Newbie SP problem

[Cantor, Scott]

> 11:10:03.061 - INFO
> [edu.internet2.middleware.shibboleth.common.config.relyingparty.RelyingP
> artyConfigurationBeanDefinitionParser:73] - Parsing configuration for relying
> party with id: https://idm-3.acs.utah.edu/shibboleth

That is not metadata per se. That's an override definition for an SP with that name. There is no way short of low level debugging to know what entities have metadata loaded. There never will be with V2.

> Now on the SP side if I have in Shibboleth2.xml (using server URL):
> 
> <ApplicationDefaults entityID="https://idm-3.acs.utah.edu/shibboleth"
>                          REMOTE_USER="eppn persistent-id targeted-id">

That matches, but again, you're still creating overrides for no reason.

> I don't get any errors in my app, but I don't get any attributes either.

Well, attribute release is a totally separate issue, but that means the metadata is loaded and things line up, and you just have to decide what to release and on what basis.

> If I have in Shibboleth2.xml (using my SP metadata entityID):
> 
> <ApplicationDefaults entityID="https://sp.attrrelease.utah.edu/shibboleth"
>                          REMOTE_USER="eppn persistent-id targeted-id">

Well, which is the intended name? Here you've renamed the SP to something different, and obviously there's no metadata with that name being loaded.

> I get the "SAML 2 SSO profile is not configured for relying party" from the IDP
> when I hit the application.

Because there's no metadata for that name loaded.

> We have a simple PHP app running on the SP's httpd that does display
> attributes. It has no entry in shibboleth2 nor any metadata.

I don't know what that means.

I don't know what your intent is or how you have this IdP configured. By default, it will respond to any SP that you load metadata for and you do NOT need any relying party definitions to make that happen. You need metadata loaded for each SP, and that's it. But if it's been modified to behave in some other way, then there's no way for me to know that.

An SP that is receiving attributes either has metadata loaded into the IdP, or it's an IdP that's been configured to respond to anonymous/unverified SPs.

-- Scott