Recreating IdP metadata after regenerating certificates?

Thu Apr 23 15:55:51 EDT 2015

I think I have a metadata problem, because testshib.org is kicking out errors after authentication. Looking at shibd.log, I see:

2015-04-23 15:25:00 INFO XMLTooling.StorageService : purged 2 expired record(s) from storage
2015-04-23 15:26:55 DEBUG Shibboleth.Listener [218]: dispatching message (default/TestShib::run::SAML2SI)
2015-04-23 15:26:55 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [218]: validating input
2015-04-23 15:26:55 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [218]: marshalling, deflating, base64-encoding the message
2015-04-23 15:26:55 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [218]: marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" Destination="https://idp-dev.niu.edu/idp/profile/SAML2/Redirect/SSO" ID="_e571d19034de056179dbc948bf178951" IssueInstant="2015-04-23T19:26:55Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sp.testshib.org/shibboleth-sp</saml:Issuer><samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest>
2015-04-23 15:26:55 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [218]: message encoded, sending redirect to client
2015-04-23 15:27:02 DEBUG Shibboleth.Listener [221]: dispatching message (default/SAML2/POST)
2015-04-23 15:27:02 DEBUG OpenSAML.MessageDecoder.SAML2POST [221]: validating input
2015-04-23 15:27:02 DEBUG OpenSAML.MessageDecoder.SAML2POST [221]: decoded SAML message:
<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://sp.testshib.org/Shibboleth.sso/SAML2/POST" ID="_17f128f2627bc5af341f51b67645676e" InResponseTo="_e571d19034de056179dbc948bf178951" IssueInstant="2015-04-23T19:27:02.306Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://idp-dev.niu.edu/idp/shibboleth</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status><saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="_bea0483d20b5576c45554c7f2f2ddb1a" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey Id="_fa35363693db56a24c00d9a3b88834f3" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/></xenc:EncryptionMethod><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIEPjCCAyagAwIBAgIBADANBgkqhkiG9w0BAQUFADB3MQswCQYDVQQGEwJVUzEVMBMGA1UECBMM
UGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMSIwIAYDVQQKExlUZXN0U2hpYiBTZXJ2
aWNlIFByb3ZpZGVyMRgwFgYDVQQDEw9zcC50ZXN0c2hpYi5vcmcwHhcNMDYwODMwMjEyNDM5WhcN
MTYwODI3MjEyNDM5WjB3MQswCQYDVQQGEwJVUzEVMBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYD
VQQHEwpQaXR0c2J1cmdoMSIwIAYDVQQKExlUZXN0U2hpYiBTZXJ2aWNlIFByb3ZpZGVyMRgwFgYD
VQQDEw9zcC50ZXN0c2hpYi5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJyR6Z
P6MXkQ9z6RRziT0AuCabDd3x1m7nLO9ZRPbr0v1LsU+nnC363jO8nGEqsqkgiZ/bSsO5lvjEt4eh
ff57ERio2Qk9cYw8XCgmYccVXKH9M+QVO1MQwErNobWbAjiVkuhWcwLWQwTDBowfKXI87SA7KR7s
FUymNx5z1aoRvk3GM++tiPY6u4shy8c7vpWbVfisfTfvef/y+galxjPUQYHmegu7vCbjYP3On0V7
/Ivzr+r2aPhp8egxt00QXpilNai12LBYV3Nv/lMsUzBeB7+CdXRVjZOHGuQ8mGqEbsj8MBXvcxIK
bcpeK5ZiJCVXPfarzuriM1G5y5QkKW+LAgMBAAGjgdQwgdEwHQYDVR0OBBYEFKB6wPDxwYrYStNj
U5P4b4AjBVQVMIGhBgNVHSMEgZkwgZaAFKB6wPDxwYrYStNjU5P4b4AjBVQVoXukeTB3MQswCQYD
VQQGEwJVUzEVMBMGA1UECBMMUGVubnN5bHZhbmlhMRMwEQYDVQQHEwpQaXR0c2J1cmdoMSIwIAYD
VQQKExlUZXN0U2hpYiBTZXJ2aWNlIFByb3ZpZGVyMRgwFgYDVQQDEw9zcC50ZXN0c2hpYi5vcmeC
AQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAc06Kgt7ZP6g2TIZgMbFxg6vKwvDL
0+2dzF11Onpl5sbtkPaNIcj24lQ4vajCrrGKdzHXo9m54BzrdRJ7xDYtw0dbu37l1IZVmiZr12eE
Iay/5YMU+aWP1z70h867ZQ7/7Y4HW345rdiS6EW663oH732wSYNt9kr7/0Uer3KD9CuPuOidBaco
spDaFyfsaJruE99Kd6Eu/w5KLAGG+m0iqENCziDGzVA47TngKz2vPVA+aokoOyoz3b53qeti77ij
atSEoKjxheBWpO+eoJeGq/e49Um3M2ogIX/JAlMaInh+vYSYngQB2sx9LGkR9KHaMKNIGCDehk93
Xla4pWJx1w==</ds:X509Certificate></ds:X509Data></ds:KeyInfo><xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue>KX6CkT+luSfiAuMmqjnQEr/hu4L8kvRQL507bqhndVqXqxbLN9E9iVyFj4GfGXtxJFBN106XztgwkS184qke7DA4vcS1asdLZtwj32Bcnw8CQ8Z8uN+eHNDcVfx4mmP0UJlRmaYXI9NPlJ+MSy3nKJ5MPxolZ5fIQkM85rmzSHg4DmU2huMDU63O0Qll7hgck4rbk/ViEJU06k3tpiJCIY+eXbG7ET9ngKzffBLF3gXqirO0jHQ4IQbJ6LkgJtDsZDQk04plFQaq0VfGUTy8qFt2oPQTsNU7XvHeki700WuViepRpMQNMwAENCvT4AlqV9g7vODsNva/O89qnfS/rg==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></ds:KeyInfo><xenc:CipherData