Thank you Nate. I fixed the configruation issue by removing the Metada filter in "shibboleth2.xml". As you said, I am running into other issues after fixing that error. I am looking into that. Thank you very much for your help.<br>
<br>-Pavan<br><br><div class="gmail_quote">On Tue, Aug 30, 2011 at 4:34 PM, Nate Klingenstein <span dir="ltr"><<a href="mailto:ndk@internet2.edu">ndk@internet2.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div style="word-wrap: break-word;">Pavan,<div><br></div><div>You're making good progress on a somewhat customized installation. There are a couple mis-steps, though.</div><div><br><div><div class="im"><blockquote type="cite">
My identity provider "entityId" is : <b>http://<machineA>:8080/idp/shibboleth</b> and the metadata is accesible by using that URL.<br></blockquote><div><br></div></div><div>Putting a port in an entityID is not usually recommended, but you can do it. Also, metadata should be signed if it's hosted over http -- but this is fine for a test deployment.</div>
<div class="im"><br><blockquote type="cite">After installing the Service provider, I modified "shibboleth2.xml" with the following changes,<br><br>Modified service provider "entityId" to <b>"http://<machineB>/sp/shibboleth"</b> in "<ApplicationDefaults" xml tag.<br>
<br>Added SSO:<br><br><b><SSO entityID="http://<machineA>:8080/idp/shibboleth"><br> SAML2 SAML1<br></SSO><br></b></blockquote><div><br></div></div><div>This is all fine.</div><div class="im">
<br><blockquote type="cite">Added metadata provider:<br><br><b> <MetadataProvider type="Chaining"><br> <MetadataProvider type="XML" uri="http://<machineA>:8080/idp/shibboleth"<br>
backingFilePath="federation-metadata.xml" reloadInterval="7200"><br> <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/><br> </MetadataProvider><br>
</MetadataProvider> <br></b></blockquote><div><br></div></div><div>This should be okay, too.</div><div class="im"><br><blockquote type="cite">And i modified identity provider "relying-party.xml" file with the following changes,<br>
<br><b> <rp:AnonymousRelyingParty provider="http://<machineB>/sp/shibboleth" defaultSigningCredentialRef="IdPCredential"/><br> <br> <rp:DefaultRelyingParty provider="http://<machineB>/sp/shibboleth" defaultSigningCredentialRef="IdPCredential"></b><br>
</blockquote><div><br></div></div><div>This is not correct. The provider attribute in these elements in relying-party.xml refers to the entityID that the IdP will use to name itself when it is talking to relying parties. This should be http://<machineA>:8080/idp/shibboleth, which should match the original values.</div>
<div><br></div><div>These properties were really hard to name right, and obviously, the current names confused you.</div><div class="im"><br><blockquote type="cite">After these changes i have restarted identity provider, services provider and apache services. I am trying to hit the url; <b>"http://<machineB>/Shibboleth.sso/Login"</b><br>
<br><br>I am getting the following error:<br><p><b>opensaml::saml2md::MetadataException at (http://<machineB>/Shibboleth.sso/Login)</b></p><p><b>Unable to locate metadata for identity provider (http://<machineA>:8080/idp/shibboleth)</b></p>
</blockquote><div><br></div></div><div>Either the metadata for the identity provider isn't being loaded correctly, or the entityID in the metadata file doesn't match http://<machineA>:8080/idp/shibboleth. There needs to be an entityID in metadata loaded by the SP that precisely matches the IdP's configured entityID, and the entityID in the SSO element has to be a string match of that entityID too. You can check shibd.log during startup and login attempt to determine where the mismatch is.</div>
<div><br></div><div>That will fix this problem. You may encounter other problems after you resolve this one.</div><div><br></div><div>Take care,</div><div>Nate.</div></div><font color="#888888"><br></font></div></div><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>