Unable to locate metadata

Julien Cochennec julien.cochennec at ac-orleans-tours.fr
Wed Sep 23 09:13:56 UTC 2020


Hi,

I read many posts about this problem on the list.

The error most of the time is a wrong path in the shibboleth2.xml of the 
sp or a wronf EntityId in the metadata of the IDP.

I checked both, but I still get this error :

    Unable to locate metadata for identity provider
    (http://idp.docker.localhost/idp/shibboleth)
    Unknown or Unusable Identity Provider
    The identity provider supplying your login credentials is not
    authorized for use with this service or does not support the
    necessary capabilities.
    To report this problem, please contact the site administrator at
    admin at idp.docker.localhost <mailto:admin at idp.docker.localhost>.
    Please include the following error message in any email:
    Identity provider lookup failed at (http://sp.docker.localhost/secure)
    *EntityID:* http://idp.docker.localhost/idp/shibboleth

    opensaml::saml2md::MetadataException: Unable to locate metadata for
    identity provider (http://idp.docker.localhost/idp/shibboleth)


Do you see something wrong with any of these files? Thanks for your help.

My shibboleth2.xml on the sp is this :

<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
     xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
     xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
     clockSkew="180">

     <!-- The ApplicationDefaults element is where most of Shibboleth's 
SAML bits are defined. -->
     <ApplicationDefaults 
entityID="http://sp.docker.localhost/idp/shibboleth" REMOTE_USER="eppn 
uid persistent-id targeted-id">

         <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                   checkAddress="false" handlerSSL="true" 
cookieProps="https">

             <SSO entityID="http://idp.docker.localhost/idp/shibboleth">
               SAML2
             </SSO>

             <!-- SAML and local-only logout. -->
             <Logout>SAML2 Local</Logout>

             <!-- Extension service that generates "approximate" 
metadata based on SP configuration. -->
             <Handler type="MetadataGenerator" Location="/Metadata" 
signing="false"/>

             <!-- Status reporting service. -->
             <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

             <!-- Session diagnostic service. -->
             <Handler type="Session" Location="/Session" 
showAttributeValues="false"/>

             <!-- JSON feed of discovery information. -->
             <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
         </Sessions>

         <!--
         Allows overriding of error template information/filenames. You can
         also add attributes with values that can be plugged into the 
templates.
         -->
         <Errors supportContact="admin at idp.docker.localhost"
             helpLocation="/about.html"
             styleSheet="/shibboleth-sp/main.css"/>

         <MetadataProvider type="XML" validate="true" 
path="metadata/idp-metadata.xml" legacyOrgNames="true"/>

         <!-- Map to extract attributes from SAML assertions. -->
         <AttributeExtractor type="XML" validate="true" 
reloadChanges="false" path="attribute-map.xml"/>

         <!-- Use a SAML query if no attributes are supplied during SSO. -->
         <AttributeResolver type="Query" subjectMatch="true"/>

         <!-- Default filtering policy for recognized attributes, lets 
other data pass. -->
         <AttributeFilter type="XML" validate="true" 
path="attribute-policy.xml"/>

         <!-- Simple file-based resolver for using a single keypair. -->
         <CredentialResolver type="File" key="/run/secrets/sp_key" 
certificate="credentials/sp-cert.pem"/>

     </ApplicationDefaults>

     <!-- Policies that determine how to process and authenticate 
runtime messages. -->
     <SecurityPolicyProvider type="XML" validate="true" 
path="security-policy.xml"/>

     <!-- Low-level configuration about protocols and bindings available 
for use. -->
     <ProtocolProvider type="XML" validate="true" reloadChanges="false" 
path="protocols.xml"/>

</SPConfig>

My IDP metadata is this :

<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor  xmlns="urn:oasis:names:tc:SAML:2.0:metadata" 
xmlns:ds="http://www.w3.org/2000/09/xmldsig#" 
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" 
xmlns:xml="http://www.w3.org/XML/1998/namespace" 
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" 
xmlns:req-attr="urn:oasis:names:tc:SAML:protocol:ext:req-attr" 
validUntil="2020-07-02T09:04:27.274Z" 
entityID="http://idp.docker.localhost/idp/shibboleth">

     <IDPSSODescriptor 
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol 
urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">

         <!-- First signing certificate is BackChannel, the Second is 
FrontChannel -->
         <KeyDescriptor use="signing">
             <ds:KeyInfo>
                     <ds:X509Data>
                         <ds:X509Certificate>
***
                         </ds:X509Certificate>
                     </ds:X509Data>
             </ds:KeyInfo>

         </KeyDescriptor>
         <KeyDescriptor use="signing">
             <ds:KeyInfo>
                     <ds:X509Data>
                         <ds:X509Certificate>
***
                         </ds:X509Certificate>
                     </ds:X509Data>
             </ds:KeyInfo>

         </KeyDescriptor>
         <KeyDescriptor use="encryption">
             <ds:KeyInfo>
                     <ds:X509Data>
                         <ds:X509Certificate>
***
                         </ds:X509Certificate>
                     </ds:X509Data>
             </ds:KeyInfo>

         </KeyDescriptor>

         <SingleSignOnService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" 
req-attr:supportsRequestedAttributes="true" 
Location="http://idp.docker.localhost/idp/profile/SAML2/Redirect/SSO"/>
         <SingleSignOnService 
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" 
Location="http://idp.docker.localhost/idp/profile/Shibboleth/SSO"/>
         <SingleSignOnService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" 
req-attr:supportsRequestedAttributes="true" 
Location="http://idp.docker.localhost/idp/profile/SAML2/POST-SimpleSign/SSO"/>
         <SingleSignOnService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
req-attr:supportsRequestedAttributes="true" 
Location="http://idp.docker.localhost/idp/profile/SAML2/POST/SSO"/>

     </IDPSSODescriptor>


     <AttributeAuthorityDescriptor 
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">

         <Extensions>
             <shibmd:Scope regexp="false">docker.localhost</shibmd:Scope>
         </Extensions>

         <!-- First signing certificate is BackChannel, the Second is 
FrontChannel -->
         <KeyDescriptor use="signing">
             <ds:KeyInfo>
                     <ds:X509Data>
                         <ds:X509Certificate>
***
                         </ds:X509Certificate>
                     </ds:X509Data>
             </ds:KeyInfo>

         </KeyDescriptor>
         <KeyDescriptor use="signing">
             <ds:KeyInfo>
                     <ds:X509Data>
                         <ds:X509Certificate>
***
                         </ds:X509Certificate>
                     </ds:X509Data>
             </ds:KeyInfo>

         </KeyDescriptor>
         <KeyDescriptor use="encryption">
             <ds:KeyInfo>
                     <ds:X509Data>
                         <ds:X509Certificate>
***
                         </ds:X509Certificate>
                     </ds:X509Data>
             </ds:KeyInfo>

         </KeyDescriptor>

     </AttributeAuthorityDescriptor>

</EntityDescriptor>


-- 

Julien Cochennec
Pôle de compétences - gestion des identités

Mél julien.cochennec at ac-orleans-tours.fr

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200923/7fd0f0f3/attachment.htm>


More information about the users mailing list