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:CipherValue>xkx2/+3/GME0l96kAzojtNgwrJ406llZMVn04uF16Hpp+IKm8B4gEsAuIWHIwA6mj3ZA3kj4zEHK71eWLrLxE8uqbWDHyJVSnnLZW48UKelrgGRdgaui/zYykr07EVC5HgZdmxbVisadadkb+Z0PiDRxT7IBMrpsdrs6hq9PwZxkR3Xve6KoIhq6QdNOcCPeI8sWuYDsiDport8Oui4OgxyIVVUG0jtwXcjNb1eEUgFudstvgnIMr4SrEYpc3EnwF6eYMbVeqCfxFRESV4YdLiStbP9mZXTEHCOmE+/zmt+UBaan7eCcEUnVSTyK5uTgoqIBZ1MihcgYZ8mVp+INtCN/NnuLnzOJgL1W7cShS/ueEtwViWhXcmwxNtXGKRY1/SW4b0wVrQQFR94T9LFNCZdOztC0p7A39NInc8wMf50wvoA1/kAP5JdPEn3FoPrV7jx1hd2CFIFFE95sgyNO07PPdKmjXb5wG+75ojBtOwVBQ4wFMiCvxEVxVRhMmqYfsEvWMGqPVJtpVtCNC/zBCQVYGvd9D5qZvDsTXUt2BEtcTe+XaIBFMZgUyc/xpN/lXRhN0k+DZresqL707zSCZ8R1c6KUuMv5SohjxFgBXvoQ/fvu1ySphv1p7R4dDWpyWPuGcOFSoRXAgS72DkXjW5dmNZPBwC3T69YZhRyTsur9cXJGrQFzyEozrrf0IlQnqBNd7690vmqoz2GtSQF4mbZ7l311wVADDBbUdgXYwy+vsz2Lr7JrV1aC+Go4uo9ITCP1NyoZBIJUmeTvx43OkDoNpkAvvYt5YaTZV/9wnE/tgYuavusC+3urLVIJAXyC9cm9pY+PHu7KiWAcUjt/JoMWHiLPVEcclIM1YRzqrYDMvpWbBskONT2C0+w4vgQ5iDW9ePZTMjHNPZSJ6aDaC8u4v6f1k8anmeKoDLdVUYOq+lvCXAx2NnrfwHd36NBvnZC9Xv8ART5HyBXv+xRHcBw6fBt7OoV4oOzW6uVvu5l44z8btH6LNwgPDX9PyJBMX4aa3XlnCm0QA8YC2ZZBnPXuXQCqL2XVVHFzcTx1pVBmOTpMmpunT5UQH39otuNwRHXOiNL82DAipH1mwyGvx/i1Ko3v783dyoSoUUn+6py3nbmJ9uada/7RmAnGgf0NEE/thkW+DP7TT7kBkstVWaMZxqdUXqwLkf+nKEy8HH4PeHF5fO65JV+zylE1GHYT7+KfmbqDybFrRs79fMABq5+PT2n2SY33S9EpOtSjdRIrGXbJX0TQvreFzG5Wi/hLykjt5PAs0vY3Fh123hZzdvHQ2K5L4aM9+LsLEupnfkYzVs7lYt324CgXz7eYfLh6Sx57voToNrDV1QMUO2LSzqGKeJNm+HvhU7gn6QHXua1TDIV1tHXPW2tQNZj0Uogug55HmKU8a+5/zQQ0canDMHo3/FLmeJBmCxzowN1UFHgOO4HbuUrg6/n3Y1aneK3Sj+FE/M/lrtG1a4GG0wZiToc3cYe8BRBJrsUFlPjl/rldXkT6uVb9qWyRVgW0csO2hzV+u/HRDLRXPtSYojHegnB3yqclR61S44tLGsD3FSKTXEKzmDyhUkXf0zyV1HnKjOIMAgPe4yd0oM7KEZSxCWvKivc/Wjzy4ATRTzFXf3uSyWEZg17JYom5eXM+RoLPYnhxKVzbyU8+pe88PgJrcdAfYMZAuavIkD1q7CRLIjUAWXMq1E+wsZyLSUXSw9rD1e9gMKLg+/Rll/pfkc76LXi5jEcz21rgZseVIcil0x9JogWScwPTzoLGnkBtp3u2mDoSr3YlbV+fzqIN6CLp8T6osV7X0RMTPj6wErsaZxJOtrHWgBOmpCM90wgGMydqO5lPS//eq4vbEuXNFzmqQyIvBgAu13J5yCVp4FzY1AKQnZzwxcvGa32AJPx2n6Ml1ot/rxERu7xPPgQ/0UYaDRH112xoo78h5nGteFmPCQ8638Dnywr9DERWw4fOLYK+5tTzVlxhaNxd8/kixreVJ14nZCmfwcXVJPU8RQUdH9nI+NsOePFDlADAbTYNOhWCCYMizZ50hCvQbanCMCTV5buMY7BfGY5rBpXexP8FH8ssTfMYKcm7Rn4WF9T/YcXpbmljNBAFHhUov+QupMz0YK2YDtXMMI4CDF85wV6blcEQKhH2mUSI42KatzELiwkMVSVNhD0ZM/MlaM3RevRaKx5/zp8v7eyLbVHSVCI3ujlbEzoNCigt/UJ5DPjK0582Ha4mSxt3+ZfCTkeGNxlUb8Qu5EeqVRVNb21y0/7JCoZCXn8cnPzO+f2Aagi3IG8Qs11D6UGkfksGgMdi8Idssw5Y3GBSEi/B8p9x0kvl1sb1pch28VSg7/fvAcOr4pHoyNNTJkrVEg2I1JUPTZAAtAC50DJI1P1hRIJOjg/RHLzlWYnO4sRvF6ulMtCk1xUgI+UAK+edVQL/+HOMXqKDMsi6mde453s4A8uUe87os7Z7EAwQMgKYivnpGlgP6rz9z4fgw+4JZo6+D4ISAWmm0xhmNZtJrQwtEubbW8Z0pkEkeRJvr+6SenDV/QI1da2cl5s4TceJaMcpYv07ZIHewl960BUMg4PZTCxatxfqOFKh1XT2ZWbrs+tyoMEaUG5YyIVBrhnb02+vswob4p2WJzutZx71i81mT7wFY5WW+XUcB3ZClgZPVnfkd6a9QbUjbR272YYgVlK9c3YP1GALq4ioc0uBmIdEZfo2Q2mwqnAKwftPXjprb39Tk3sleAv2o9UPYzY5KyfYZzV6SWF9y9xX05kFU2LpVVnK5ZhsM3wGlTIKCcQ3X+niSNaCBohVN8RXz7mSot7afqkKHewHIVCIjQuCxR3m+Xth5cpeklvelSzoDFvEvH4mXDdoTu9/GofDuGgPwWyVt3ctkLNZE22iQugzl40YpdrBaMstlhdLL9zQIrhYCr9WGSEKRX4976mUsKzmb8fp81607rik7wmYnmrqVOe4sHRP9jKplGr8sbuz2ORkPFjiiu2azHjJQ0+61A2YE2HbcNgdvqhg+8NZ2oSGLJ3tz8An50K+j/HNgyU7C/F6GPfJiPYu7a1CeFzoE1lIfrnXiU5/LT6BhtnqPJ73O+w3/TjBwugtVHQMH8lMgX69jIL2oKse5y0SBZ3F23e3UODDPteYOsOx4QAmgELF/J0aZAIbqKaSzqvPZgDD7n+Np9UK7NrRz2nwQwf6SBIy83M34mi2srOIjFgrLZRHHooqCajI0n9obFlq72R1f+ZBm9JQ4SR4mrn8RekJ9PH84uMOTXyOJIBwDVrh8FQvnmp4j8/bHoL5QOarBWykaM1XdGX3SO2Y3RneS4jGnQ778TVgAqi8yjbwmIEg6qVV9GPQ8XwTIkR72Gvp025NTM1dIci7VHOrXnWp7IOsmWQRjHZRQ+5vSDhPvMRzaF0MRkQz6o+gZW7xfo4Kp4dPE6aPcA+JcYK+jfKstwX8rptvhVyep03lpYoCFnoEr2dwIM5mZWMLLao42URsLyqVDEIdAIVkXCEut/F15pYjPvQIR7g15J5p+eqdKHFLYFNzagDTDib4tPuwOpWWrGcVJDpLdZrnA3GPY76NsGcvy73sPNqeSN6/j92CqDorm/OwALTIPWhxT4Ti9nrXiUFoi7dBcC0g12AtgdHTdSwXT26vG4WnO1ev8JxGGqIRD0pBmfYXcpO4hx+KFPFHEualyFEl6kWo6GHYsUzOtD2hA5b6C6ibVN1OCAopXcENW147q/RAmKl4ps/zE62fkNx8vJ2mKvcgmoYX3Ck0tFmjDhj1FkvpvTn5+olgkdXZuAaAZH9Xl51dHC4U9KJpkZsajQJRtekPzELKtm0tVkrtEP6PqJNenwMD4eYpq8jtioxZOqXaNe1wBAYqzaGTt1DdL//PrbOnppQdDMvNEUbsCKQ6yh1fKgQoXgZz835q57uvpqT9/b2Nnf8MC8hsbqA1MiMYB/sIUfeY3yEAT8HndbUGQnwntv9vvjAalxacaHw3rGVMg4hJbULWs1283Y6bkqHtqQj2yDaRxq6xFLEbtgXatynDLdLiF7z2caHrS8hi5MN5t8th8yH7INsuyEKU4u0lwft0Oz7iVQGDyuiUIYRl2yZhMhVQXXyysx3b+ztSf7V50rqwbI4tVoD2WDnQHuGBQNuRk8ggKfMtZFH00jDjRYFmCpN6+sIPpcRtalnGTPluiuNM5PtNFuga0a7Fkt6Z55s5cvFhNr7WwuBk03k/dYqV+kqMWL42lxyFcwiKGxw2z6uKP+9iTWX6t2oV3ZalcEev3+1M4fljRZ3BxKLGqkDIboYhkkJ/zucymOhgmF9slh1jozNNnsCMoim9XPAcFSr78nLGdLw8W0FbwMtGGTeVCyzwQ8TNMzpFdM1FOQg+gHO9Whqz/QtECk3CqZ2UuFhgfwUfNE/M3zXnAsssAWoML2EfMLAJETt8582x+vGN0q8Zch5+iMfo63kdat786/IR7pXcrCs5Nyt6t+gteeLESPCxei56avWS4Wd51NC/hLDZJnVWOtZfUHhkNhqHjvF3r6xbhPt9vaJn92w7VHS5iLaCzC50fMdx3huhOUjsog7hee00DPl3qh97+OEkHVIX4G/3nbv57HN+OmfcvCipfLHfr9LTLSZhVongQS5BtofkcFwNTQ95nVdPhLOuJgrFSOr+gzM9zgWFfDm+xASQUawDlkLTSzmmRZSp9hHxbo8y3sEBvdHjdKgc9xLc8AxLPG84BEapsGjkAGdatZoBibz5Qz4guYoj8174+kYDobPVJixLQj0NxlhBTmYq4k5T+HR9e1tBjU1gmgdICBxIiMWp5V4zuoWOybrdWKGdkFuroWblE7udxknvSSsvLVrXRV7Rng7R0NHvOeNmvWbfAgQn35Wu6yHgpIXF90lDslRHFFTFdSxNlSPZwQc/rM2AH5FY7IibT5ZE4Vuo0tyB+2mIooV+NiLL1ps+d7UhfbEISIyMKy3kz0L95U5BI+q0626XVBihwj/PJy00o/ut7k7rYVkk3Un2NJAkygccH7n9MHdn13mxZKv7tWjN6NMMvTDejJjoDl37Q3QSP3yJvluh+UazrDbx4qz+lsftBxydFPc7KUKZLmrE19+SoHQvLDZQ8bcvLJ9Ohvlrh3d0C0yEcb5COe54efsC3mEOCqJefKaubtledNNKbYv6iJaCZm899aQu9+FBhecg1WKSYhoWaJt8w7pBGJgeeI14q8jOSi2xkJD/Ej05ENOAje1502Ei+WsJ+Umx3gy9zgtzPKuxvP7BRHia6q2Ms/VizmlqsRV6PEJNX6OXn5BsXnb7IuQFUpGu8v3B1G4JjttVPb+AGTGZgVxh0fYtg4rj+KgLKzLc7ZuiFOGxGKpuhMtWKAfC4KmxNNuECQ7uN2FI5q+yxIvYg4wd2nLrbH9b6mKVPbHoK98dUrdiVxXiKuH13+cBmHuQh5mVDWEym7nDKF4Y3RChHPXMktArnIDgWtz7rVRYqXjPRRc812UDofeiTzQ+9ZEVPenxx4Q7x+qQPsD0qAIYsUgUdIqAanYWJCd1QT7NcWVqpHtgbExm4phxjcNjPXRZqNlpFlMVdmsb9ytwdNZVuL7pjzYd6Pt5cKen8QwMl8qrRJkiADdhDb7nUprDfL2HHmPWVUm9QxOZ7kl6UDDd04MzPE8r41kTmqGbj4nUdSSoF8MmGUr5Wu7BPlPwDypwpSbtA6pPS97DCUEmyxKjTu1627F6wITGcKqA2U+4tH2NddbvSp1y6etGP7aZeMX2MZUV5H4k2EUL74yULFWXuuQp+N9gKZqaPImmn/yR0FW1xf3QBDSr5CY9fK3HABnzDcZlA05J75KgFnU5mvMkVw==</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData></saml2:EncryptedAssertion></saml2p:Response>
2015-04-23 15:27:02 DEBUG OpenSAML.MessageDecoder.SAML2 [221]: extracting issuer from SAML 2.0 protocol message
2015-04-23 15:27:02 DEBUG OpenSAML.MessageDecoder.SAML2 [221]: message from (https://idp-dev.niu.edu/idp/shibboleth)
2015-04-23 15:27:02 DEBUG OpenSAML.MessageDecoder.SAML2 [221]: searching metadata for message issuer...
