Help needed: Testing Shibboleth SP and IdP integration on Windows platform and having issues.

[Aytha, Satish (US - Hyderabad)]

Thank you Scott.

I was under the impression the url also needs to include the port as I am not using the default 443 port.  I am able to move forward with this issue however I started getting following error now. Authentication is successful at IdP/LDAP, however now its failing at SP.

URL: https://ushydsaytha1.us.deloitte.com:553/Shibboleth.sso/SAML2/POST

opensaml::FatalProfileException

The system encountered an error at Fri Jan 23 02:13:22 2015

To report this problem, please contact the site administrator at saytha at deloitte.com.

Please include the following message in any email:

opensaml::FatalProfileException at (https://ushydsaytha1.us.deloitte.com:553/Shibboleth.sso/SAML2/POST)

Unable to establish security of incoming assertion.

Here is the shibd.log

2015-01-23 02:13:22 WARN OpenSAML.MessageDecoder.SAML2 [1]: no metadata found, can't establish identity of issuer (https://ushydsaytha1.us.deloitte.com:6443/idp/shibboleth)
2015-01-23 02:13:22 WARN Shibboleth.SSO.SAML2 [1]: no metadata found, can't establish identity of issuer (https://ushydsaytha1.us.deloitte.com:6443/idp/shibboleth)
2015-01-23 02:13:22 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: Unable to establish security of incoming assertion.
2015-01-23 02:23:53 INFO XMLTooling.StorageService : purged 2 expired record(s) from storage

Shibd_warn.log

2015-01-23 02:13:22 WARN OpenSAML.MessageDecoder.SAML2 [1]: no metadata found, can't establish identity of issuer (https://ushydsaytha1.us.deloitte.com:6443/idp/shibboleth)
2015-01-23 02:13:22 WARN Shibboleth.SSO.SAML2 [1]: no metadata found, can't establish identity of issuer (https://ushydsaytha1.us.deloitte.com:6443/idp/shibboleth)
2015-01-23 02:13:22 WARN Shibboleth.SSO.SAML2 [1]: detected a problem with assertion: Unable to establish security of incoming assertion.

Here is the excerpt from the CommonErrors Wiki

Unable to establish security of incoming assertion

 This error will be presented in the browser for a variety of different underlying reasons.  Check shibd.log for more useful debugging information.

 I appreciate your help.


Satish K. Aytha  SCEA, PMP
Deloitte Consulting India Pvt Ltd.,
US Direct: +1 615 718 6874| India Desk: +91 40 6670 6874| Mobile: +91 800 818 6555
www.deloitte.com





This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.

v.E.1


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, January 22, 2015 9:21 PM
To: Shib Users
Subject: Re: Help needed: Testing Shibboleth SP and IdP integration on Windows platform and having issues.

On 1/22/15, 3:48 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:


>>Unable to locate metadata for identity provider
>>(https://ushydsytha1.us.deloitte.com:6443/idp/shibboleth)
>
>You should never include ports in an entityID. Beyond that, the error is
>exactly what's documented, you failed to supply metadata to the SP for
>that IdP name. That's it.

Of course, if you think you supplied the metadata, you should check logs
and check the entityID(s) against the metadata and configuration and
compare to make sure there's no typo or stray character or whatever.

And under no circumstances ever point the software at each other's
metadata source link, those are not designed for that purpose. Obtain the
metadata, check it, and deliver it out of band or via a separate hosted
location after signing it.

-- Scott

>
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net