Using Shibboleth with radius

[Mak, Steven]

Christoph,

One of the most common issues when upgrading from Shib SP 2.x to Shib SP 3.x is that the shibboleth2.xml file has this in the xmlns declarations at the top:

xmlns="urn:mace:shibboleth:2.0:native:sp:config"
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"

and they need to be replaced with a 3.0 namespace. You should take a look at the shipped version of the file and compare your XML declarations.

- Steve

From: users <users-bounces at shibboleth.net> on behalf of Christoph Pleger via users <users at shibboleth.net>
Date: Monday, July 21, 2025 at 4:15 AM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Christoph Pleger <Christoph.Pleger at cs.tu-dortmund.de>
Subject: Using Shibboleth with radius
Hello,

I upgraded a machine with a very old Debian OS version to a newer, but
still old Debian version, thereby going from shibboleth 2.6.0 to 3.0.4.
Unfortunately, though shibd starts with the old configuration file, the
apache does not work like expected anymore, but the corresponding web
page shows in the browser:

Unknown or Unusable Identity Provider

The identity provider supplying your login credentials is not
authorized for use with this service or does not support the necessary
capabilities.

To report this problem, please contact the site administrator at
root at localhost.

Please include the following error message in any email:

Identity provider lookup failed at
(https://example.tu-dortmund.de/otrs/index.pl/index.pl)

EntityID: https://idp.example.org/idp/shibboleth

opensaml::saml2md::MetadataException: Unable to locate metadata for
identity provider (https://idp.example.org/idp/shibboleth)

Please help. I attached the configuration file (with DNS names
replaced), I hope that it helps to understand how the whole thing
should work ..

Regards
  Christoph
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250721/ba081470/attachment.htm>