Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-04-10 16:02 CEST]:
> I already have metadata for an SP in the /opt/shibboleth/metadata directory
> and in the metadata.conf file.  Recall that I had the SP data from that
> other IdP (and I checked and it has SPSSO...), but would that SP be active
> automatically?  Or do I have to run that script that you mentioned?

If you've told the IDP to look for that metadata document (by
configuring a MetadataProvider) and since restarted the IDP it would
know the SP. (Checking logs is always an option to verify but I
suppose you haven't gotten there either, yet.)

> I just tried the script and it fails because my IdP is not on localhost
> port 443

That's not the source of whatever error you're experiencing:
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511365/WebInterfaces
I.e., it expects to find your IDP on localhost port 80 at path /idp.
If that doesn't match your deployment choices you can either use the
means provided by the IDP (see URL above) or change your deployment
accordingly.

> so I think I figured out how to still run it specifying a URL, but
> then it having a cert chain error.
> 
> I've tried using the parameter for pointing to the script to a
> trustore containing the CA that issued my IdPs server cert, but that
> isn't working either.

Just make your Java servlet container (if that's what you're using as
webserver as well, otherwise the web server you're proying to the IDP
from) also listen on the loopback interface on port 80.

If that's not "possible" somehow then use the `-k` parameter the aacli
offers to ignore security errors when connecting to localhost:443.

-peter