shibsp::ConfigurationException error

[Mike De Lise]

I believe that is what I did do.
SP box name: pirlxjira1
IDP box name: pirlx66vm1

I did wget https://pirlxjira1/idp/shibboleth     on SP box. put it in
/etc/shibboleth/idp-metadata.xml
Here is what that metadata file first line looks like:
<EntityDescriptor entityID="https://pirlx66vm1/idp/shibboleth"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata">

On the IDP box I did wget https://pirlxjira1/Shibboleth.sso/Metadata
and put it in /opt/shibboleth-idp/metadata/idp-metadata.xml
The first part of that metadata file looks like the follow:
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_8f11a0cd2126cf3e75cf86d49dc98beff68a9dec"
entityID="https://pirlx66vm1/idp/shibboleth">

This is the part I think is probably goofing me up since i've gone
back and forth so many times on this single install that the default
metadata is hosed from the IDP box.

Should the default /opt/shibboleth-idp/metadata/idp-metadata.xml point
to the SP box or itself?


Another thing, dunno if it matters but if I goto
https://idp-host/idp/status  I get the

Web Login Service - Access Denied

You do not have access to the requested resource.

Is this because the acl is only for localhost?  I know i added my
workstation IP in the acl on the SP box and can view that status fine,
wasn't sure on the IDP box.

Thanks
Mike

On Mon, Mar 2, 2015 at 7:30 PM, Kevin Foote <kpfoote at uoregon.edu> wrote:
>
>> On Mar 2, 2015, at 5:25 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> Firstly, stop using IP addresses. Those are not useful names. EntityIDs
>> are names.
>>
>> Secondly, that's the common/usual format of the entityID of a Shibboleth
>> SP, not an IdP. I would therefore assume that you've handed the metadata
>> for the SP to itself. That is not going to work. That metadata does not
>> describe an IdP, and it doesn't have the right role descriptors in it.
>> That's why the log message is what it is, no IdP role found.
>>
>> SP metadata -> load into IdP
>> IdP metadata -> load into SP
>
> Yea what he said :)
> (much better than I)
>
> - sent from mobile
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net