Fwd: Message Handler: No metadata returned for ...
Jozef Misutka
misutka at ufal.mff.cuni.cz
Mon Feb 19 08:15:30 UTC 2024
Dear all,
I would appreciate your help with the following IdP/SP test setup ending in
the IdP showing
Web Login Service - Unsupported Request
The application you have accessed is not registered for use with this
service.
# Setup overview:
Local machine, dev-5.pc, self signed certificate, nginx with built in
shibboleth support via docker on port 8443 and Idp on port 8444.
# What is happening:
Link
https://dev-5.pc:8443/Shibboleth.sso/Login?SAMLDS=1&entityID=https%3A%2F%2Fidptestbed%2Fidp%2Fshibboleth
correctly redirects to
https://dev-5.pc:8444/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZJPT4MwGMa%2FCumdFRiwrRkkuB1cMh0Z6MGLgfIqTaDFvmXqt5eNaaYxS3rr86fPL11i0TYdS3pTyz289YDG%2Bmgbiex0EZFeS6YKFMhk0QIyw1mW3G2ZN3FYp5VRXDXEShBBG6HkSknsW9AZ6IPg8LDfRqQ2pkNGaQUHO5h0nM19f0qzWpSlasDUE0RFj6EeTXdZTqz18Aohi2Pe%2F26fiqqjQ%2F2LaOBs3UMlNHBDs2xHrM06Is%2FBjIdV4fNgWjoOQBDMF3zqBAs%2BC6uwnC0GGWIPG4mmkCYinuP5tuPZbpi7M%2BYGw3kiVnpeeSNkJeTrdSTlKEJ2m%2BepPc55BI2nKYOAxMsjWHYq1heor8cW33xJ%2FJcHxR%2BQNnZLehE%2FdnXsfsjbrFPVCP5pJU2j3lcaCgMRcQmNR8vvPxB%2FAQ%3D%3D&RelayState=ss%3Amem%3A60e0bbf25c5d9d4f0e23f02856d72449f140ab04aa0f3ed8570ed3d9d7050752&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=gMHW9eEe4QsNpFQ8Dq7YXBFoRoEALTxm21HmChUZ788TFdoGaiQTGJbYCw6Btp8082OmM9Pakaj0XECdUABgJZiDdWpzLaP%2FaV4UW2s9w9mtDttqChRIUMgSSiVm7yWBpUstz9YDKQAGoBrKnzA88BR8I0oGKFnVreHxlzqEkHC5j9Ar7VbgxGcN0Bx59K8dIxdDluinq1C4dtJBida%2FT3osC4H%2FXd9h5RH%2Bk6oAi4XusCx89VXggIvI8hsdTdAnFWydMPsRxpZ0e7QiHBW%2FRNWgFljsQe2%2FCAq3B5W23vknXn%2FaPD%2BlLkQSFgqF8K%2BghTfBwWOCJAd5nLTE%2B8RupVbal08SC8sxgfgpmBsdDwajIe6XEXgTMc6KTP28z2bMyUw1CRK4b3D10b8a3BxQ7P9feQb7gV7DlPoyQrHvVW5H044ADue271caCNXKCSCeXiHh%2BptcVrkkqZvO%2Fs%2FawXbWAn3p0V2bRE%2Fm1STQrw278WZXFBMVbylsPBt0qmfi
but I get the above error
# More details
SP - (using https://github.com/ufal/dockerized-nginx-with-shibboleth) with
minor changes, seems this part is working so I will not add details unless
requested.
