new SP / IdP config question

[Markus M. Krause]

Dear all,

first of all: happy new year!

Then: I successfully installed a Shibboleth IdP (Version 3.3.4, running 
on Debian 8) and could configure it to be used by the german DFN 
Shibboleth federation (following their documentation at 
https://doku.tid.dfn.de/de:shibidp3 . All seems to be working fine 
(means the test SP at the DFN all can "use" my IdP and show the 
appropriate messages and attribute values).
Now I need to add a SP which is running at our institute and should be 
connected "directly" to the IdP (as this is the only user base we do not 
want to confuse our users to select their home institute first). 
Unfortunately I could not find a documentation for this use case 
anywhere (nor DFN or Shibboleth.net or mailing list archive, the 
keywords seem to be to just to common ...)
I assume this is possible by configuring relying party and filter 
information correctly, which I obviously fail to do. So I appolgise for 
my newbie questions ...


What I did so far is:
- add a bean "RelyingPartByName" to conf/relying-party.xml
- add AttributeFilterPolicy in conf/attribute-filter.xml

The SP seems to be configured correctly as if I point by browser to a 
proteced URL I get a redirection to the IdP, but just get "Unsupported 
Request" in the browser. The logs on the IdP contain:

idp-process.log:
INFO 
[org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:128] - 
IP:10.0.0.24 - Message Handler:  No metadata returned for 
https://test-sp01.XXXXXXX/shibboleth in role 
{urn:oasis:names:tc:SAML:2.0:tadata}SPSSODescriptor with protocol 
urn:oasis:names:tc:SAML:2.0:protocol
WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - 
IP:10.0.0.24 - Profile Action SelectProfileConfiguration: Profile 
http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for 
RP configuration shibboleth.UnverifiedRelyingParty (RPID 
https://test-sp01.XXXXXXX/shibboleth)
WARN [org.opensaml.profile.action.impl.LogEvent:105] - IP:10.0.0.24 - A 
non-proceed event occurred while processing the request: 
InvalidProfileConfiguration

During start of the IdP I do not see any error messages, all lines just 
contain "INFO" messages.

Is there an error in my configuration or do have to add an additional 
configuration somewhere else?


The configuration I added just contain:
[relying-party.xml]
         <!-- test-sp01 -->
         <bean parent="RelyingPartyByName" 
c:relyingPartyIds="https://test-sp01.XXXXXXX/shibboleth">
             <property name="profileConfigurations">
                 <list>
                     <bean parent="Shibboleth.SSO" 
p:postAuthenticationFlows="attribute-release" />
                     <ref bean="SAML1.AttributeQuery" />
                     <ref bean="SAML1.ArtifactResolution" />
                     <bean parent="SAML2.SSO" 
p:postAuthenticationFlows="attribute-release" />
                     <ref bean="SAML2.ECP" />
                     <ref bean="SAML2.Logout" />
                     <ref bean="SAML2.AttributeQuery" />
                     <ref bean="SAML2.ArtifactResolution" />
                     <ref bean="Liberty.SSOS" />
                 </list>
             </property>
         </bean>
[/relying-party.xml]

and

[attribute-filter.xml]
     <!-- test-sp01 -->
     <AttributeFilterPolicy id="test-sp01">
         <PolicyRequirementRule xsi:type="Requester" 
value="https://test-sp01.XXXXXXX/shibboleth" />
         <AttributeRule attributeID="givenName" permitAny="true"/>
         <AttributeRule attributeID="surname" permitAny="true"/>
         <AttributeRule attributeID="mail" permitAny="true"/>
         <AttributeRule attributeID="organizationName" permitAny="true"/>
     </AttributeFilterPolicy>
[/attribute-filter.xml]



Thanks in advance for any hints or points to some tutorial or 
documentation I missed!

Best regards,
    Markus