Problem trying to add an additional partner to my Shibboleth IdP

[o haya]

Hi,

I found the problem.  There was a section in the attribute-filter.xml file
where the "Requester" value was different between the new and old partners.

I don't know if this was the "right" way to fix the problem, but I
replicated that section... so I ended up with 2 sections, with different
"Requester" values.

After that, testing from both partners is now working.

On Sat, May 3, 2025 at 7:54 AM o haya <ohaya1001 at gmail.com> wrote:

> Hi,
>
> I have been testing with the Shibboleth IdP that I got setup a while ago
> (thanks to help from people here!), and everything has been working ok, but
> now, we want to add an additional partner.
>
> Both the original partner and the new partner will use the same users and
> passwords from the OpenDJ LDAP server that is hosted on the same machine
> where the Shibboleth IdP is hosted.
>
> Also, the original partner and the new partner (from the partner side) are
> essentially/structurally similar, excerpt they have different entityID, etc.
>
> So I got the metadata from the new partner and put it into the
> /opt/shibboleth/metadata directory, and updated the
> /opt/shibboleth/conf/metadata-providers.xml file:
>
>     <!-- FOR Metadata from ORIGINAL PARTNER -->
>>     <MetadataProvider id="LocalMetadata"
>>  xsi:type="FilesystemMetadataProvider"
>> metadataFile="/opt/shibboleth-idp/metadata/ORIGINALIDPMetadata.xml"/>
>>     <!-- ADDED FOR NEW Metadata from NEW PARTNER -->
>>     <MetadataProvider id="NEWLocalMetadata"
>>  xsi:type="FilesystemMetadataProvider"
>> metadataFile="/opt/shibboleth-idp/metadata/NEWIDPMetadata.xml"/>
>
>
> Is there anything else that I need to do on the Shibboleth IdP in order to
> get the new partner working?
>
> I am asking because after made the changes to the metadata directory and
> the metadata-providers.xml, I bounced the Shibboleth IdP and tested with
> requests from both partners and:
>
> - The test using the original partner is working as it did before the
> change, but
> - The test using the new partner is failing and I am seeing the following
> in the idp-process.log file:
>
>     <saml2p:Status>
>>         <saml2p:StatusCode
>> Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
>>             <saml2p:StatusCode
>> Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy"/>
>>         </saml2p:StatusCode>
>>         <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
>>     </saml2p:Status>
>>
>>
> I don't see any errors in the idp-warn.log or in the idp-process.log files.
>
> As mentioned, both partners are very similar, and they are both sending
> their theoretically-similar requests to the same/single Shibboleth IdP, so
> what else could cause one to work and one to fail with the NameIDFormat
> errors?
>
> It seems like there must be some other/additional configuration that I
> haven't done on the Shibboleth IdP side that is required for the IdP to be
> able to support the 2 partners?
>
> Thanks,
> Jim
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250503/62e3516c/attachment.htm>