[Ext] RE: Newbie SP problem

[Bryan Wooten]

I think we found the issue, It is a Tomcat6 bug.

https://groups.google.com/forum/#!topic/shibboleth-users/K90-JyuvSaI

I¹ll let you knowŠ

-Bryan

On 7/15/16, 4:00 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>> 11:10:03.061 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.relyingparty.RelyingP
>> artyConfigurationBeanDefinitionParser:73] - Parsing configuration for
>>relying
>> party with id: https://idm-3.acs.utah.edu/shibboleth
>
>That is not metadata per se. That's an override definition for an SP with
>that name. There is no way short of low level debugging to know what
>entities have metadata loaded. There never will be with V2.
>
>> Now on the SP side if I have in Shibboleth2.xml (using server URL):
>> 
>> <ApplicationDefaults entityID="https://idm-3.acs.utah.edu/shibboleth"
>>                          REMOTE_USER="eppn persistent-id targeted-id">
>
>That matches, but again, you're still creating overrides for no reason.
>
>> I don't get any errors in my app, but I don't get any attributes either.
>
>Well, attribute release is a totally separate issue, but that means the
>metadata is loaded and things line up, and you just have to decide what
>to release and on what basis.
>
>> If I have in Shibboleth2.xml (using my SP metadata entityID):
>> 
>> <ApplicationDefaults
>>entityID="https://sp.attrrelease.utah.edu/shibboleth"
>>                          REMOTE_USER="eppn persistent-id targeted-id">
>
>Well, which is the intended name? Here you've renamed the SP to something
>different, and obviously there's no metadata with that name being loaded.
>
>> I get the "SAML 2 SSO profile is not configured for relying party" from
>>the IDP
>> when I hit the application.
>
>Because there's no metadata for that name loaded.
>
>> We have a simple PHP app running on the SP's httpd that does display
>> attributes. It has no entry in shibboleth2 nor any metadata.
>
>I don't know what that means.
>
>I don't know what your intent is or how you have this IdP configured. By
>default, it will respond to any SP that you load metadata for and you do
>NOT need any relying party definitions to make that happen. You need
>metadata loaded for each SP, and that's it. But if it's been modified to
>behave in some other way, then there's no way for me to know that.
>
>An SP that is receiving attributes either has metadata loaded into the
>IdP, or it's an IdP that's been configured to respond to
>anonymous/unverified SPs.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net