Unable to locate metadata
Julien Cochennec
julien.cochennec at ac-orleans-tours.fr
Wed Sep 23 09:13:56 UTC 2020
Hi,
I read many posts about this problem on the list.
The error most of the time is a wrong path in the shibboleth2.xml of the
sp or a wronf EntityId in the metadata of the IDP.
I checked both, but I still get this error :
Unable to locate metadata for identity provider
(http://idp.docker.localhost/idp/shibboleth)
Unknown or Unusable Identity Provider
The identity provider supplying your login credentials is not
authorized for use with this service or does not support the
necessary capabilities.
To report this problem, please contact the site administrator at
admin at idp.docker.localhost <mailto:admin at idp.docker.localhost>.
Please include the following error message in any email:
Identity provider lookup failed at (http://sp.docker.localhost/secure)
*EntityID:* http://idp.docker.localhost/idp/shibboleth
opensaml::saml2md::MetadataException: Unable to locate metadata for
identity provider (http://idp.docker.localhost/idp/shibboleth)
Do you see something wrong with any of these files? Thanks for your help.
My shibboleth2.xml on the sp is this :
<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
clockSkew="180">
<!-- The ApplicationDefaults element is where most of Shibboleth's
SAML bits are defined. -->
<ApplicationDefaults
entityID="http://sp.docker.localhost/idp/shibboleth" REMOTE_USER="eppn
uid persistent-id targeted-id">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
checkAddress="false" handlerSSL="true"
cookieProps="https">
<SSO entityID="http://idp.docker.localhost/idp/shibboleth">
SAML2
</SSO>
<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>
<!-- Extension service that generates "approximate"
metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata"
signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session"
showAttributeValues="false"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<!--
Allows overriding of error template information/filenames. You can
also add attributes with values that can be plugged into the
templates.
-->
<Errors supportContact="admin at idp.docker.localhost"
helpLocation="/about.html"
styleSheet="/shibboleth-sp/main.css"/>
<MetadataProvider type="XML" validate="true"
path="metadata/idp-metadata.xml" legacyOrgNames="true"/>
<!-- Map to extract attributes from SAML assertions. -->
<AttributeExtractor type="XML" validate="true"
reloadChanges="false" path="attribute-map.xml"/>
<!-- Use a SAML query if no attributes are supplied during SSO. -->
<AttributeResolver type="Query" subjectMatch="true"/>
<!-- Default filtering policy for recognized attributes, lets
other data pass. -->
<AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/>
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="/run/secrets/sp_key"
certificate="credentials/sp-cert.pem"/>
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate
runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/>
<!-- Low-level configuration about protocols and bindings available
for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false"
path="protocols.xml"/>
</SPConfig>
My IDP metadata is this :
<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xml="http://www.w3.org/XML/1998/namespace"
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
xmlns:req-attr="urn:oasis:names:tc:SAML:protocol:ext:req-attr"
validUntil="2020-07-02T09:04:27.274Z"
entityID="http://idp.docker.localhost/idp/shibboleth">
<IDPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
<!-- First signing certificate is BackChannel, the Second is
FrontChannel -->
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
***
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
***
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<KeyDescriptor use="encryption">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
***
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
req-attr:supportsRequestedAttributes="true"
Location="http://idp.docker.localhost/idp/profile/SAML2/Redirect/SSO"/>
<SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location="http://idp.docker.localhost/idp/profile/Shibboleth/SSO"/>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
req-attr:supportsRequestedAttributes="true"
Location="http://idp.docker.localhost/idp/profile/SAML2/POST-SimpleSign/SSO"/>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
req-attr:supportsRequestedAttributes="true"
Location="http://idp.docker.localhost/idp/profile/SAML2/POST/SSO"/>
</IDPSSODescriptor>
<AttributeAuthorityDescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">
<Extensions>
<shibmd:Scope regexp="false">docker.localhost</shibmd:Scope>
</Extensions>
<!-- First signing certificate is BackChannel, the Second is
FrontChannel -->
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
***
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
***
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<KeyDescriptor use="encryption">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
***
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
</AttributeAuthorityDescriptor>
</EntityDescriptor>
--
Julien Cochennec
Pôle de compétences - gestion des identités
Mél julien.cochennec at ac-orleans-tours.fr
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200923/7fd0f0f3/attachment.htm>
More information about the users
mailing list