Can't understand error messages

[Daniele Albrizio]

Yes, the full metadata-providers.xml is

<?xml version="1.0" encoding="UTF-8"?>
<!-- This file is an EXAMPLE metadata configuration file. -->
<MetadataProvider id="ShibbolethMetadata" 
xsi:type="ChainingMetadataProvider"
     xmlns="urn:mace:shibboleth:2.0:metadata"
     xmlns:resource="urn:mace:shibboleth:2.0:resource"
     xmlns:security="urn:mace:shibboleth:2.0:security"
     xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata 
http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
                         urn:mace:shibboleth:2.0:resource 
http://shibboleth.net/schema/idp/shibboleth-resource.xsd
                         urn:mace:shibboleth:2.0:security 
http://shibboleth.net/schema/idp/shibboleth-security.xsd
                         urn:oasis:names:tc:SAML:2.0:metadata 
http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd">

       <MetadataProvider id="Jobiri-MD" 
xsi:type="FileBackedHTTPMetadataProvider"
backingFile="/opt/shibboleth-idp/metadata/jobiri-metadata.xml"
metadataURL="https://units.jobiri.com/simplesaml/module.php/saml/sp/metadata.php/units-sp">
             <MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
                 </MetadataFilter>
      </MetadataProvider>
</MetadataProvider>

This is the full jetty log.

https://pastebin.com/pfwmW9Nc

It seems no other things concerning directly shibboleth are up the log.


On 18/11/19 14:04, Peter Schober wrote:
> * Daniele Albrizio <albrizio at units.it> [2019-11-18 12:23]:
>> Responsible metadata-providers.xml configuration (without this conf the IdP
>> starts successfully):
>>
>>      <MetadataProvider id="Jobiri-MD"
>> xsi:type="FileBackedHTTPMetadataProvider"
>> backingFile="/opt/shibboleth-idp/metadata/jobiri-metadata.xml"
>>              metadataURL="https://<SOME_URL_OF_MINE>">
>>              <MetadataFilter xsi:type="EntityRoleWhiteList">
>>                  <!-- Consume all and only SP metadata in the aggregate -->
>> <RetainedRole>md:SPSSODescriptor</RetainedRole>
>>              </MetadataFilter>
>>      </MetadataProvider>
> Does your surrounding chaining MetadataProvider in
> conf/metadata-providers.xml define the "md" XML namespace prefix
> (xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata")?
> Otherwise the above isn't valid XML.
>
> If that's not it I'd look for earlier WARN and/or ERROR messages in
> the log.
>
> Also (and fully unrelated) note that without a signature validation
> filter the above is possibly not really secure (with only TLS as
> protection, which does not provide integrity and authenticity on the
> document level).
>
> -peter

-- 
Daniele ALBRIZIO - daniele.albrizio at units.it
          Tel. +39-040.558.3319
   UNIVERSITY OF TRIESTE - Network Services
      Unita' di Staff Reti di Ateneo
via Alfonso Valerio, 12 I-34127 Trieste, Italy

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3609 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20191118/05d5fbbd/attachment.p7s>