<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Pavan,<div><br></div><div>You're making good progress on a somewhat customized installation. There are a couple mis-steps, though.</div><div><br><div><blockquote type="cite">My identity provider "entityId" is : <b>http://<machineA>:8080/idp/shibboleth</b> and the metadata is accesible by using that URL.<br></blockquote><div><br></div><div>Putting a port in an entityID is not usually recommended, but you can do it. Also, metadata should be signed if it's hosted over http -- but this is fine for a test deployment.</div><br><blockquote type="cite">After installing the Service provider, I modified "shibboleth2.xml" with the following changes,<br><br>Modified service provider "entityId" to <b>"http://<machineB>/sp/shibboleth"</b> in "<ApplicationDefaults" xml tag.<br> <br>Added SSO:<br><br><b><SSO entityID="http://<machineA>:8080/idp/shibboleth"><br> SAML2 SAML1<br></SSO><br></b></blockquote><div><br></div><div>This is all fine.</div><br><blockquote type="cite">Added metadata provider:<br><br><b> <MetadataProvider type="Chaining"><br> <MetadataProvider type="XML" uri="http://<machineA>:8080/idp/shibboleth"<br> backingFilePath="federation-metadata.xml" reloadInterval="7200"><br> <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/><br> </MetadataProvider><br></MetadataProvider> <br></b></blockquote><div><br></div><div>This should be okay, too.</div><br><blockquote type="cite">And i modified identity provider "relying-party.xml" file with the following changes,<br><br><b> <rp:AnonymousRelyingParty provider="http://<machineB>/sp/shibboleth" defaultSigningCredentialRef="IdPCredential"/><br> <br> <rp:DefaultRelyingParty provider="http://<machineB>/sp/shibboleth" defaultSigningCredentialRef="IdPCredential"></b><br></blockquote><div><br></div><div>This is not correct. The provider attribute in these elements in relying-party.xml refers to the entityID that the IdP will use to name itself when it is talking to relying parties. This should be http://<machineA>:8080/idp/shibboleth, which should match the original values.</div><div><br></div><div>These properties were really hard to name right, and obviously, the current names confused you.</div><br><blockquote type="cite">After these changes i have restarted identity provider, services provider and apache services. I am trying to hit the url; <b>"http://<machineB>/Shibboleth.sso/Login"</b><br> <br><br>I am getting the following error:<br><p class="error"><b>opensaml::saml2md::MetadataException at (http://<machineB>/Shibboleth.sso/Login)</b></p><p><b>Unable to locate metadata for identity provider (http://<machineA>:8080/idp/shibboleth)</b></p></blockquote><div><br></div><div>Either the metadata for the identity provider isn't being loaded correctly, or the entityID in the metadata file doesn't match http://<machineA>:8080/idp/shibboleth. There needs to be an entityID in metadata loaded by the SP that precisely matches the IdP's configured entityID, and the entityID in the SSO element has to be a string match of that entityID too. You can check shibd.log during startup and login attempt to determine where the mismatch is.</div><div><br></div><div>That will fix this problem. You may encounter other problems after you resolve this one.</div><div><br></div><div>Take care,</div><div>Nate.</div></div><br></div></body></html>