error, neither from the SP side, nor the CDS side. I'm sure I'm
doing something wrong, overlooking something... please, help me. Thanks in
advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140723/ac869a5d/attachment-0001.html
More information about the users
mailing list