Testing SP against sp.testshib.org

[Kevin Foote]

> On Dec 16, 2016, at 07:42, Dariusz Dolecki <dariusz.dolecki at gmail.com> wrote:
> 
> I've installed the IDP and the SP and am testing against https://sp.testshib.org/

Hi Dariusz, 

You are testing your IdP against the TestShib SP?

> I am getting the following error message:
> 2016-12-15 18:55:26 WARN Shibboleth.SessionInitiator.SAML2 [70]: unable to locate metadata for provider (https://ec2-54-91-116-213.compute-1.amazonaws.com/idp/shibboleth)

This is perhaps an IdP metadata load problem on the TestShib side. I’ll check into that. 

> In [root at ip-172-31-50-83 shibboleth]# tail shibd_warn.log
> 2016-12-15 21:35:37 WARN Shibboleth.Application : no MetadataProvider available, configure at least one for standard SSO usage
> 2016-12-15 21:48:51 WARN Shibboleth.Application : insecure cookieProps setting, set to "https" for SSL/TLS-only usage
> 2016-12-15 21:48:51 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites
> 2016-12-15 21:48:51 WARN Shibboleth.Application : no MetadataProvider available, configure at least one for standard SSO usage
> 2016-12-15 22:06:09 WARN Shibboleth.Application : insecure cookieProps setting, set to "https" for SSL/TLS-only usage
> 2016-12-15 22:06:09 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites
> 2016-12-15 22:06:09 WARN Shibboleth.Application : no MetadataProvider available, configure at least one for standard SSO usage
> 2016-12-15 23:39:21 WARN Shibboleth.Application : empty/missing cookieProps setting, set to "https" for SSL/TLS-only usage
> 2016-12-15 23:39:21 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites
> 2016-12-15 23:39:21 WARN Shibboleth.AttributeExtractor.
> XML : attribute mappings are reloadable; be sure to restart web server when adding new attribute IDs
>  
> shibboleth2.xml:  http://pastebin.com/muJ9WJqP
> 
> 
> #cat /opt/shibboleth-idp/conf/metadata-providers.xml
> <MetadataProvider id="HTTPMetadataTESTSHIB"
>                   xsi:type="FileBackedHTTPMetadataProvider"
>                   backingFile="%{idp.home}/metadata/testshib-providers.xml"
>                   metadataURL="http://www.testshib.org/metadata/testshib-providers.xml"/>
> 
> [root at ip-172-31-50-83 shibboleth]# tail shibd.log
> 2016-12-15 23:39:21 INFO Shibboleth.AttributeFilter : loaded XML resource (/etc/shibboleth/attribute-policy.xml)
> 2016-12-15 23:39:21 INFO Shibboleth.Application : building AttributeResolver of type Query...
> 2016-12-15 23:39:21 INFO Shibboleth.Application : building CredentialResolver of type File...
> 2016-12-15 23:39:21 INFO XMLTooling.SecurityHelper : loading private key from file (/etc/shibboleth/sp-key.pem)
> 2016-12-15 23:39:21 INFO XMLTooling.SecurityHelper : loading certificate(s) from file (/etc/shibboleth/sp-cert.pem)
> 2016-12-15 23:39:21 INFO Shibboleth.Listener : registered remoted message endpoint (default::getHeaders::Application)
> 2016-12-15 23:39:21 INFO Shibboleth.Listener : listener service starting
> 2016-12-15 23:39:21 INFO Shibboleth.AttributeExtractor.XML : reload thread started...running when signaled
> 2016-12-15 23:39:21 INFO Shibboleth.AttributeFilter : reload thread started...running when signaled
> 2016-12-15 23:39:21 INFO OpenSAML.MetadataProvider.XML : reload thread started...running every 180000 seconds
> [root at ip-172-31-50-83 shibboleth]#

You are however, showing logs and configuration from your install of the shib-sp software. 
I’m confused on what you are trying to test. 

--------
thanks
 kevin.foote