Testing SP against sp.testshib.org

[Dariusz Dolecki]

Kevin,

Thanks for looking into the metadata load possible issue. I tried to follow
the list guidelines and provided all configuration files and logs. I am
trying to get a workable idp-sp configuration going. Regards,

Dariusz

On Fri, Dec 16, 2016 at 8:56 AM, Kevin Foote <kevin.foote at colorado.edu>
wrote:

>
> > On Dec 16, 2016, at 07:42, Dariusz Dolecki <dariusz.dolecki at gmail.com>
> wrote:
> >
> > I've installed the IDP and the SP and am testing against
> https://sp.testshib.org/
>
> Hi Dariusz,
>
> You are testing your IdP against the TestShib SP?
>
> > I am getting the following error message:
> > 2016-12-15 18:55:26 WARN Shibboleth.SessionInitiator.SAML2 [70]: unable
> to locate metadata for provider (https://ec2-54-91-116-213.
> compute-1.amazonaws.com/idp/shibboleth)
>
> This is perhaps an IdP metadata load problem on the TestShib side. I’ll
> check into that.
>
> > In [root at ip-172-31-50-83 shibboleth]# tail shibd_warn.log
> > 2016-12-15 21:35:37 WARN Shibboleth.Application : no MetadataProvider
> available, configure at least one for standard SSO usage
> > 2016-12-15 21:48:51 WARN Shibboleth.Application : insecure cookieProps
> setting, set to "https" for SSL/TLS-only usage
> > 2016-12-15 21:48:51 WARN Shibboleth.Application : handlerSSL should be
> enabled for SSL/TLS-enabled web sites
> > 2016-12-15 21:48:51 WARN Shibboleth.Application : no MetadataProvider
> available, configure at least one for standard SSO usage
> > 2016-12-15 22:06:09 WARN Shibboleth.Application : insecure cookieProps
> setting, set to "https" for SSL/TLS-only usage
> > 2016-12-15 22:06:09 WARN Shibboleth.Application : handlerSSL should be
> enabled for SSL/TLS-enabled web sites
> > 2016-12-15 22:06:09 WARN Shibboleth.Application : no MetadataProvider
> available, configure at least one for standard SSO usage
> > 2016-12-15 23:39:21 WARN Shibboleth.Application : empty/missing
> cookieProps setting, set to "https" for SSL/TLS-only usage
> > 2016-12-15 23:39:21 WARN Shibboleth.Application : handlerSSL should be
> enabled for SSL/TLS-enabled web sites
> > 2016-12-15 23:39:21 WARN Shibboleth.AttributeExtractor.
> > XML : attribute mappings are reloadable; be sure to restart web server
> when adding new attribute IDs
> >
> > shibboleth2.xml:  http://pastebin.com/muJ9WJqP
> >
> >
> > #cat /opt/shibboleth-idp/conf/metadata-providers.xml
> > <MetadataProvider id="HTTPMetadataTESTSHIB"
> >                   xsi:type="FileBackedHTTPMetadataProvider"
> >                   backingFile="%{idp.home}/metadata/testshib-providers.
> xml"
> >                   metadataURL="http://www.testshib.org/metadata/
> testshib-providers.xml"/>
> >
> > [root at ip-172-31-50-83 shibboleth]# tail shibd.log
> > 2016-12-15 23:39:21 INFO Shibboleth.AttributeFilter : loaded XML
> resource (/etc/shibboleth/attribute-policy.xml)
> > 2016-12-15 23:39:21 INFO Shibboleth.Application : building
> AttributeResolver of type Query...
> > 2016-12-15 23:39:21 INFO Shibboleth.Application : building
> CredentialResolver of type File...
> > 2016-12-15 23:39:21 INFO XMLTooling.SecurityHelper : loading private key
> from file (/etc/shibboleth/sp-key.pem)
> > 2016-12-15 23:39:21 INFO XMLTooling.SecurityHelper : loading
> certificate(s) from file (/etc/shibboleth/sp-cert.pem)
> > 2016-12-15 23:39:21 INFO Shibboleth.Listener : registered remoted
> message endpoint (default::getHeaders::Application)
> > 2016-12-15 23:39:21 INFO Shibboleth.Listener : listener service starting
> > 2016-12-15 23:39:21 INFO Shibboleth.AttributeExtractor.XML : reload
> thread started...running when signaled
> > 2016-12-15 23:39:21 INFO Shibboleth.AttributeFilter : reload thread
> started...running when signaled
> > 2016-12-15 23:39:21 INFO OpenSAML.MetadataProvider.XML : reload thread
> started...running every 180000 seconds
> > [root at ip-172-31-50-83 shibboleth]#
>
> You are however, showing logs and configuration from your install of the
> shib-sp software.
> I’m confused on what you are trying to test.
>
> --------
> thanks
>  kevin.foote
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161216/45c2dc37/attachment.html>