testshib IDP not finding config so "unable to select endpoint"

[Klingenstein, Nate]

Matt,


I see nothing obviously wrong with your metadata, but I might not be looking closely enough.


The bigger problem is that TestShib is still running very old software and the volunteer primarily maintaining it today is overloaded.


Have you tested loading the metadata in other providers?


Sorry to not be more useful,

Nate.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Matt Self <matt at crafted.education>
Sent: Thursday, July 27, 2017 4:50:31 PM
To: users at shibboleth.net
Subject: testshib IDP not finding config so "unable to select endpoint"

Hi,
I've setup an app to act as a Service Provider on testshib.org<http://testshib.org/>.  I've uploaded my metadata (which afaik looks fine when compared against others and i see no errors in logs when uploading). And I see my EntityID at http://www.testshib.org/entities.html (EntityID https://preprod.inscribe.education/organizations/indianau/saml/metadata)

But when sending over an AuthnRequest I get "No peer endpoint available to which to send SAML response". This appears to be because the SAMLMDRelyingPartyConfigurationManager can't find my configuration by the entityID which I pass in (on the querystring of the request as "providerId" which I send to https://idp.testshib.org/idp/profile/Shibboleth/SSO). I've confirmed that the entityID in my metadata and matches what I send in providerId. Also, the AssertionConsumerServiceUrl matches in both the metadata and the AuthnRequest. I'm at a loss as to what to look at next.

The logs show it falling back to "default" relying party config at which point it isn't going to work:

19:14:58.385 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for https://preprod.inscribe.education/organizations/indianau/saml/metadata
19:14:58.385 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for https://preprod.inscribe.education/organizations/indianau/saml/metadata, looking up configuration based on metadata groups.
19:14:58.386 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for https://preprod.inscribe.education/organizations/indianau/saml/metadata. Using default relying party configuration.
19:14:58.386 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml1.ShibbolethSSOEndpointSelector:62] - Unable to select endpoint, no entity role metadata available.
19:14:58.387 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party https://preprod.inscribe.education/organizations/indianau/saml/metadata

I've attached my metadata xml and an example authnrequest.xml.

Any help is greatly appreciated.
Thanks so much.
Matt Self
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170728/5bfff4ce/attachment-0001.html>