<div dir="ltr"><span class="" style>ShibUsers</span>,<div><br></div><div>We're finally getting around to cleaning up our <span class="" style>metadata</span> file.</div><div>We're SP only so this is the file that we'd have our partner/customer <span class="" style>IdP</span> servers install.</div>
<div><br></div><div>We've looked at examples for everywhere and we're still confused.</div><div><br></div><div>The ../Shibboleth.<span class="" style>sso</span>/<span class="" style>Metadata</span> generated file has a familiar structure:</div>
<div><br></div><div>(We know this will not be the final file, but just a starting point)</div><div><br></div><div><br></div><div><div><br></div><div><!--</div><div>This is example <span class="" style>metadata</span> only. Do *NOT* supply it as is without review,</div>
<div>and do *NOT* provide it in real time to your partners.</div><div> --></div><div><<span class="" style>md</span>:<span class="" style>EntityDescriptor</span> <span class="" style>xmlns</span>:<span class="" style>md</span>="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:<span class="" style>metadata</span>" ID="_7f02024667d46287aafdd4ecdfd0627d2010938b" <span class="" style>entityID</span>="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>"></div>
<div> <<span class="" style>md</span>:Extensions <span class="" style>xmlns</span>:<span class="" style>alg</span>="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:<span class="" style>metadata</span>:<span class="" style>algsupport</span>"></div>
<div> <<span class="" style>alg</span>:<span class="" style>DigestMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmlenc</span>#sha512"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>DigestMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmldsig</span>-more#sha384"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>DigestMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmlenc</span>#sha256"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>DigestMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmldsig</span>-more#sha224"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>DigestMethod</span> Algorithm="<a href="http://www.w3.org/2000/09/">http://www.w3.org/2000/09/</a><span class="" style>xmldsig</span>#sha1"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>SigningMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmldsig</span>-more#<span class="" style>rsa</span>-sha512"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>SigningMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmldsig</span>-more#<span class="" style>rsa</span>-sha384"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>SigningMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmldsig</span>-more#<span class="" style>rsa</span>-sha256"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>SigningMethod</span> Algorithm="<a href="http://www.w3.org/2009/xmldsig11#">http://www.w3.org/2009/xmldsig11#</a><span class="" style>dsa</span>-sha256"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>SigningMethod</span> Algorithm="<a href="http://www.w3.org/2000/09/">http://www.w3.org/2000/09/</a><span class="" style>xmldsig</span>#<span class="" style>rsa</span>-sha1"/></div>
<div> <<span class="" style>alg</span>:<span class="" style>SigningMethod</span> Algorithm="<a href="http://www.w3.org/2000/09/">http://www.w3.org/2000/09/</a><span class="" style>xmldsig</span>#<span class="" style>dsa</span>-sha1"/></div>
<div> </<span class="" style>md</span>:Extensions></div><div> <<span class="" style>md</span>:<span class="" style>SPSSODescriptor</span> <span class="" style>protocolSupportEnumeration</span>="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:protocol urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:1.1:protocol urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:1.0:protocol"></div>
<div> <<span class="" style>md</span>:Extensions></div><div> <<span class="" style>init</span>:<span class="" style>RequestInitiator</span> <span class="" style>xmlns</span>:<span class="" style>init</span>="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:profiles:<span class="" style>SSO</span>:request-<span class="" style>init</span>" Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:profiles:<span class="" style>SSO</span>:request-<span class="" style>init</span>" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/<span class="" style>Login</span>"/></div>
<div> </<span class="" style>md</span>:Extensions></div><div> <<span class="" style>md</span>:<span class="" style>KeyDescriptor</span>></div><div> <<span class="" style>ds</span>:<span class="" style>KeyInfo</span> <span class="" style>xmlns</span>:<span class="" style>ds</span>="<a href="http://www.w3.org/2000/09/">http://www.w3.org/2000/09/</a><span class="" style>xmldsig</span>#"></div>
<div> <<span class="" style>ds</span>:<span class="" style>KeyName</span>>CBRDWEBP07</<span class="" style>ds</span>:<span class="" style>KeyName</span>></div><div> <<span class="" style>ds</span>:X509Data></div>
<div> <<span class="" style>ds</span>:X509SubjectName><span class="" style>CN</span>=CBRDWEBP07</<span class="" style>ds</span>:X509SubjectName></div><div> <<span class="" style>ds</span>:X509Certificate><span class="" style>dklsfjklsdfkljslf</span>;<span class="" style>fjsfjweiorjds</span>;f;<span class="" style>JSDFSDFJ</span>;<span class="" style>ASDFSJDF</span></div>
<div><br></div><div><CERT LINES HERE></div><div><br></div><div><span class="" style>dklsfjklsdfkljslf</span>;<span class="" style>fjsfjweiorjds</span>;f;<span class="" style>JSDFSDFJ</span>;<span class="" style>ASDFSJDF</span>==</div>
<div></<span class="" style>ds</span>:X509Certificate></div><div> </<span class="" style>ds</span>:X509Data></div><div> </<span class="" style>ds</span>:<span class="" style>KeyInfo</span>></div>
<div> <<span class="" style>md</span>:<span class="" style>EncryptionMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmlenc</span>#aes128-<span class="" style>cbc</span>"/></div>
