Shibboleth SP, Azure AD IDP - no metadata found.

[Dan MacMillan]

Actually now that I take a closer look at the logs, I see that it couldn't parse the metadata XML file at all, which must be the real problem.

2018-06-28 22:11:40 DEBUG OpenSAML.Metadata.XML : using local resource (/etc/shibboleth/idp-metadata.xml), will monitor for changes
2018-06-28 22:11:40 DEBUG OpenSAML.Metadata.XML : loading configuration from external resource...
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 471, message: grammar not found for namespace 'http://docs.oasis-open.org/wsfed/federation/200706'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 1665, message: no declaration found for element 'fed:ClaimTypesOffered'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 7889, message: no declaration found for element 'fed:SecurityTokenServiceEndpoint'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 8133, message: no declaration found for element 'fed:PassiveRequestorEndpoint'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 8360, message: element 'fed:ClaimTypesOffered' is not allowed for content model '(Signature?,Extensions?,KeyDescriptor*,Organization?,ContactPerson*)'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 8611, message: grammar not found for namespace 'http://docs.oasis-open.org/wsfed/federation/200706'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 9800, message: no declaration found for element 'fed:TargetScopes'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 10015, message: no declaration found for element 'fed:ApplicationServiceEndpoint'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 10257, message: no declaration found for element 'fed:PassiveRequestorEndpoint'
2018-06-28 22:11:40 ERROR XMLTooling.ParserPool : error on line 1, column 10484, message: element 'fed:TargetScopes' is not allowed for content model '(Signature?,Extensions?,KeyDescriptor*,Organization?,ContactPerson*)'
2018-06-28 22:11:40 ERROR OpenSAML.Metadata.XML : error while loading resource (/etc/shibboleth/idp-metadata.xml): XML error(s) during parsing, check log for specifics
2018-06-28 22:11:40 CRIT Shibboleth.Application : error initializing MetadataProvider: XML error(s) during parsing, check log for specifics

Dan MacMillan | Integration Specialist
Emerald Associates Inc.

Tel: 403.686.7100 ext. 8930



-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Dan MacMillan
Sent: Thursday, June 28, 2018 15:56
To: users at shibboleth.net
Subject: Shibboleth SP, Azure AD IDP - no metadata found.

Hello,

I am a total neophyte when it comes to SAML, Shibboleth, and Azure AD. I have done a lot of reading and I think I have a broad understanding of the moving parts, but it is not working for me.

Since I am new to everything, I decided a good plan was to start with a fully working environment in the form of the dockerized-idp-testbed from GitHub, and then swap out each leg with the piece I really want to use. I got the dockerized-idp-testbed working. I made changes to it, and to our DNS, firewall rules etc. to publish it on the internet, since it will need to be publicly accessible in order for Azure to talk to it. That is working.

Now I am trying to substitute Azure AD for Shibboleth IDP.

I uploaded my SP metadata into Azure. I downloaded the Azure metadata and put it into the "sp/etc-shibboleth/idp-metadata.xml" file in the testbed, completely replacing the contents of that file. I edited the shibboleth2.xml file, setting the entityID attribute on the SSO element to the value the Azure AD control panel is telling me to use. This value agrees with the value of the entityID attribute in the EntityDescriptor element of the idp-metadata.xml file.

This is the error I am getting (from shibd.log)

2018-06-28 21:23:00 WARN Shibboleth.SSO.SAML2 [1]: no metadata found, can't establish identity of issuer (https://sts.windows.net/48f50b92-8209-4bbd-9e4e-49fb432e8d73/)

This is what the SSO attribute of shibboleth2.xml looks like:

            <SSO entityID="https://sts.windows.net/48f50b92-8209-4bbd-9e4e-49fb432e8d73/">
              SAML2 SAML1
            </SSO>

At this point I am completely flummoxed. There is another entityID on the ApplicationDefaults but I left it looking like this:

    <ApplicationDefaults entityID="https://sp.idptestbed/shibboleth"

I don't think I have to change that, do I? I understand it could be considered "bad" to leave it at this bogus value, but this is a test environment for now and I want to minimize my changes so I understand how this all works.  My understanding is that the entityID on the SSO element is how it finds the metadata. There is a MetaData provider element in shibboleth2.xml that looks like this (I did not change this):

        <MetadataProvider type="XML" validate="true" file="idp-metadata.xml"/>

Since the idp-metadata file it is pointing to contains the Azure metadata, and since that metadata has an entityID that agrees with the SSO element, I don't understand why this is not working.

I would really appreciate any help.

-- 
Dan MacMillan
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net