IdPv3 jetty9 back-channel setup help needed

[Francesco Malvezzi]

Il 21/01/15 15:49, Cantor, Scott ha scritto:
>> So client receives a fairly generic error:
> 
> All errors are generic, that's a configuration setting. Unrelated,
> just noting it.
> 
>> jetty-base is the jetty-base dir in the idp unzipped source.
> 
> That isn't how you want to deploy Jetty. That directory is used for
> the Windows installer and is nothing but an example otherwise (if
> that). Do not use it directly. Certainly don't use it if it's not
> working.
> 
>> Naively, I suspect it's something connected to
>> jetty9-dta-ssl-1.0.0.jar, but I can't have any logline about:
>> net.shibboleth.utilities.jetty9, nor in shib logs, neither in jetty
>> logs.
> 
> I seriously doubt it, but just don't use it, and if it turns into a
> different error involving authentication of the request, you'll have
> more proof.
> 
>> Whence should I start to pinpoint my error?
> 
> Use Jetty itself and configure it based on the documentation I
> provided in the wiki.

Of course there was a wrong assumption. When I tested attribute
authority with resolvertest, it worked.

The job done by the people who builded the "jetty-base" directory in the
unzipped shibboleth-idp source is not bad, as the results are the same
both starting from there or doing the jetty setup from scratch.

So, jetty idp back-channel works. Attribute authority works.

Doing attribute authority queries with curl, instead, needs a extra
setup when facing IdPv3.0: you need to set the correct content-type:

-H "Content-Type: text/xml; charset=UTF-8"

while IdP-2.4.0 didn't require that (at least for me: Debian GNU/Linux,
Tomcat6, java6).

thank you,

Francesco