IdP metadata missing items after IdP installation

[o haya]

Hi Brent,

Ah, ok, thanks... I will get the 5.1.4 and try the build again.

Answering your question, no there wasn't anything else specifically...
frankly, I didn't even think of a bug and thought I had somehow misread the
documentation :(....

Re. authentication, etc., I've already asked here what they want, but will
go with the default until I hear back from them.

Thanks again!

Jim

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Sat, Apr 5, 2025 at 10:48 PM Brent Putman via users <users at shibboleth.net>
wrote:

>
> On 4/5/25 8:41 PM, o haya via users wrote:
>
> Hi,
>
> I installed Shibboleth IdP,
>
> See below, but presumably you installed 5.1.3?  You'll want to update to
> 5.1.4 just to avoid any other bugs that were fixed, aside from the one
> below.
>
>
>
> However, when I was looking at the metadata file that was produced (in
> /opt/shibboleth-idp/metadata), it seems to be missing some information
> (e.g., EntityID is missing)
>
>
> The "missing" entityID is the only thing you specifically mention and
> that's due to this bug:
>
> https://shibboleth.atlassian.net/browse/OSJ-409
>
> which was fixed in the recent 5.1.4 patch. It's actually there in your
> example, just without the space between element name and attribute:
>
> <md:EntityDescriptorentityID="https://idp01.xxx.com/idp/shibboleth"  ...
>
> You can fix by simply adding a space: <md:EntityDescriptor entityID=...
>
>
> and also the metadata file fails to parse (i.e., xmllint --format fails),
>
>
> What were the specific error messages, etc?
>
>
>
> Should I have explicitly used a command line options, e.g., "-e
> https://idp01.xxx.com/idp/shibboleth", etc., and the other options, such
> as "-h idp01.xxx.com", as shown on that web page?
>
>
> Not those 2 specific ones for the entityID issue, that was simply a bug.
> (You'd use those if you wanted the domain name and/or entityID to be
> something other than based on the hostname of the machine you are
> installing on, such as when you install on a multi-node cluster. Or just
> want to "virtualize" things to be not based on the physical name).
>
>
>
> Also, I have a question about the order of the steps under the section
> labelled "Typical Next Steps".  If I get through steps 1-3 and the Hello
> World app works, is that indicative that the IdP should be functional?  Or
> is there still additional configuration that needs to be done?
>
>
> I think for basic functionality testing (no config mistakes, etc), that's
> all you need.
>
> Of course, for real-world use you have to install actual metadata for
> actual SPs; configure authN the way you want actual users to authenticate;
> configure attribute resolution for attributes needed/requested by the
> actual SPs, including attribute release policies; etc.
>
>
>
> FYI, here's the metadata:
>
>
> Aside from the entityID bug, I don't offhand see anything wrong there.
> (But I could just be missing).  Was there something else specific that you
> were expecting to see that isn't there?
>
> The generated metadata is just a starter template. It's not necessarily
> expected that you give that out to SPs or federations as-is. For some
> things you configure or enable in the IdP, you'd have to adjust the
> generated metadata accordingly.
>
> --Brent
>
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250406/94039d33/attachment.htm>