Recreating IdP metadata after regenerating certificates?

[David Gersic]

I was assuming that testshib's SP was working. If the error is on the other end, that'd be good for me, 'cause then it's not my problem. I have uploaded this IdP's idp-metadata.xml to testshib.org, so it should be correct there.


________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, April 23, 2015 3:31 PM
To: Shib Users
Subject: Re: Recreating IdP metadata after regenerating certificates?

On 4/23/15, 7:55 PM, "David Gersic" <dgersic at niu.edu> wrote:


>
>I think I have a metadata problem, because testshib.org is kicking out
>errors after authentication. Looking at shibd.log, I see:

All I see there is success, except that the SP is broken apparently and
didn't get its plugins loaded so it can run properly. From the IdP
perspective, it worked fine.

I don't know what state testshib is in, but somebody will have to go kick
it I guess, it seems to be broken.

>I think I know what I did wrong. I'm having trouble getting out of it.
>The other day, I wanted to make some simple changes to login.css and
>login.jsp. I did that, then ran install.sh. I erroneously picked the
>"overwrite" option. Oops. So it looks like the
> certs in /opt/shibboleth-idp/credentials get replaced when you do this.
>Oops. But the metadata in /opt/shibboleth-idp/metadata/idp-metadata.xml
>does not get replaced or regenerated.

That isn't the problem here, the signature appears to have checked out
fine. My guess is the overwrite step may not actually regen the keys
because it's pretty paranoid about doing that. I don't think it will ever
overwrite those files using the ant task the installer runs. Could be
wrong, but that's my guess.

>Ok, I understand that idp-metadata.xml isn't automatically maintained, so
>if I need to replace /opt/shibboleth-idp/metadata/idp-metadata.xml with
>new and correct metadata, how exactly do I do that?

The metadata file you have locally has nothing to do with much of anything
really, unless that's the exact file you're sharing with somebody or
something else. In testshib's case, you have to upload your metadata to it.

Your metadata in general is entirely your responsibility to maintain in
whatever places you're making it available, and that's a matter of editing
XML. That's how you do it. I'm not sure if there's a deeper question that
I'm missing, but that's exactly how, you edit it.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net