v2->v3 upgrade, idp-metadata.xml

[Nate Klingenstein]

There are a hundred thousand checks that TestShib performs on uploaded
metadata, some of which don't have particularly descriptive errors
associated with them.  If you got a message, I can trace it back a
little further, but I would suspect something's just mistyped
somewhere in that file.  xmllint with schema validation is a decent
starting point.

xmllint --noout --schema
/opt/schema-files/saml-schema-metadata-2.0.xsd your-metadata.xml

If neither of those helps, we'd have to start instrumenting the error
messages here better, which will likely require Kevin to pitch in, as
he's done extensive work adding new checks and refactoring of my
original "Hello World"-quality script, along with wiring it all up to
a new aggregator.


On Wed, Jul 6, 2016 at 5:42 PM, Baron Fujimoto <baron at hawaii.edu> wrote:
> I'm making progress on our v2->v3 upgrade. I've completed the post-upgrade
> tasks for metadata-providers.xml and relying-party.xml, though I've yet to
> convert them to new the new configuration style.
>
> I'm able to successfully load the status servlet both via a browser and
> using the status script. The AllowedIPs parameter wasn't automatically
> carried over from the Status servlet in the v2.conf/web.xml into its
> equivalent in v3's access-control.xml's allowedRanges. Perhaps this might
> be noted as a post-upgrade task as well?
>
> aacli also appears to generate the expected results.
>
> Before moving on to configuring an external CAS authentication (we'll
> get around to transitioning to the native CAS later), I wanted to
> verify the upgrade with testshib.org. I'm running into problems with
> our metadata though. Testshib rejects it as invalid.
>
> This is presumably the result of the way I pursued this upgrade, where I
> copied an existing deployment to a new host and upgraded that. This meant
> I had the metadata from the original host. I edited the copied metadata
> to reflect the new hostname in the SSO endpoints. I also took the
> opportunity to follow recommendations to use the same entityID in our
> test and production environments, and thus updated the entityID as well.
> Testshib is not specific as to why the metadata is invalid, but I'm
> supposing it may be due to a mismatch in the x509 certificates? If this
> is probably it, what's the best way to correct this or regenerate the
> metadata (and /credentials ?) for the new host?
>
> --
> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net