IdP metadata missing items after IdP installation

[o haya]

Hi,

I installed Shibboleth IdP, and also OpenDJ LDAP earlier, and thus far,
after setting the values in the IdP ldap.properties, I have just been
testing the IdP,  with the status test URL, and with the Hello World app,
which both seem to be working (thanks to help from some of you all).

However, when I was looking at the metadata file that was produced (in
/opt/shibboleth-idp/metadata), it seems to be missing some information
(e.g., EntityID is missing) and also the metadata file fails to parse
(i.e., xmllint --format fails), so I am reviewing the documentation at
"Typical next steps" at:

https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199500577/Installation

When I ran the install.sh previously, I did not use any command line
options on the install.sh command line, but according to my notes, I just
hit ENTER for each of the prompts, including when it prompted for "SAML
EntityID", which had a default value ("https://idp01.xxx.com/idp/shibboleth").


Should I have explicitly used a command line options, e.g., "-e
https://idp01.xxx.com/idp/shibboleth", etc., and the other options, such as
"-h idp01.xxx.com", as shown on that web page?

Also, I have a question about the order of the steps under the section
labelled "Typical Next Steps".  If I get through steps 1-3 and the Hello
World app works, is that indicative that the IdP should be functional?  Or
is there still additional configuration that needs to be done?

FYI, here's the metadata:

<!--
>  This is example metadata only. Do *NOT* supply it as is without review,
> and do *NOT* provide it in real time to your partners.
> This metadata is not dynamic - it will not change as your configuration
> changes.
> On Demand Metadata Generation available from the metadatagen plugin.
> -->
> <md:EntityDescriptorentityID="https://idp01.xxx.com/idp/shibboleth"
> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
> xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:ds="
> http://www.w3.org/2000/09/xmldsig#">
>     <md:IDPSSODescriptor
> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
>         <md:Extensions>
>             <shibmd:Scope regexp="false">xxx.com</shibmd:Scope>
>             <mdui:UIInfo>
>                 <mdui:DisplayName xml:lang="en">A name for the IdP at
> idp01.xxx.com</mdui:DisplayName>
>                 <mdui:Description xml:lang="en">Enter a description for
> the IdP at idp01.xxx.com</mdui:Description>
>                 <mdui:Logo xml:lang="en" width="80" height="80">
> https://idp01.xxx.com/path/to/logo.png</mdui:Logo>
>             </mdui:UIInfo>
>         </md:Extensions>
>         <md:KeyDescriptor use="signing">
>             <ds:KeyInfo>
>                 <ds:X509Data>
>                     <ds:X509Certificate>
>
> MIIEJzCCAo+gAwIBAgIUN3JmGSnQ/O73gK1G+6ehWixnxhYwDQYJKoZIhvcNAQELBQAwGjEYMBYG
>
> A1UEAwwPaWRwMDEuamxmb28uY29tMB4XDTI1MDMyNDIyMDkwMFoXDTQ1MDMyNDIyMDkwMFowGjEY
> .
> .
>
> d9ocJZn8Dk+AzFCiAyWH9r3GC92iPnuNiaGQe/BiBKpg7q67NTZOotqQpCefZc5JGy3XPfIKux+H
> eHRW0JDz1IR9J25KvQZk2d7iFZgKCp+w2VNEEmr/Zh+/F3nt5D9syFY=
>                     </ds:X509Certificate>
>                 </ds:X509Data>
>             </ds:KeyInfo>
>         </md:KeyDescriptor>
>         <md:KeyDescriptor use="signing">
>             <ds:KeyInfo>
>                 <ds:X509Data>
>                     <ds:X509Certificate>
>
> MIIEKDCCApCgAwIBAgIVAPFl3fw+x/m+XslpiBHxk9+3Fra1MA0GCSqGSIb3DQEBCwUAMBoxGDAW
>
> BgNVBAMMD2lkcDAxLmpsZm9vLmNvbTAeFw0yNTAzMjQyMjA4NTZaFw00NTAzMjQyMjA4NTZaMBox
> .
> .
>
> N5FXtWNTziQXEi0uCzo2aVTJYkKiwb5Ez19fDLX2pv18X8MmDumbpnnDUbCzh+vHQREq1c9MjIMk
> esL3mG7lx7h54ZK32tAcQLT0jLqfDoxxxuPTyWtT6vQR8mZ/49Hr8vEY
>                     </ds:X509Certificate>
>                 </ds:X509Data>
>             </ds:KeyInfo>
>         </md:KeyDescriptor>
>         <md:KeyDescriptor use="encryption">
>             <ds:KeyInfo>
>                 <ds:X509Data>
>                     <ds:X509Certificate>
>
> MIIEJzCCAo+gAwIBAgIUYqnMS2GbelkEvwvQLjDUs0n77UkwDQYJKoZIhvcNAQELBQAwGjEYMBYG
> .
> .
>
> +7cUTqwOe1vmVPqScbnS1W8OrP8CSSecpSr5qySPuCMoexZz3AGHJFdR4XdKgvYba9J3jRyoYz2q
> 0/1bQSSFNZxWcQZCFI+gVvq9KRBI6S3Q9m6I222Je6DjdDK4Ff5Y2jI=
>                     </ds:X509Certificate>
>                 </ds:X509Data>
>             </ds:KeyInfo>
>         </md:KeyDescriptor>
>         <md:SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="
> https://idp01.xxx.com/idp/profile/SAML2/SOAP/ArtifactResolution" />
>         <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
> Location="https://idp01.xxx.com/idp/profile/SAML2/POST-SimpleSign/SSO" />
>         <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> https://idp01.xxx.com/idp/profile/SAML2/Redirect/SSO" />
>         <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://idp01.xxx.com/idp/profile/SAML2/POST/SSO" />
>     </md:IDPSSODescriptor>
>
> </md:EntityDescriptor>


Thanks again,
Jim




<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250405/62f0bde6/attachment.htm>