IdP metadata missing items after IdP installation

[o haya]

Hi Brent et al,

I was able to rebuild using the Shibboleth IdP V5.1.4, and now the IdP
metadata looks good!  COOL ;)!!!

Thanks!

Jim

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Sun, Apr 6, 2025 at 12:42 AM o haya <ohaya1001 at gmail.com> wrote:

> Hi Brent,
>
> Ah, ok, thanks... I will get the 5.1.4 and try the build again.
>
> Answering your question, no there wasn't anything else specifically...
> frankly, I didn't even think of a bug and thought I had somehow misread the
> documentation :(....
>
> Re. authentication, etc., I've already asked here what they want, but will
> go with the default until I hear back from them.
>
> Thanks again!
>
> Jim
>
>
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
> Virus-free.www.avast.com
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
> <#m_4732576070038392087_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
>
> On Sat, Apr 5, 2025 at 10:48 PM Brent Putman via users <
> users at shibboleth.net> wrote:
>
>>
>> On 4/5/25 8:41 PM, o haya via users wrote:
>>
>> Hi,
>>
>> I installed Shibboleth IdP,
>>
>> See below, but presumably you installed 5.1.3?  You'll want to update to
>> 5.1.4 just to avoid any other bugs that were fixed, aside from the one
>> below.
>>
>>
>>
>> However, when I was looking at the metadata file that was produced (in
>> /opt/shibboleth-idp/metadata), it seems to be missing some information
>> (e.g., EntityID is missing)
>>
>>
>> The "missing" entityID is the only thing you specifically mention and
>> that's due to this bug:
>>
>> https://shibboleth.atlassian.net/browse/OSJ-409
>>
>> which was fixed in the recent 5.1.4 patch. It's actually there in your
>> example, just without the space between element name and attribute:
>>
>> <md:EntityDescriptorentityID="https://idp01.xxx.com/idp/shibboleth"  ...
>>
>> You can fix by simply adding a space: <md:EntityDescriptor entityID=...
>>
>>
>> and also the metadata file fails to parse (i.e., xmllint --format fails),
>>
>>
>> What were the specific error messages, etc?
>>
>>
>>
>> Should I have explicitly used a command line options, e.g., "-e
>> https://idp01.xxx.com/idp/shibboleth", etc., and the other options, such
>> as "-h idp01.xxx.com", as shown on that web page?
>>
>>
>> Not those 2 specific ones for the entityID issue, that was simply a bug.
>> (You'd use those if you wanted the domain name and/or entityID to be
>> something other than based on the hostname of the machine you are
>> installing on, such as when you install on a multi-node cluster. Or just
>> want to "virtualize" things to be not based on the physical name).
>>
>>
>>
>> Also, I have a question about the order of the steps under the section
>> labelled "Typical Next Steps".  If I get through steps 1-3 and the Hello
>> World app works, is that indicative that the IdP should be functional?  Or
>> is there still additional configuration that needs to be done?
>>
>>
>> I think for basic functionality testing (no config mistakes, etc), that's
>> all you need.
>>
>> Of course, for real-world use you have to install actual metadata for
>> actual SPs; configure authN the way you want actual users to authenticate;
>> configure attribute resolution for attributes needed/requested by the
>> actual SPs, including attribute release policies; etc.
>>
>>
>>
>> FYI, here's the metadata:
>>
>>
>> Aside from the entityID bug, I don't offhand see anything wrong there.
>> (But I could just be missing).  Was there something else specific that you
>> were expecting to see that isn't there?
>>
>> The generated metadata is just a starter template. It's not necessarily
>> expected that you give that out to SPs or federations as-is. For some
>> things you configure or enable in the IdP, you'd have to adjust the
>> generated metadata accordingly.
>>
>> --Brent
>>
>>
>>
>> --
>> For Consortium Member technical support, see
>> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250406/1571470c/attachment.htm>