IdP- (using https://github.com/ufal/dockerized-idp-testbed based on
UniconLabs/dockerized-idp-testbed
<https://github.com/UniconLabs/dockerized-idp-testbed>)
conf/metadata-providers.xml contains
<MetadataProvider id="TestSP" xsi:type="FilesystemMetadataProvider"
metadataFile="%{idp.home}/metadata/sp-metadata.xml"/>
and sp-metadata.xml contains
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_bf63813d70b5f63a1d2a3504dca89b5e268be651" entityID="
https://dev-5.pc/shibboleth-sp">
<md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
<alg:DigestMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#sha384"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<alg:DigestMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#sha224"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
<alg:SigningMethod Algorithm="
http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1
"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1
"/>
</md:Extensions>
<md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
<md:Extensions>
<init:RequestInitiator
xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="
https://dev-5.pc:8443/Shibboleth.sso/Login"/>
</md:Extensions>
<md:KeyDescriptor>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>5a19262b8d15</ds:KeyName>
<ds:KeyName>dev-5.pc</ds:KeyName>
<ds:X509Data>
<ds:X509SubjectName>CN=5a19262b8d15</ds:X509SubjectName>
<ds:X509Certificate>MIID9jCCAl6gAwIBAgIUb8Cdg8DbUIQZ/B7yyBDZ22DicXIwDQYJKoZIhvcNAQEL
BQAwFzEVMBMGA1UEAxMMNWExOTI2MmI4ZDE1MB4XDTI0MDIxMzExNTU0MFoXDTM0
MDIxMDExNTU0MFowFzEVMBMGA1UEAxMMNWExOTI2MmI4ZDE1MIIBojANBgkqhkiG
9w0BAQEFAAOCAY8AMIIBigKCAYEAodAsbofq37kcwYdu7nYNqdbqjwV0OBKB0N1V
+2hMwq7PNZfyk/rUDq/5Dj098mePJuxkLv1FLgYcEqdQdH4KoX4WPdM3Q8kbTx2a
3TO29F63dIPdmzZnnKehN6T5dtrosPUS823rLbsGBUJpcpcgClFCo7IEt45NzfZO
p0Pms9R/W+Ox00/AXX5xCW0RQeOK5syA2zJ/qYYFcvBcKObppcASAqalRx18FAex
zRdndTbsvtdVHcyDvMSF8lrKK9MpEZaJoXtRhYNxgV5+eC0q6GpSoNHCdsunFKrg
gvT+SMXb21A1RdEn28pJNss+ta/OxSKhSXhm2CvrY4e9e4AccoWyf+fdN49eM9sL
bXxXALB0hFDAf1S5Fhnrb1Iz2BZpKLN/La2FC81iIFGf5E0j6TbLmhEwC7mWWFK5
N0i0R2H3y9Xzhz8mQVHoiqe0Q/t78LEzXaGgzspBhxZw8U0B9zWtEevtMlHieMBt
J8jaQWtlrVMZrMLdeajY+wgYWiARAgMBAAGjOjA4MBcGA1UdEQQQMA6CDDVhMTky
NjJiOGQxNTAdBgNVHQ4EFgQUCVoTgiuMBwOPogLk3xOImAIYHuIwDQYJKoZIhvcN
AQELBQADggGBAKGX4hfkU7Op8DDboTJXUK4hdm+kXKd9cb48Hb833Jffc3515XVX
ozRcm9qpm0/vY7E5HIaUiHk8hNIYdtGComJoCwS1gjcRz+jcpMK7srlN1lL8bgPN
qqQ5ixNoGRXBHvYTdBmRUBfHs78ZRhfSTQ/uDa4OL6RLIAhVWiKEcTH8+EgH+TDl
t64GHFin3NvxyoSxbOuR8P0HTUz4tsZLJHpAnhPbA3PzJ7spkXqSH/k5Um65PsKB
trCgAuEHdpEK9g8RmWdjPmWxcS5b2oJmUHx7Rg+cWTlQtqbFpk1Cl1ZWz4BZPPnd
ACH1M2h+uxVmAc06AiQZZKnsk5s/Z3h4PWBq/IJyo/v93wk9JvyYSpIktyZBFdsX
wB1M3AWfTC6rdgyYtRqRZdAHVfxlY2uehJPpmzQGPFJ04FrC7uoMhbYn8x1mMq9t
y0I8tTvmrjkbO+DJfmclL0WbV1aTS4NKyH2jijgk478o1HNoydc5JTOB5oIvkSfF
kou6kgk9qeTaEA==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2009/xmlenc11#aes192-gcm"/>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2009/xmlenc11#rsa-oaep"/>
<md:EncryptionMethod Algorithm="
http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
</md:KeyDescriptor>
<md:ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="
https://dev-5.pc:8443/Shibboleth.sso/Artifact/SOAP" index="1"/>
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="
https://dev-5.pc:8443/Shibboleth.sso/SLO/SOAP"/>
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
https://dev-5.pc:8443/Shibboleth.sso/SLO/Redirect"/>
