IdP metadata missing items after IdP installation

[Brent Putman]

On 4/5/25 8:41 PM, o haya via users wrote:
> Hi,
>
> I installed Shibboleth IdP,

See below, but presumably you installed 5.1.3?  You'll want to update 
to 5.1.4 just to avoid any other bugs that were fixed, aside from the 
one below.


>
> However, when I was looking at the metadata file that was produced 
> (in /opt/shibboleth-idp/metadata), it seems to be missing some 
> information (e.g., EntityID is missing)


The "missing" entityID is the only thing you specifically mention and 
that's due to this bug:

https://shibboleth.atlassian.net/browse/OSJ-409

which was fixed in the recent 5.1.4 patch. It's actually there in your 
example, just without the space between element name and attribute:

> <md:EntityDescriptorentityID="https://idp01.xxx.com/idp/shibboleth" ...

You can fix by simply adding a space: <md:EntityDescriptor entityID=...


> and also the metadata file fails to parse (i.e., xmllint --format 
> fails), 


What were the specific error messages, etc?



> Should I have explicitly used a command line options, e.g., "-e 
> https://idp01.xxx.com/idp/shibboleth", etc., and the other options, 
> such as "-h idp01.xxx.com <http://idp01.xxx.com>", as shown on that 
> web page?


Not those 2 specific ones for the entityID issue, that was simply a 
bug. (You'd use those if you wanted the domain name and/or entityID to 
be something other than based on the hostname of the machine you are 
installing on, such as when you install on a multi-node cluster. Or 
just want to "virtualize" things to be not based on the physical name).


>
> Also, I have a question about the order of the steps under the 
> section labelled "Typical Next Steps".  If I get through steps 1-3 
> and the Hello World app works, is that indicative that the IdP should 
> be functional?  Or is there still additional configuration that needs 
> to be done?


I think for basic functionality testing (no config mistakes, etc), 
that's all you need.

Of course, for real-world use you have to install actual metadata for 
actual SPs; configure authN the way you want actual users to 
authenticate; configure attribute resolution for attributes 
needed/requested by the actual SPs, including attribute release 
policies; etc.


>
> FYI, here's the metadata:


Aside from the entityID bug, I don't offhand see anything wrong there. 
(But I could just be missing).  Was there something else specific that 
you were expecting to see that isn't there?

The generated metadata is just a starter template. It's not necessarily 
expected that you give that out to SPs or federations as-is. For some 
things you configure or enable in the IdP, you'd have to adjust the 
generated metadata accordingly.

--Brent


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250405/898ad713/attachment.htm>