Velocity in new installation of Shibboleth IDP

[Cantor, Scott]

On 6/6/17, 11:46 AM, "users on behalf of Brett Cave" <users-bounces at shibboleth.net on behalf of brettcave at gmail.com> wrote:

> Thanks Scott. I was hoping to get a nice login page to test the LDAP authentication I configured - I thought (not misled by the
> docs, but just an assumption) that Shib IDP would provide a UI to authenticate into the app and then kick off some a SAML.

Well, even if we did *something*, we could have to make up a SAML response to issue since there's no SP. That might be taking things a bit far, but once having done something we might end up building in enough simple testing capability to make that possible. Regardless, "test the LDAP authentication" is the thing we identified we have to add.

> So on to the next issue - I found TestShib which seemed like a great place to start testing SAML. My understanding is that I can
> use the IDP metadata in testshib.org to generate some SP metadata, add it to the Shib host and then reference it from
> metadata-providers. Is this the correct sort of next step?

You have to create metadata for your IdP to give to testshib and you need to load testshib's SP metadata into your IdP. Testshib is not, name aside, part of this project and we don't use it or support it as a testing mechanism. Use it at your own risk.

> Am guessing I could also use the shib app and drop in my own login.jsp
>  to test authentication and then test SAML through to the SP... 

I don't really follow that, so I'm guessing no. The IdP supports views with both Velocity or JSP templates, but we don't advise wasting time on JSP, so there's no login.jsp provided as an alternative to login.vm.

> TestShib is coming back to me with an error that the idp-metadata.xml is not valid, so I'm trying to figure out how to fix that (any
> guidance or samples would be a great help).

I don't get involved with it and that's why. It exposes its logs so any error it raises should be in one of them.

-- Scott