Connection between a SP and a new Shibboleth IdP

[Peter Schober]

* Esther Garcia <fulletverde at gmail.com> [2015-06-09 17:57]:
> But if we try to connect from a SP to our new Shibboleth Idp, we receive
> the following error: *"Message did not meet security requirements"*.

I'd undo the logging change you made to log everything on DEBUG (as
that will just make it harder for you to find anything).

> It seems a problem with the certificate configuration, but we do not see
> the problem. I would like to ask if you can help to understand this problem.
> 
> Here our certificate configuration:

This has nothing to do with your IDP's certificates.

> For stablishing communication between SP and the new IdP, we have copied
> the idp-metadata.xml into SP. From SP we are redirected to IdP but fails
> when the certificate is checked. Here the logfiles:
[...]
> Another question about Shibboleth configuration is: How we can load the
> SAML metadata from the SP with which we will interact? We tried to
> configure it in IDP_HOME/conf/relying-party.xml following this procedure:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-HTTPMetadataProvider
> <https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider>
> but we can not find where we need to register the SP. How should be set
> this step?

I guess that's not another question at all, i.e. the former error
(which is just a WARNing, not an ERROR) is probably a result of the
latter, i.e. of the fact that you don't have metadata available for
the SP.

How to add an SP's metadata: For simple cases I'd add a filesystem
based metadata provider to my relying-party.xml, referencing a local
file of your creation in IDP_HOME/metadata/. That file would have an
EntitiesDescriptor as its root element and contain copies of all of
your SPs' SAML metadata.
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-FilesystemMetadataProvider
See also
https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata
for some general explanations on SAML metadata.
-peter