Recreating IdP metadata after regenerating certificates?

[Cantor, Scott]

On 4/23/15, 7:55 PM, "David Gersic" <dgersic at niu.edu> wrote:


>
>I think I have a metadata problem, because testshib.org is kicking out 
>errors after authentication. Looking at shibd.log, I see:

All I see there is success, except that the SP is broken apparently and 
didn't get its plugins loaded so it can run properly. From the IdP 
perspective, it worked fine.

I don't know what state testshib is in, but somebody will have to go kick 
it I guess, it seems to be broken.

>I think I know what I did wrong. I'm having trouble getting out of it. 
>The other day, I wanted to make some simple changes to login.css and 
>login.jsp. I did that, then ran install.sh. I erroneously picked the 
>"overwrite" option. Oops. So it looks like the
> certs in /opt/shibboleth-idp/credentials get replaced when you do this. 
>Oops. But the metadata in /opt/shibboleth-idp/metadata/idp-metadata.xml 
>does not get replaced or regenerated. 

That isn't the problem here, the signature appears to have checked out 
fine. My guess is the overwrite step may not actually regen the keys 
because it's pretty paranoid about doing that. I don't think it will ever 
overwrite those files using the ant task the installer runs. Could be 
wrong, but that's my guess.

>Ok, I understand that idp-metadata.xml isn't automatically maintained, so 
>if I need to replace /opt/shibboleth-idp/metadata/idp-metadata.xml with 
>new and correct metadata, how exactly do I do that?

The metadata file you have locally has nothing to do with much of anything 
really, unless that's the exact file you're sharing with somebody or 
something else. In testshib's case, you have to upload your metadata to it.

Your metadata in general is entirely your responsibility to maintain in 
whatever places you're making it available, and that's a matter of editing 
XML. That's how you do it. I'm not sure if there's a deeper question that 
I'm missing, but that's exactly how, you edit it.

-- Scott