Velocity in new installation of Shibboleth IDP

[Brett Cave]

I have configured the SP, and am wanting to test authentication (even
though it's unsupported, it does give a quick test mechanism for POC). So
now, if I go to

>From https://wiki.shibboleth.net/confluence/display/IDP30/Installation, the
typical next steps are config (done), loading SP metadata (done), configure
auth (done). I've skipped attribute resolution and release policy, and
wanting to "customize the login UI". The link to customizing login also
references 3 files: *conf/authn/password-authn-config.xml, views/login.vm,
login.jsp.  *Is login.jsp a legacy file reference in the wiki?

This brings me back to confusion as per my original post: I initially
assumed that having a "login.vm" in the "views" directory of shib idp meant
I'd be able to view it on /login some how. Scott: "There's no login.jsp
provided as an alternative to login.vm" seems to indicate the ability to
access "login" some how - but I can't. So if login.vm doesn't render
anything to a client, how can I access it / use it?

Also, while testing SAML, I am able to get a request from the SP to Shib
IDP. The request sends me to /idp/profile/SAML2/Redirect/SSO with some URL
parameters as per the default metadata I provided to the SP... And this
endpoint is also coming back with a 404. web.xml includes servlet mappings
for IDP which is a DispatcherServlet and references mv-beans.xml and
webflow-config.xml for config.

If the views or UI rendering is not provided by Shib IDP, pelase help me
understand what the views are for, and what to do next to get authenticated
/ handle auth requests....

Thanks.

On Tue, Jun 6, 2017 at 6:01 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/6/17, 11:46 AM, "users on behalf of Brett Cave" <
> users-bounces at shibboleth.net on behalf of brettcave at gmail.com> wrote:
>
> > Thanks Scott. I was hoping to get a nice login page to test the LDAP
> authentication I configured - I thought (not misled by the
> > docs, but just an assumption) that Shib IDP would provide a UI to
> authenticate into the app and then kick off some a SAML.
>
> Well, even if we did *something*, we could have to make up a SAML response
> to issue since there's no SP. That might be taking things a bit far, but
> once having done something we might end up building in enough simple
> testing capability to make that possible. Regardless, "test the LDAP
> authentication" is the thing we identified we have to add.
>
> > So on to the next issue - I found TestShib which seemed like a great
> place to start testing SAML. My understanding is that I can
> > use the IDP metadata in testshib.org to generate some SP metadata, add
> it to the Shib host and then reference it from
> > metadata-providers. Is this the correct sort of next step?
>
> You have to create metadata for your IdP to give to testshib and you need
> to load testshib's SP metadata into your IdP. Testshib is not, name aside,
> part of this project and we don't use it or support it as a testing
> mechanism. Use it at your own risk.
>
> > Am guessing I could also use the shib app and drop in my own login.jsp
> >  to test authentication and then test SAML through to the SP...
>
> I don't really follow that, so I'm guessing no. The IdP supports views
> with both Velocity or JSP templates, but we don't advise wasting time on
> JSP, so there's no login.jsp provided as an alternative to login.vm.
>
> > TestShib is coming back to me with an error that the idp-metadata.xml is
> not valid, so I'm trying to figure out how to fix that (any
> > guidance or samples would be a great help).
>
> I don't get involved with it and that's why. It exposes its logs so any
> error it raises should be in one of them.
>
> -- Scott
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
twitter: @brettcave
Blog: http://brett.cave.za.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170607/375ca1a7/attachment.html>