SPSSODescriptor role metadata issue

[Waldbieser, Carl]

Luke,

If you look at the backing file ("C:\Program Files (x86)\Internet2\Shib2Idp/metadata/InCommon-metadata.xml") for the metadata you are downloading, do you see OrgSync's metadata in it?  There should be an entityID "https://orgsync.com/shibboleth-sp" in the XML file (which can be rather large).

If so, you may need to look at your idp's "logs/idp-process.log" file and see what is going on.  Does the IdP recognize the OrgSync relying party?  Does it ultimately release any attributes or are they all filtered out?

At Lafayette College, we added OrgSync as an SP to our IdP, and the integration was super-simple.  I just followed the instructions on their web site and the whole process was completed in about a day.

Thanks,
Carl Waldbieser
ITS Identity Management
Lafayette College

----- Original Message -----
From: "Luke Adams" <ladams at charlottelaw.edu>
To: "Shib Users" <users at shibboleth.net>
Sent: Monday, June 29, 2015 11:52:10 AM
Subject: SPSSODescriptor role metadata issue



Good morning, 



Can you assist me with a Shibboleth issue I’m having. A test SP has been setup at Orgsync and it points to my IdP: https://clt-idp.charlottelaw.edu/idp/shibboleth . This is my relying party information for OrgSync: 





<metadata:MetadataProvider id="https://orgsync.com/shibboleth-sp" xsi:type="metadata:FileBackedHTTPMetadataProvider" 

metadataURL="http://md.incommon.org/InCommon/InCommon-metadata.xml" 

backingFile="C:\Program Files (x86)\Internet2\Shib2Idp/metadata/InCommon-metadata.xml" 

/> 

</metadata:MetadataProvider> 





However, when trying the connection I receive this in the logs: 



11:12:55.342 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID 'https://orgsync.com/shibboleth-sp' could not be resolved 

11:12:55.342 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:305] - No metadata for relying party https://orgsync.com/shibboleth-sp, treating party as anonymous 



I know the IdP works because I can authenticate with Testshib. 





Luke Adams 

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net