2015-04-23 15:27:02 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [221]: evaluating message flow policy (replay checking on, expiration 60)
2015-04-23 15:27:02 DEBUG XMLTooling.StorageService [221]: inserted record (_17f128f2627bc5af341f51b67645676e) in context (MessageFlow) with expiration (1429817462)
2015-04-23 15:27:02 DEBUG Shibboleth.SSO.SAML2 [221]: processing message against SAML 2.0 SSO profile
2015-04-23 15:27:02 DEBUG XMLTooling.KeyInfoResolver.Inline [221]: resolved 0 certificate(s)
2015-04-23 15:27:02 DEBUG XMLTooling.CredentialCriteria [221]: key algorithm didn't match ('AES' != 'RSA')
2015-04-23 15:27:02 DEBUG XMLTooling.CredentialCriteria [221]: key algorithm didn't match ('AES' != 'RSA')
2015-04-23 15:27:02 DEBUG XMLTooling.CredentialCriteria [221]: key algorithm didn't match ('AES' != 'RSA')
2015-04-23 15:27:02 DEBUG XMLTooling.KeyInfoResolver.Inline [221]: resolving ds:X509Certificate
2015-04-23 15:27:02 DEBUG XMLTooling.KeyInfoResolver.Inline [221]: resolved 1 certificate(s)
2015-04-23 15:27:02 DEBUG XMLTooling.CredentialCriteria [221]: credential name(s) didn't overlap
2015-04-23 15:27:02 DEBUG XMLTooling.CredentialCriteria [221]: keys didn't match
2015-04-23 15:27:02 DEBUG Shibboleth.SSO.SAML2 [221]: decrypted Assertion: <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_055fd777d185376fb93ce19ba7a24cee" IssueInstant="2015-04-23T19:27:02.306Z" Version="2.0"><saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://idp-dev.niu.edu/idp/shibboleth</saml2:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><ds:Reference URI="#_055fd777d185376fb93ce19ba7a24cee"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>6WSDrkUKGnrfN0RK9J4iB6xdJAY=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>A58PzPdtKIdHB4rhjwxO2hYxun8IBt/7IQDjXakl9h0c5kXBOOZSA9qulm8c67OT1g7ttMMb6b6zwyMr8UhlSa6Fan7/8H4+GgWYSFU2ZL/W+d96lIsZuHAm7Ay0nEYofB5nfaHjV527QpnfkSg7YiOfufAN+w+1e6mTI2xKUgLliXVY2QcThszdU8LZgHs6ZrStZFdUHE9+DZI8AUqiUU+84lQb+5Uqi+zfwiGYPRun+A83Ee4p0SHWm1DE8rE9wS18NW4TQWlHoUCsHsbeh6j5YE2ZRhPVy2U26UA9V/asmQxYbgeZJnrWJsgr4Wf+3DcGIKlKCS4MU0+BzQUS3g==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDKDCCAhCgAwIBAgIVAOAL4oOtl14FShg3idgI/piiS6+jMA0GCSqGSIb3DQEBBQUAMBoxGDAW
BgNVBAMTD2lkcC1kZXYubml1LmVkdTAeFw0xNTA0MjExNjAwMjRaFw0zNTA0MjExNjAwMjRaMBox
GDAWBgNVBAMTD2lkcC1kZXYubml1LmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AONflHIiAU0xtKKOWobev8pcJCJhrEP+FGi40wxtKe2wtrnT3vQjMVxcVJzXx7Jbz0oeVo40it1P
sUdHnq1rTBb+xpws1a2EQNbAWdFR/6S8teWiiN0HEtKmx+HyC3bZxr7Tg4I0l3kwHAJ1Lyy8bJbi
OpsMGWOJly8bHdU+hslIJLfAy+awCBB85wZBTNXOdJ6xK7ZL7WGDpv7eUkHKGjYZ/yElh/rwGBGV
6sTtkfRSFlKxWFg54rVMZ8bx+UHKQ3DA59HKKFKqFn4/mQ55VO9NE/DVAptoFCPl7ZrjDpVPVh6i
zsMvp1BiGiBP/mjq+GKDNrjMU+oEiEPzaxQP4QMCAwEAAaNlMGMwQgYDVR0RBDswOYIPaWRwLWRl
di5uaXUuZWR1hiZodHRwczovL2lkcC1kZXYubml1LmVkdS9pZHAvc2hpYmJvbGV0aDAdBgNVHQ4E
