TestShib.org: Issue with some URLs specified in the metadata.

[Corey Puffalt]

All,

I was just trying to use testshib.org to test an OpenAM SP setup and one
thing I ran into is that some of the endpoint URLs in the
testshib-providers.xml metadata file are referencing endpoints that have a
self-signed SSL certificate for some reason.  The problematic URLs are all
referencing port 8443 instead of the standard 443 port for SSL.

>From the metadata:

...
            <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
                Location="
https://idp.testshib.org:8443/idp/profile/SAML1/SOAP/ArtifactResolution"
                index="1"/>
            <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
                Location="
https://idp.testshib.org:8443/idp/profile/SAML2/SOAP/ArtifactResolution"
                index="2"/>
...
            <AttributeService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
                Location="
https://idp.testshib.org:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>
            <AttributeService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
                Location="
https://idp.testshib.org:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>
...

The issue here (for OpenAM at least) is that idp.testshib.org:8443 returns
an untrusted, self-signed certificate instead of the trusted certificate
which is used on idp.testshib.org:443.  I'm not sure if these URLs are
incorrect and should be edited to use port 443 instead of 8443 or whether
the ports are correct but the service listening on :8443 is just
incorrectly configured to use the wrong certificate.

Thanks!
Corey
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151022/f11bd187/attachment.html>