<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hey world, new Shibboleth user here!<div><br></div><div>I'm trying to set up a local installation of IdP and SP on the same machine (Mac OS X Lion) and have gotten it to work - almost. I stumble upon a mismatch in URLs after successfully have logged in with the configured LDAP. IDP says</div><div><br></div><div>WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying party '<a href="https://sp.ejeklint.se/shibboleth'">https://sp.ejeklint.se/shibboleth'</a> requested the response to be returned to endpoint with ACS URL '<a href="https://www.example.com/Shibboleth.sso/SAML2/POST'">https://www.example.com/Shibboleth.sso/SAML2/POST'</a> and binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint, with that URL and using a supported binding, can be found in the relying party's metadata </div><div><br></div><div>and that's fair enough as "<a href="https://www.example.com">https://www.example.com</a>..." is not a correct URL. But the thing is that I share metadata ONLY through files, and in my metadata file for the SP there is not a trace left of "<a href="http://www.example.com">www.example.com</a>" - my own machine name is there.</div><div><br></div><div>For some reason the IdP seem to pick the ACS URL from the running SP and not from the metadata file I have provided. Now I'm stuck and need a (gentle) kick in the right direction.</div><div><br></div><div>Here's my metadata tags in RelyingParty.xml:</div><div><br></div><div><div> <!-- ========================================== --></div><div> <!-- Metadata Configuration --></div><div> <!-- ========================================== --></div><div> <!-- MetadataProvider the combining other MetadataProviders --></div><div> <metadata:MetadataProvider id="ShibbolethMetadata" xsi:type="metadata:ChainingMetadataProvider"></div><div> </div><div> <span class="Apple-tab-span" style="white-space:pre"> </span><!-- Load the IdP's own metadata. This is necessary for artifact support. --></div><div> <metadata:MetadataProvider id="IdPMD" xsi:type="metadata:ResourceBackedMetadataProvider"></div><div> <metadata:MetadataResource xsi:type="resource:FilesystemResource" file="/opt/shibboleth-idp/metadata/idp-metadata.xml"/></div><div> </metadata:MetadataProvider></div><div> </div><div> <!-- Load the SP's metadata. --></div><div> <metadata:MetadataProvider xsi:type="FilesystemMetadataProvider"</div><div> xmlns="urn:mace:shibboleth:2.0:metadata" id="SPMETADATA"</div><div> metadataFile="/opt/shibboleth-idp/metadata/sp-metadata.xml" /></div><div> </div><div> </metadata:MetadataProvider></div><div><br></div></div><div>And here is the sp-metadata.xml that is referred to from RelyingParty.xml:</div><div><br></div><div><div> <EntityDescriptor entityID="<a href="https://sp.ejeklint.se/shibboleth">https://sp.ejeklint.se/shibboleth</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"></div><div> <!-- The TestShib Two SP supports SAML 2.0, SAML 1.1, and Shibboleth 1.2+. --></div><div> <SPSSODescriptor</div><div> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"></div><div> <Extensions xmlns="urn:oasis:names:tc:SAML:2.0:metadata"></div><div> <!-- Extension to permit the SP to receive IdP discovery responses. --></div><div> <idpdisc:DiscoveryResponse</div><div> Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/Login">https://sp.ejeklint.se/Shibboleth.sso/Login</a>"</div><div> index="1" xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"/></div><div> <idpdisc:DiscoveryResponse</div><div> Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/Login">https://sp.ejeklint.se/Shibboleth.sso/Login</a>"</div><div> index="2" xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"/></div><div> </Extensions></div><div><br></div><div>[verbose key stuff removed...]</div><div><br></div><div> <!-- This tells IdPs that Single Logout is supported and where/how to request it. --></div><div><br></div><div> <SingleLogoutService</div><div> Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SLO/SOAP">https://sp.ejeklint.se/Shibboleth.sso/SLO/SOAP</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div> <SingleLogoutService</div><div> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SLO/Redirect">https://sp.ejeklint.se/Shibboleth.sso/SLO/Redirect</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div> <SingleLogoutService</div><div> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SLO/POST">https://sp.ejeklint.se/Shibboleth.sso/SLO/POST</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div> <SingleLogoutService</div><div> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SLO/Artifact">https://sp.ejeklint.se/Shibboleth.sso/SLO/Artifact</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div> <!-- This tells IdPs that you only need transient identifiers. --></div><div> <NameIDFormat xmlns="urn:oasis:names:tc:SAML:2.0:metadata">urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat></div><div> <NameIDFormat xmlns="urn:oasis:names:tc:SAML:2.0:metadata">urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat></div><div> <!--</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>This tells IdPs where and how to push assertions through the browser. Mostly</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>the SP will tell the IdP what location to use in its request, but this</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>is how the IdP validates the location and also figures out which</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>SAML version/binding to use.