FgQUrAkgSaEtMFRLTJGQzx9aV9TlWiowDQYJKoZIhvcNAQEFBQADggEBAI2bFvFcFPSzxW3Okr7A
52wpAgkNP1komKY+H0E4G00QEyEEe51AS8ify0zKJ42Du+0oB7W1hgggoHxiWgAAiKUt3xZpvYNi
XXpaxPtTkq0omRr7J0khA0m9FfTxteXYzjBWRHBufe3esxWojGZRP+feF08T56VbSFsLHJySsHG3
javGyP02l8TpG3j0nf0+h6tRccsD50X6YKGLlDKlreKsIWOIthRoZqOVNFEEzitWBnJdtkQigaX1
ob9oNb+yO5XW0nqwnwXcUJPaUTBoEHTjU+tEceUsmzC/Nhc/rdj45NL+Ssm2OvUy/2EvDeHGvMER
wZ7NWfbTM5XxtN2f920=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idp-dev.niu.edu/idp/shibboleth" SPNameQualifier="https://sp.testshib.org/shibboleth-sp">_e900b212dfba0f62784f87500f4dc99b</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="10.159.88.45" InResponseTo="_e571d19034de056179dbc948bf178951" NotOnOrAfter="2015-04-23T19:32:02.306Z" Recipient="https://sp.testshib.org/Shibboleth.sso/SAML2/POST"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2015-04-23T19:27:02.306Z" NotOnOrAfter="2015-04-23T19:32:02.306Z"><saml2:AudienceRestriction><saml2:Audience>https://sp.testshib.org/shibboleth-sp</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement AuthnInstant="2015-04-23T19:27:02.134Z" SessionIndex="520d57a389b84f84a79833c65160630e3fa28c465860fa8bbe8993599fc67934"><saml2:SubjectLocality Address="10.159.88.45"/><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><saml2:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://idp-dev.niu.edu/idp/shibboleth" SPNameQualifier="https://sp.testshib.org/shibboleth-sp">b1NmQgDCcmij8DHRY3OOGeBXw1I=</saml2:NameID></saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion>
2015-04-23 15:27:02 DEBUG Shibboleth.SSO.SAML2 [221]: extracting issuer from SAML 2.0 assertion
2015-04-23 15:27:02 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [221]: evaluating message flow policy (replay checking on, expiration 60)
2015-04-23 15:27:02 DEBUG XMLTooling.StorageService [221]: inserted record (_055fd777d185376fb93ce19ba7a24cee) in context (MessageFlow) with expiration (1429817462)
2015-04-23 15:27:02 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [221]: validating signature profile
2015-04-23 15:27:02 DEBUG XMLTooling.KeyInfoResolver.Inline [221]: resolving ds:X509Certificate
2015-04-23 15:27:02 DEBUG XMLTooling.KeyInfoResolver.Inline [221]: resolved 1 certificate(s)
2015-04-23 15:27:02 DEBUG XMLTooling.KeyInfoResolver.Inline [221]: resolved 0 CRL(s)
2015-04-23 15:27:02 DEBUG XMLTooling.TrustEngine.ExplicitKey [221]: attempting to validate signature with the peer's credentials
2015-04-23 15:27:02 DEBUG XMLTooling.TrustEngine.ExplicitKey [221]: signature validated with credential
2015-04-23 15:27:02 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [221]: signature verified against message issuer
2015-04-23 15:27:02 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation [221]: assertion satisfied bearer confirmation requirements
