SimpleSAMLphp SP against testshib - SSO Profile not recognized
Greg Desmarais
gdesmarais at isafe.org
Mon Jul 6 02:21:42 EDT 2015
There is a decent chance that I've just plain messed something up in my
config, but...late last week I was getting responses from the testshib idp
through my SP SSO process. Then I messed with configs, and started getting
*Error Message: SAML 2 SSO profile is not configured for relying party*
So I started over with my config, and tried to go step by step. I have
brought the testshib idp metadata into my simplesamlphp installation, and
configured it through the saml20-idp-remote.php (see below).
I have also configured the authsources.php to configure my SP's use of the
testshib IDP (see below), and exported this metadata, registering it with
the testshib IDP. My entity ID for my SP is https://idtest.com/sspsaml25.
It shows up on the entities list. When I try to hit the SSO service at
https://idp.testshib.org/idp/profile/SAML2/POST/SSO, I get the message
Error Message: SAML 2 SSO profile is not configured for relying party
https://idtest.com/sspsaml25
I understand that the message probably means something is wrong with my
metadata, but the logs say that testshib can't find the metadata for my
entity - not that there is an error in the process. And the entity is
listed. When I tried modifying the SP metadata to include a SSO service
that simplephp wasn't using, I got a different error, which seems to tell
me that the metadata is found, but not matched in some way.
Am I missing something simple? Any help is very much appreciated.
saml20-idp-remote.php:
<?php
$metadata['https://idp.testshib.org/idp/shibboleth'] = array (
'entityid' => 'https://idp.testshib.org/idp/shibboleth',
'description' =>
array (
'en' => 'TestShib Two Identity Provider',
),
'OrganizationName' =>
array (
'en' => 'TestShib Two Identity Provider',
),
'name' =>
array (
'en' => 'TestShib Test IdP',
),
'OrganizationDisplayName' =>
array (
'en' => 'TestShib Two',
),
'url' =>
array (
'en' => 'http://www.testshib.org/testshib-two/',
),
'OrganizationURL' =>
array (
'en' => 'http://www.testshib.org/testshib-two/',
),
'contacts' =>
array (
0 =>
array (
'contactType' => 'technical',
'givenName' => 'Nate',
'surName' => 'Klingenstein',
'emailAddress' =>
array (
0 => 'ndk at internet2.edu',
),
),
),
'metadata-set' => 'saml20-idp-remote',
'SingleSignOnService' =>
array (
0 =>
array (
'Binding' =>
'urn:mace:shibboleth:1.0:profiles:AuthnRequest',
'Location' => '
https://idp.testshib.org/idp/profile/Shibboleth/SSO',
),
1 =>
array (
'Binding' =>
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
'Location' => '
https://idp.testshib.org/idp/profile/SAML2/POST/SSO',
),
2 =>
array (
'Binding' =>
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'Location' => '
https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO',
),
3 =>
array (
'Binding' =>
'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
'Location' => '
https://idp.testshib.org/idp/profile/SAML2/SOAP/ECP',
),
),
'SingleLogoutService' =>
array (
),
'ArtifactResolutionService' =>
array (
0 =>
array (
'Binding' =>
'urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding',
'Location' => '
https://idp.testshib.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution',
'index' => 1,
),
1 =>
array (
'Binding' =>
'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
'Location' => '
https://idp.testshib.org:8443/idp/profile/SAML2/SOAP/ArtifactResolution',
'index' => 2,
),
),
'NameIDFormats' =>
array (
0 => 'urn:mace:shibboleth:1.0:nameIdentifier',
1 => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
),
'keys' =>
array (
0 =>
array (
'encryption' => true,
'signing' => true,
'type' => 'X509Certificate',
'X509Certificate' => '[removed for brevity]',
),
),
'scope' =>
array (
0 => 'testshib.org',
),
'UIInfo' =>
array (
'DisplayName' =>
array (
'en' => 'TestShib Test IdP',
),
'Description' =>
array (
'en' => 'TestShib IdP. Use this as a source of
attributes for your test SP.',
),
'InformationURL' =>
array (
),
'PrivacyStatementURL' =>
array (
),
'Logo' =>
array (
0 =>
array (
'url' => '
https://www.testshib.org/testshibtwo.jpg',
'height' => 88,
'width' => 253,
),
),
),
);
?>
authsources.php
<?php
