Unable To Resolve "SPSSODescriptor role metadata for entityID XXX could not be resolved"

[Kanuch, Andrew]

It's not the literal string.  The full entityID is: "https://www.okta.com/saml2/service-provider/spi3cj4veynwC2CBD0h7"

It is also in my relying-party.xml 's metadata configuration as a file backed meta data provider:

<metadata:MetadataProvider id="OktaDev" xsi:type="metadata:FilesystemMetadataProvider" 
	metadataFile="C:\Program Files (x86)\Internet2\Shib2Idp/metadata/OktaDev.xml" 
                          />

(And the file is in that corresponding directory, of course.)

So I'm not sure why it's not loading? (Unless you're suggesting it is loading the wrong metadata?)

Or am I misunderstanding this as a FileSystem back typed of Metadata when it should be some sort of HTTP Metadata type? The URL does not appear to point towards a valid location.


I've reverted the changes in the relying party elemental as well.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, February 25, 2015 5:02 PM
To: Shib Users
Subject: Re: Unable To Resolve "SPSSODescriptor role metadata for entityID XXX could not be resolved"

On 2/25/15, 8:58 PM, "Kanuch, Andrew" <Andy.Kanuch at sdstate.edu> wrote:



>14:06:08.157 - WARN
>[org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - 
>SPSSODescriptor role metadata for entityID 'https://www.okta.com/URL'
>could not be resolved

I assume it's not literally that string.

In any case, you do not in fact have metadata for that SP loaded.

>I’ve checked their metadata to confirm the requirements of their 
>SPSSODescriptor and it shows:

Whatever you're checking, it's not in fact loaded.

> 
> 
>I’ve created a RelyingParty for it, and set the profile configuration 
>signResponses=Never, and signAssertions=Never (The two I assume 
>correspond with the first to items in the SPSSODescriptor.)

They don't correspond at all, but that isn't the problem. But setting both to never would make it impossible for any unbroken SP to consume the result and you need to undo that change.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net