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>--></div><div><br></div><div> <AssertionConsumerService</div><div> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML2/POST">https://sp.ejeklint.se/Shibboleth.sso/SAML2/POST</a>"</div><div> index="1" isDefault="true" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div> <AssertionConsumerService</div><div> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML2/POST-SimpleSign">https://sp.ejeklint.se/Shibboleth.sso/SAML2/POST-SimpleSign</a>"</div><div> index="2" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div> <AssertionConsumerService</div><div> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML2/Artifact">https://sp.ejeklint.se/Shibboleth.sso/SAML2/Artifact</a>"</div><div> index="3" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div> <AssertionConsumerService</div><div> Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML/POST">https://sp.ejeklint.se/Shibboleth.sso/SAML/POST</a>"</div><div> index="4" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div> <AssertionConsumerService</div><div> Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"</div><div> Location="<a href="https://sp.ejeklint.se/Shibboleth.sso/SAML/Artifact">https://sp.ejeklint.se/Shibboleth.sso/SAML/Artifact</a>"</div><div> index="5" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> </div><div> <!-- </div><div> <AttributeConsumingService index="1"></div><div> <ServiceName xml:lang="en">secure</ServiceName></div><div> <ServiceDescription xml:lang="en">An example service that requires a human-readable identifier and optional name and e-mail address.</ServiceDescription></div><div> </AttributeConsumingService> </div><div> --> </div><div> </SPSSODescriptor></div><div><br></div><div> <!-- This is just information about the entity in human terms. --></div><div> <Organization xmlns="urn:oasis:names:tc:SAML:2.0:metadata"></div><div> <OrganizationName xml:lang="en" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">Shibboleth SP at <a href="http://ejeklint.se">ejeklint.se</a></OrganizationName></div><div><br></div><div> <OrganizationDisplayName xml:lang="en" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">EE SP</OrganizationDisplayName></div><div><br></div><div> <OrganizationURL xml:lang="en" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><a href="http://www.ejeklint.se</OrganizationURL>">http://www.ejeklint.se</OrganizationURL></a></div><div> </Organization></div><div> <ContactPerson contactType="technical" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"></div><div> <GivenName xmlns="urn:oasis:names:tc:SAML:2.0:metadata">Per</GivenName></div><div> <SurName xmlns="urn:oasis:names:tc:SAML:2.0:metadata">Ejeklint</SurName></div><div> <EmailAddress xmlns="urn:oasis:names:tc:SAML:2.0:metadata">mailto:ejeklint@me.com</EmailAddress></div><div><br></div><div> </ContactPerson></div><div><br></div><div> </EntityDescriptor></div></div><div><br></div><div><br></div><div>As for the configuration of the SP, there is indeed a problem with the RequestMapper (I think). The metadata that is available from <a href="https://sp.ejeklint.se/Shibboleth.sso/Metadata">https://sp.ejeklint.se/Shibboleth.sso/Metadata</a> does indeed have the wrong URLs with <a href="http://www.example.com">www.example.com</a> in them, but as I don't have a metadata provider pointing to that URL it should still work. Or am I ignorant about something here? This is the RequestMapper in shibboleth2.xml which isn't doing what I expect:</div><div><br></div><div><div> <RequestMapper type="Native"></div><div> <RequestMap></div><div> <!--</div><div> The example requires a session for documents in /secure on the containing host with http and</div><div> https on the default ports. Note that the name and port in the <Host> elements MUST match</div><div> Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element above.</div><div> --></div><div> <Host name="<a href="http://sp.ejeklint.se">sp.ejeklint.se</a>"></div><div> <Path name="secure" authType="shibboleth" requireSession="true"/></div><div> </Host></div><div><br></div><div> </RequestMap></div><div> </RequestMapper></div></div><div><br></div><div><br></div><div>Any ideas?</div><div><br><div apple-content-edited="true">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><strong style="color: rgb(51, 153, 153); "><br class="Apple-interchange-newline">Per Ejeklint</strong></span></div><div><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><strong style="color: rgb(51, 153, 153); "></strong></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; ">Address: <a href="http://www.heimore.com/" title="visit heimore.com" style="color: rgb(51, 153, 153); text-decoration: none; border-bottom-width: 1px; border-bottom-color: rgb(153, 153, 153); border-bottom-style: dotted; ">Heimore Group AB</a></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; ">, Götgatan 78 22th floor, SE-118 30 </span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><a href="http://www.stockholm.se/" title="visit Stockholm" style="color: rgb(51, 153, 153); text-decoration: none; border-bottom-width: 1px; border-bottom-color: rgb(153, 153, 153); border-bottom-style: dotted; ">Stockholm</a></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; ">, </span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><a href="http://www.sweden.se/" title="visit Sweden" style="color: rgb(51, 153, 153); text-decoration: none; border-bottom-width: 1px; border-bottom-color: rgb(153, 153, 153); border-bottom-style: dotted; ">Sweden</a></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; "><br></span><span class="Apple-style-span" style="color: rgb(51, 153, 153); font-family: 'Lucida Grande'; font-size: 11px; line-height: 13px; ">Phone: +4670-5090052</span></div></div></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br></div></body></html>