$config = array(
'shibsaml' => array(
'saml:SP',
'name' => array(
'en' => 'TestShib',
'no' => 'TestShib',
),
'entityID' => 'https://idtest.com/sspsaml25',
'idp' => 'https://idp.testshib.org/idp/shibboleth',
'discoURL' => null,
'signature.algorithm' => '
http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
'privatekey' => 'saml.pem',
'certificate' => 'saml.crt',
),
);
SP metadata:
<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="
https://idtest.com/sspsaml25">
<md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>[removed for brevity]</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:KeyDescriptor use="encryption">
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:X509Data>
<ds:X509Certificate>[removed for brevity]</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
http://family.parentpermit.com/simplesaml/module.php/saml/sp/saml2-logout.php/shibsaml
"/>
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="
http://family.parentpermit.com/simplesaml/module.php/saml/sp/saml2-logout.php/shibsaml
"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
http://family.parentpermit.com/simplesaml/module.php/saml/sp/saml2-acs.php/shibsaml"
index="0"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="
http://family.parentpermit.com/simplesaml/module.php/saml/sp/saml1-acs.php/shibsaml"
index="1"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="
http://family.parentpermit.com/simplesaml/module.php/saml/sp/saml2-acs.php/shibsaml"
index="2"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="
http://family.parentpermit.com/simplesaml/module.php/saml/sp/saml1-acs.php/shibsaml/artifact"
index="3"/>
</md:SPSSODescriptor>
<md:ContactPerson contactType="technical">
<md:GivenName>IT</md:GivenName>
<md:SurName>Director</md:SurName>
<md:EmailAddress>itdirector at isafe.org</md:EmailAddress>
</md:ContactPerson>
</md:EntityDescriptor>
IDP log section:
02:05:28.445 - INFO [Shibboleth-Access:73] -
20150706T060528Z|50.81.16.78|idp.testshib.org:443|/profile/SAML2/POST/SSO|
02:05:28.446 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:86]
- shibboleth.HandlerManager: Looking up profile handler for request path:
/SAML2/POST/SSO
02:05:28.446 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.IdPProfileHandlerManager:97]
- shibboleth.HandlerManager: Located profile handler of the following type
for the request path:
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler
02:05:28.446 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:339] -
LoginContext key cookie was not present in request
02:05:28.446 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:188]
- Incoming request does not contain a login context, processing as first
leg of request
02:05:28.446 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:366]
- Decoding message with decoder binding
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
02:05:28.449 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128]
- Looking up relying party configuration for https://idtest.com/sspsaml25
02:05:28.450 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134]
- No custom relying party configuration found for
https://idtest.com/sspsaml25, looking up configuration based on metadata
groups.
02:05:28.450 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157]
- No custom or group-based relying party configuration found for
https://idtest.com/sspsaml25. Using default relying party configuration.
02:05:28.450 - WARN
[org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] -
SPSSODescriptor role metadata for entityID 'https://idtest.com/sspsaml25'
could not be resolved
02:05:28.450 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:387]
- Decoded request from relying party 'https://idtest.com/sspsaml25'
02:05:28.451 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:305]
- No metadata for relying party https://idtest.com/sspsaml25, treating
party as anonymous
02:05:28.451 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:222]
- SAML 2 SSO profile is not configured for relying party
https://idtest.com/sspsaml25
ᐧ
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150705/93838c9f/attachment-0001.html>
More information about the users
mailing list