Newbie question - how to test a new shibboleth installation

[David Dellinger]

Hi again, Shib Users,

Someone at InCommon showed me how to run the curl on the container.
# podman exec -it 270a7aac015c curl -k https://127.0.0.1/idp/status

Does this look correct? I was expecting HTML output.

===================
# podman exec -it 54d824b363c0 curl -k https://127.0.0.1/idp/status
### Operating Environment Information
operating_system: Linux
operating_system_version: 5.15.0-103.114.4.el9uek.x86_64
operating_system_architecture: amd64
jdk_version: 11.0.19
available_cores: 4
used_memory: 149 MB
maximum_memory: 3000 MB

### Identity Provider Information
idp_version: 4.3.1
start_time: 2023-08-15T15:56:03.634Z
current_time: 2023-08-15T15:58:26.888727Z
uptime: PT2M23.254S

enabled modules:
idp.authn.Password (Password Authentication)
idp.admin.Hello (Hello World)

installed plugins:

service: shibboleth.LoggingService
last successful reload attempt: 2023-08-15T15:55:58.538299Z
last reload attempt: 2023-08-15T15:55:58.538299Z

service: shibboleth.AttributeFilterService
last successful reload attempt: 2023-08-15T15:56:01.681255Z
last reload attempt: 2023-08-15T15:56:01.681255Z

service: shibboleth.AttributeResolverService
last reload attempt: 2023-08-15T15:56:01.787520Z

No Data Connector has ever failed

service: shibboleth.AttributeRegistryService
last successful reload attempt: 2023-08-15T15:56:00.817894Z
last reload attempt: 2023-08-15T15:56:00.817894Z

service: shibboleth.NameIdentifierGenerationService
last successful reload attempt: 2023-08-15T15:56:02.174581Z
last reload attempt: 2023-08-15T15:56:02.174581Z

service: shibboleth.RelyingPartyResolverService
last successful reload attempt: 2023-08-15T15:56:02.259009Z
last reload attempt: 2023-08-15T15:56:02.259009Z

service: shibboleth.MetadataResolverService
last successful reload attempt: 2023-08-15T15:56:01.113745Z
last reload attempt: 2023-08-15T15:56:01.113745Z

No Metadata Resolver has ever attempted a reload

service: shibboleth.ReloadableAccessControlService
last successful reload attempt: 2023-08-15T15:56:02.727162Z
last reload attempt: 2023-08-15T15:56:02.727162Z

service: shibboleth.ReloadableCASServiceRegistry
last successful reload attempt: 2023-08-15T15:56:02.800181Z
last reload attempt: 2023-08-15T15:56:02.800181Z

service: shibboleth.ManagedBeanService
last successful reload attempt: 2023-08-15T15:56:02.825529Z
last reload attempt: 2023-08-15T15:56:02.825529Z

#
=======================

I really appreciate all the help that I've received!

*David Dellinger *| Sr. Systems Administrator

*Information Technology Services*ddellinger at oxy.edu | T 323-259-1315

*OXY*
*Occidental College*Mary Norton Clapp Library | 1600 Campus Road  |  Los
Angeles, California 90041
oxy.edu/its


On Mon, Aug 14, 2023 at 10:54 AM David Dellinger <ddellinger at oxy.edu> wrote:

> Hi David,
>
> Thanks for your reply.
> Yes, it's published on port 443. Good thinking to check though!
>
> # podman port -l
> 443/tcp -> 0.0.0.0:443
>
> *David Dellinger *| Sr. Systems Administrator
>
> *Information Technology Services*ddellinger at oxy.edu | T 323-259-1315
>
> *OXY*
> *Occidental College*Mary Norton Clapp Library | 1600 Campus Road  |  Los
> Angeles, California 90041
> oxy.edu/its
>
>
> On Mon, Aug 14, 2023 at 10:26 AM IAM David Bantz <dabantz at alaska.edu>
> wrote:
>
>> Is your IdP servlet perhaps on a different port (8443 is common)?
>>
>> If so, then something like curl -s -k 'https://localhost:8443/idp/status
>> <https://localhost/idp/status>’
>>
>> Haven’t followed this thread carefully, so apologies if this is not
>> helpful.
>>
>> David St Pierre Bantz
>>
>> On Aug 14, 2023 at 08:55:44, David Dellinger via users <
>> users at shibboleth.net> wrote:
>>
>>> Agreed. Thanks!
>>> I viewed the access-control.xml file from the running container and see
>>> that it is indeed allowing localhost.
>>>
>>>         <entry key="AccessByIPAddress">
>>>             <bean id="AccessByIPAddress"
>>> parent="shibboleth.IPRangeAccessControl"
>>>                 p:allowedRanges="#{ {'127.0.0.1/32', '::1/128'} }" />
>>>         </entry>
>>>
>>> I don't want to allow more hosts than necessary. I do want to check the
>>> installation before moving forward.
>>> It might be what Paul mentioned earlier in the thread about NAT. The
>>> status page might be viewable only from within the container's localhost.
>>> I'm seeing a new podman0 interface, but I get a 404 from a tomcat
>>> instance when I hit that interface. It's at least not an access denied
>>> message. I don't have tomcat running at the VM level, so I think I'm
>>> hitting tomcat inside the container.
>>>
>>> *David Dellinger *| Sr. Systems Administrator
>>>
>>> *Information Technology Services*ddellinger at oxy.edu | T 323-259-1315
>>>
>>> *OXY*
>>> *Occidental College*Mary Norton Clapp Library | 1600 Campus Road  |
>>>  Los Angeles, California 90041
>>> oxy.edu/its
>>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230815/ce292b92/attachment.htm>