2015-04-23 15:27:02 DEBUG Shibboleth.SSO.SAML2 [221]: SSO profile processing completed successfully
2015-04-23 15:27:02 WARN Shibboleth.SSO.SAML2 [221]: no AttributeExtractor plugin installed, check log during startup
2015-04-23 15:27:02 DEBUG Shibboleth.SSO.SAML2 [221]: resolving attributes...
2015-04-23 15:27:02 DEBUG Shibboleth.AttributeResolver.Query [221]: found AttributeStatement in input to new session, skipping query
2015-04-23 15:27:02 DEBUG Shibboleth.SessionCache [221]: creating new session
2015-04-23 15:27:02 DEBUG Shibboleth.SessionCache [221]: storing new session...
2015-04-23 15:27:02 DEBUG XMLTooling.StorageService [221]: inserted record (session) in context (_f30b30c558664633f29f200344775f1a) with expiration (1429820822)
2015-04-23 15:27:02 DEBUG XMLTooling.StorageService [221]: inserted record (_e900b212dfba0f62784f87500f4dc99b) in context (NameID) with expiration (1429846022)
2015-04-23 15:27:02 DEBUG XMLTooling.StorageService [221]: inserted record (_055fd777d185376fb93ce19ba7a24cee) in context (_f30b30c558664633f29f200344775f1a) with expiration (1429820822)
2015-04-23 15:27:02 INFO Shibboleth.SessionCache [221]: new session created: ID (_f30b30c558664633f29f200344775f1a) IdP (https://idp-dev.niu.edu/idp/shibboleth) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (131.156.157.224)
2015-04-23 15:27:02 DEBUG Shibboleth.SSO.SAML2 [221]: ACS returning via redirect to: https://sp.testshib.org/testing/sample.jsp
2015-04-23 15:27:02 DEBUG Shibboleth.Listener [218]: dispatching message (default::getHeaders::Application)
2015-04-23 15:27:02 DEBUG Shibboleth.Listener [218]: dispatching message (find::StorageService::SessionCache)
2015-04-23 15:27:02 DEBUG XMLTooling.StorageService [218]: updated expiration of valid records in context (_f30b30c558664633f29f200344775f1a) to (1429820822)

I think I know what I did wrong. I'm having trouble getting out of it. The other day, I wanted to make some simple changes to login.css and login.jsp. I did that, then ran install.sh. I erroneously picked the "overwrite" option. Oops. So it looks like the certs in /opt/shibboleth-idp/credentials get replaced when you do this. Oops. But the metadata in /opt/shibboleth-idp/metadata/idp-metadata.xml does not get replaced or regenerated. Fortunately, this is a development IdP, so no actual users are affected. Unfortunately, it's a development IdP, so there's no backups to restore from.

Some searching found (https://lists.internet2.edu/sympa/arc/shibboleth-users/2008-02/msg00471.html) and (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall).

Ok, I understand that idp-metadata.xml isn't automatically maintained, so if I need to replace /opt/shibboleth-idp/metadata/idp-metadata.xml with new and correct metadata, how exactly do I do that?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150423/c3f7cfaa/attachment-0001.html>