Shibboleth SP, Azure AD IDP - no metadata found.

[Dan MacMillan]

Hello,

I am a total neophyte when it comes to SAML, Shibboleth, and Azure AD. I have done a lot of reading and I think I have a broad understanding of the moving parts, but it is not working for me.

Since I am new to everything, I decided a good plan was to start with a fully working environment in the form of the dockerized-idp-testbed from GitHub, and then swap out each leg with the piece I really want to use. I got the dockerized-idp-testbed working. I made changes to it, and to our DNS, firewall rules etc. to publish it on the internet, since it will need to be publicly accessible in order for Azure to talk to it. That is working.

Now I am trying to substitute Azure AD for Shibboleth IDP.

I uploaded my SP metadata into Azure. I downloaded the Azure metadata and put it into the "sp/etc-shibboleth/idp-metadata.xml" file in the testbed, completely replacing the contents of that file. I edited the shibboleth2.xml file, setting the entityID attribute on the SSO element to the value the Azure AD control panel is telling me to use. This value agrees with the value of the entityID attribute in the EntityDescriptor element of the idp-metadata.xml file.

This is the error I am getting (from shibd.log)

2018-06-28 21:23:00 WARN Shibboleth.SSO.SAML2 [1]: no metadata found, can't establish identity of issuer (https://sts.windows.net/48f50b92-8209-4bbd-9e4e-49fb432e8d73/)

This is what the SSO attribute of shibboleth2.xml looks like:

            <SSO entityID="https://sts.windows.net/48f50b92-8209-4bbd-9e4e-49fb432e8d73/">
              SAML2 SAML1
            </SSO>

At this point I am completely flummoxed. There is another entityID on the ApplicationDefaults but I left it looking like this:

    <ApplicationDefaults entityID="https://sp.idptestbed/shibboleth"

I don't think I have to change that, do I? I understand it could be considered "bad" to leave it at this bogus value, but this is a test environment for now and I want to minimize my changes so I understand how this all works.  My understanding is that the entityID on the SSO element is how it finds the metadata. There is a MetaData provider element in shibboleth2.xml that looks like this (I did not change this):

        <MetadataProvider type="XML" validate="true" file="idp-metadata.xml"/>

Since the idp-metadata file it is pointing to contains the Azure metadata, and since that metadata has an entityID that agrees with the SSO element, I don't understand why this is not working.

I would really appreciate any help.

-- 
Dan MacMillan