Unknown or Unusable Identity Provider for Shib 3.2 SP

[Peter Schober]

Steve Platz via users <users at shibboleth.net> [2024-06-03 19:05 CEST]:
> We're having issues after upgrading the SAML (php) IdP to 2.0,
> although from everything I can tell, the Shib server is not even
> making a request to the IdP for metadata, just returns a 500
> /auth/shibboleth/index.php.

Why would the Shibboleth SP ask the IDP for its metadata? Did you
configure the SP software with a MetadataProvider pointing to the IDP
server? While that's probably not a good idea security wise that can
certainly work. The SP's log files would tell you what metadata the SP
consumes and whether updating it from a remote URL was successful or
not.

And who or what "returns a 500 /auth/shibboleth/index.php"?  The
webserver hosting the Shib SP software? How is that web server
configured with regards to requests to that path?

> If we had a request to debug, this wold be easier, but I feel like
> we need to look for some sort of misconfiguration on the SP side of
> the equation.

Log files.

HTH,
-peter