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://dev-5.pc:8443/Shibboleth.sso/SLO/POST"/>
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="
https://dev-5.pc:8443/Shibboleth.sso/SLO/Artifact"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://dev-5.pc:8443/Shibboleth.sso/SAML2/POST" index="1"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="https://dev-5.pc:8443/Shibboleth.sso/SAML2/POST-SimpleSign"
index="2"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="
https://dev-5.pc:8443/Shibboleth.sso/SAML2/Artifact" index="3"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="
https://dev-5.pc:8443/Shibboleth.sso/SAML2/ECP" index="4"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="
https://dev-5.pc:8443/Shibboleth.sso/SAML/POST" index="5"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="
https://dev-5.pc:8443/Shibboleth.sso/SAML/Artifact" index="6"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>
# logs
nginx-1 | 192.168.88.32 - - [16/Feb/2024:17:11:53 +0000] "GET
/Shibboleth.sso/Login?SAMLDS=1&entityID=https%3A%2F%2Fidptestbed%2Fidp%2Fshibboleth
HTTP/1.1" 302 40 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" "-"
idp-1 | 2024-02-16 17:11:53,729 - 172.26.0.5 - INFO
[org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:129] -
Message Handler: No metadata returned for https://dev-5.pc/shibboleth-sp
in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol
urn:oasis:names:tc:SAML:2.0:protocol
idp-1 | 2024-02-16 17:11:53,731 - 172.26.0.5 - WARN
[net.shibboleth.idp.profile.impl.SelectProfileConfiguration:117] - Profile
Action SelectProfileConfiguration: Profile
http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for RP
configuration shibboleth.UnverifiedRelyingParty (RPID
https://dev-5.pc/shibboleth-sp)
idp-1 | 2024-02-16 17:11:53,732 - 172.26.0.5 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: InvalidProfileConfiguration
idp-1 | 172.26.0.5 - - [16/Feb/2024:17:11:53 +0000] "GET
/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZJdT4MwFIb%2FCuk9a2HsqxkkuF24ZCoZ6IU3psBBmrAWe8rUfy8b00xjdt33o%2B%2BTs0Sxb1oed7ZWO3jrAK3zsW8U8tNDSDqjuBYokSuxB%2BS24Gl8t%2BX%2BiPHWaKsL3RAnRgRjpVYrrbDbg0nBHGQBj7ttSGprW%2BSUlnBwJ6O24PMgGNO0lnmuG7D1CFHTY6hPk4c0I866%2F4VU4pj3vzugsmxpX1%2FJBs7WHZTSQGFpmj4QZ7MOyQublx4bg78Q05IJVi2YKBa5V%2BWBP5uzatrLEDvYKLRC2ZD4zA9c5rveNPNm3PP4ZPxMnOS88kaqUqrX60jyQYT8NssSd5jzBAZPU3oBiZZHsPxUbC5QX48V33xJ9JcHxR%2BQLrZLehE%2FdLX8vs%2FbrBPdyOLTiZtGv68MCAsh8QiNBsvvG4i%2BAA%3D%3D&RelayState=ss%3Amem%3Ad59d54d66ce58318641ea40b58c1286e9a9df1c807fa141d83aa2c8728466adb&SigAlg=http%3A%2F%
2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=g0LFX0a0KnR4vvWsrdrWESUT4Lt1cWB8ojM5IYRldozplHHE3JEn2efFI%2B%2BNEZB3IXPbzommZeWDo1y0h9NNkFkt1Npcg8nqEjAFdvWPnkaDg57iTdWqWFejmjX9Vg2Tq8bs%2B8Q5Sc4TnlCZlcBtW9wzewC4nfaYcREwoepOvpbOlcb589dwiVqFv54BmAexMMi34ImpTrrGEW3ZJoNtUFjG66xT4%2Bu%2BxJSjwBAvq10uGPMTlIJcUCLG4rxirJzT3C0DUIvL2QxU5Jsok8xV2h3Zrx%2B0PN9ClZcDHs7nOkzRqYhnyqUk1Nc%2FjzGngsW%2FshLjqA1ljqHlgedIbOgYWgUKCgISYyW%2F%2Fc9sJpDYzyTfXgbkJ1Fh%2FOIhGza0OHu9bMAWSeTOtz215mnUA6NWz9yFTQAd0yrjr0qMeo8WskSiBPSFzgp%2BAQpK8ZGTHoS2JtlP4DEbc%2FP4o2Whj7VcsbQIttBLw9VHcoaIbI%2BTKTdhJlQXdAw3r7JJKHZqXZsy
HTTP/1.1" 400 901 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
Thank you,
Jozef
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240219/237c9462/attachment.htm>
More information about the users
mailing list