Here is my sample shibboleth2.xml file<br><br><!--<br>This is an example shibboleth2.xml generated for you by TestShib Two. It's reduced and recommented<br>specifically for testing. You don't need to change anything, but you may want to explore the file<br>
to learn about how your SP works. Uncomment attributes in your attribute-map.xml file to test them.<br><br>If you want to test advanced functionality, start from the distribution shibboleth2.xml and add the<br>MetadataProvider, TestShib credentials, the right entityID, and a SessionInitiator. More information:<br>
<br><a href="https://spaces.internet2.edu/display/SHIB2/NativeSPConfiguration">https://spaces.internet2.edu/display/SHIB2/NativeSPConfiguration</a><br>--><br><br><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br>
logger="syslog.logger" clockSkew="1800"><br><br> <!-- You might want to increase the top-level log sensitivity in these files. --><br> <OutOfProcess logger="shibd.logger" /><br>
<InProcess logger="native.logger"><br> <ISAPI normalizeRequest="true"><br> <!-- Maps IIS Instance ID values to the host name. --><br> <Site id="12345" name="<a href="http://sampleidp.nowhere.com">sampleidp.nowhere.com</a>"/><br>
</ISAPI><br><br> </InProcess><br><br> <!-- Settings for session storage and internal communication. --><br> <TCPListener address="127.0.0.1" port="12345" acl="127.0.0.1"/><br>
<StorageService type="Memory" id="mem" cleanupInterval="900"/><br> <SessionCache type="StorageService" StorageService="mem" cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/><br>
<ReplayCache StorageService="mem"/><br><br> <RequestMapper type="Native"><br> <RequestMap applicationId="default"><br> <Host name="<a href="http://sampleidp.nowhere.com">sampleidp.nowhere.com</a>" applicationId="auth-sample"><br>
<Path name="secure" authType="shibboleth" requireSession="true" requireSessionWith="SampleIdP" /><br> </Host><br> </RequestMap><br>
</RequestMapper><br><br> <!-- The entityID is the name TestShib made for your SP. --><br> <ApplicationDefaults id="default" policyId="default" REMOTE_USER="eppn"<br> entityID="<a href="https://myspd.nowhere.com/shibboleth-sp">https://myspd.nowhere.com/shibboleth-sp</a>"<br>
homeURL="<a href="https://myspd.nowhere.com/index.html">https://myspd.nowhere.com/index.html</a>"><br><br> <Sessions lifetime="28800" timeout="3600" checkAddress="false" handlerURL="/Shibboleth.sso" handlerSSL="false"><br>
<SessionInitiator type="Chaining" Location="/Login" isDefault="false" id="SampleIdP" relayState="cookie" entityID="<a href="https://sampleidp.nowhere.com/idp/shibboleth">https://sampleidp.nowhere.com/idp/shibboleth</a>"><br>
<SessionInitiator type="SAML2" acsIndex="1" template="bindingTemplate.html"/><br> <SessionInitiator type="Shib1" acsIndex="5"/><br>
</SessionInitiator><br> <br> <!-- How and where the SP listens. --><br> <md:AssertionConsumerService Location="/SAML2/POST" index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/><br>
<md:AssertionConsumerService Location="/SAML/POST" index="6" Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/><br> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br>
<Handler type="Status" Location="/Status" acl="127.0.0.1"/><br> <Handler type="Session" Location="/Session"/><br> <br> <!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. --><br>
<LogoutInitiator type="Chaining" Location="/Logout"><br> <LogoutInitiator type="SAML2" template="bindingTemplate.html"/><br> <LogoutInitiator type="Local"/><br>
</LogoutInitiator><br><br> <!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. --><br> <!--<br> <md:SingleLogoutService Location="/SLO/SOAP"<br>
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/><br> <md:SingleLogoutService Location="/SLO/Redirect" conf:template="bindingTemplate.html"<br> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/><br>
<md:SingleLogoutService Location="/SLO/POST" conf:template="bindingTemplate.html"<br> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/><br> <md:SingleLogoutService Location="/SLO/Artifact" conf:template="bindingTemplate.html"<br>
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/><br> --><br> </Sessions><br><br> <!-- Error pages to display to yourself if something goes horribly wrong. --><br>
<Errors session="sessionError.html" metadata="metadataError.html" access="accessError.html" ssl="sslError.html"<br> supportContact="root@localhost" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/><br>
<br> <!-- Loads and trusts a metadata file from InCommon. --><br> <!--<br> <MetadataProvider type="XML" uri="<a href="https://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml">https://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml</a>" backingFilePath="incommon-metadata.xml" reloadInterval="7200"><br>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/><br> <MetadataFilter type="Signature" certificate="incommon.pem"/><br> </MetadataProvider><br>
--><br> <!-- Attribute and trust options you shouldn't need to change. --><br> <TrustEngine type="ExplicitKey"/><br> <AttributeExtractor type="XML" path="attribute-map.xml"/><br>
<AttributeResolver type="Query"/><br> <AttributeFilter type="XML" path="attribute-policy.xml"/><br><br> <!-- Your SP generated these credentials. They're used to talk to IdP's. --><br>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br> <br> <ApplicationOverride id="auth-sample" entityID="<a href="http://sampleidp.nowhere.com">sampleidp.nowhere.com</a>"><br>
<MetadataProvider type="XML" file="sampleidp-idp-metadata.xml"/><br> </ApplicationOverride><br> <br> </ApplicationDefaults><br><br> <br> <!-- Security policies you shouldn't change unless you know what you're doing. --><br>
<SecurityPolicies><br> <Policy id="default" validate="false"><br> <Rule type="MessageFlow" checkReplay="true" expires="60"/><br> <Rule type="ClientCertAuth" errorFatal="true"/><br>
<Rule type="XMLSigning" errorFatal="true"/><br> </Policy><br> </SecurityPolicies><br><br></SPConfig><br><br><br><div class="gmail_quote">On Thu, Mar 15, 2012 at 2:22 PM, Jason Johnson <span dir="ltr"><<a href="mailto:jasonaj@gmail.com">jasonaj@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
I am wanting to convert my existing Shibboleth SP installation from a native (using local SP metadata file AND connecting to IDPs using local metadata files) to an InCommon/Shibboleth SP installation (with my SP metadata being pulled from InCommon). My biggest hurdle is I don't see where in the shibboleth2.xml file I need to specify that my SP metadata is to now be supplied remotely. I have seen this line mentioned a few times in other posts:<br>
<br>
<MetadataProvider type="XML" uri="<a href="https://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml" target="_blank">https://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml</a>" backingFilePath="incommon-metadata.xml" reloadInterval="7200"><br>
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200" /><br>
<MetadataFilter type="Signature" certificate="incommon.pem" /><br>
</MetadataProvider><br>
<br>
However, I was under the impression that this XML attribute was to tell Shibboleth how to interact with the IDPs. Do I have that wrong? Does it control both??<br>
<br>
My end goal is the following:<br>
<br>
1. Use my new InCommon SP metadata for all my connections<br>
2. Use InCommon IDPs for those that are in InCommon<br>
3. Use local IDP metadata files for those not in InCommon<br>
4. All this using one Shibboleth installation.<br>
<br>
Thanks,<br>
Jason<br>
</blockquote></div><br>