Cannot register SP metadata for testing
Paul Pogonyshev
pogonyshev at gmail.com
Thu Oct 18 05:53:04 EDT 2018
Hi,
I upload SP metadata for testing purposes. It is for entity identifier
"pnw-test-dev3". Uploading page then says: "Your metadata was uploaded
successfully". It can also be seen here:
http://www.testshib.org/entities.html
However, when I try to send authentication requests from this entity,
I get Testshib error page. In the logs I can see these lines:
05:41:30.004 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128]
- Looking up relying party configuration for pnw-test-dev3
05:41:30.004 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134]
- No custom relying party configuration found for pnw-test-dev3,
looking up configuration based on metadata groups.
05:41:30.004 - DEBUG
[edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157]
- No custom or group-based relying party configuration found for
pnw-test-dev3. Using default relying party configuration.
05:41:30.004 - WARN
[org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81]
- SPSSODescriptor role metadata for entityID 'pnw-test-dev3' could not
be resolved
05:41:30.005 - WARN
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:195]
- Simple signature validation (with no request-derived credentials)
failed
05:41:30.005 - WARN
[org.opensaml.common.binding.security.BaseSAMLSimpleSignatureSecurityPolicyRule:138]
- Validation of request simple signature failed for context issuer:
pnw-test-dev3
05:41:30.006 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406]
- Message did not meet security requirements
org.opensaml.ws.security.SecurityPolicyException: Validation of
request simple signature failed for context issuer
So, apparently, Testshib IdP cannot find SP metadata, even though
other parts of Testshib say that it has been uploaded (without errors)
and list "pnw-test-dev3" among known entities.
I have registered successfully and logged in using similar metadata
before. In fact, "pnw-dev3" entity ID still works, even though
http://www.testshib.org/entities.html doesn't list it anymore (it has
been overwritten with this new "pnw-test-dev3").
It seems to me like there is some problem on Testshib side, where IdP
and metadata uploading site parts don't operate with the same data
anymore. Or do I miss something?
Paul
More information about the users
mailing list