<div> <<span class="" style>md</span>:<span class="" style>EncryptionMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmlenc</span>#aes192-<span class="" style>cbc</span>"/></div>
<div> <<span class="" style>md</span>:<span class="" style>EncryptionMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmlenc</span>#aes256-<span class="" style>cbc</span>"/></div>
<div> <<span class="" style>md</span>:<span class="" style>EncryptionMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmlenc</span>#<span class="" style>tripledes</span>-<span class="" style>cbc</span>"/></div>
<div> <<span class="" style>md</span>:<span class="" style>EncryptionMethod</span> Algorithm="<a href="http://www.w3.org/2009/xmlenc11#">http://www.w3.org/2009/xmlenc11#</a><span class="" style>rsa</span>-<span class="" style>oaep</span>"/></div>
<div> <<span class="" style>md</span>:<span class="" style>EncryptionMethod</span> Algorithm="<a href="http://www.w3.org/2001/04/">http://www.w3.org/2001/04/</a><span class="" style>xmlenc</span>#<span class="" style>rsa</span>-<span class="" style>oaep</span>-mgf1p"/></div>
<div> </<span class="" style>md</span>:<span class="" style>KeyDescriptor</span>></div><div> <<span class="" style>md</span>:<span class="" style>ArtifactResolutionService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:SOAP" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/Artifact/SOAP" index="1"/></div>
<div> <<span class="" style>md</span>:<span class="" style>SingleLogoutService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:SOAP" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/<span class="" style>SLO</span>/SOAP"/></div>
<div> <<span class="" style>md</span>:<span class="" style>SingleLogoutService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:HTTP-Redirect" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/<span class="" style>SLO</span>/Redirect"/></div>
<div> <<span class="" style>md</span>:<span class="" style>SingleLogoutService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:HTTP-POST" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/<span class="" style>SLO</span>/POST"/></div>
<div> <<span class="" style>md</span>:<span class="" style>SingleLogoutService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:HTTP-Artifact" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/<span class="" style>SLO</span>/Artifact"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:HTTP-POST" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/SAML2/POST" index="1"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:HTTP-POST-<span class="" style>SimpleSign</span>" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/SAML2/POST-<span class="" style>SimpleSign</span>" index="2"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:HTTP-Artifact" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/SAML2/Artifact" index="3"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:<span class="" style>PAOS</span>" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/SAML2/<span class="" style>ECP</span>" index="4"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:1.0:profiles:browser-post" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/<span class="" style>SAML</span>/POST" index="5"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:1.0:profiles:artifact-01" Location="<a href="https://app1.corp.com/Shibboleth">https://app1.corp.com/Shibboleth</a>.<span class="" style>sso</span>/<span class="" style>SAML</span>/Artifact" index="6"/></div>
<div> </<span class="" style>md</span>:<span class="" style>SPSSODescriptor</span>></div><div> <Organization></div><div> <<span class="" style>OrganizationName</span> <span class="" style>xml</span>:<span class="" style>lang</span>="en">Corp.Com</<span class="" style>OrganizationName</span>></div>
<div> <<span class="" style>OrganizationDisplayName</span> <span class="" style>xml</span>:<span class="" style>lang</span>="en">Corp.Com</<span class="" style>OrganizationDisplayName</span>></div>
<div> <<span class="" style>OrganizationURL</span> <span class="" style>xml</span>:<span class="" style>lang</span>="en"><a href="https://www.corp.com">https://www.corp.com</a></<span class="" style>OrganizationURL</span>></div>
<div> </Organization></div><div> <<span class="" style>ContactPerson</span> <span class="" style>contactType</span>="administrative"></div><div> <<span class="" style>GivenName</span>>Mr. Administrator</<span class="" style>GivenName</span>></div>
<div> <<span class="" style>EmailAddress</span>><span class="" style>adm</span>@<a href="http://corp.com">corp.com</a></<span class="" style>EmailAddress</span>></div><div> </<span class="" style>ContactPerson</span>></div>
<div> <<span class="" style>ContactPerson</span> <span class="" style>contactType</span>="support"></div><div> <<span class="" style>GivenName</span>>Support Group</<span class="" style>GivenName</span>></div>
<div> <<span class="" style>EmailAddress</span>><a href="mailto:support@corp.com">support@corp.com</a></<span class="" style>EmailAddress</span>></div><div> </<span class="" style>ContactPerson</span>></div>
<div></<span class="" style>md</span>:<span class="" style>EntityDescriptor</span>></div></div><div><br></div><div style>This worked just fine with our partners and customers.</div><div style><br></div><div style>Notice all the "<<span class="" style>md</span>: ... </<span class="" style>md</span>: pairs.</div>
<div style><br></div><div style>We then added the endpoints and CERT for one of new customers. We generated their CERT pair with <span class="" style>KEYGEN</span> and their <span class="" style>metadata</span> file with <span class="" style>METAGEN</span>. When we went to add this new meta file to the existing <span class="" style>metadata</span> file things blew up.</div>
<div style><br></div><div style><div><br></div><div><span class="" style="white-space:pre"> </span><!-- customer2301 --></div><div><<span class="" style>md</span>:<span class="" style>EntityDescriptor</span> <span class="" style>xmlns</span>:<span class="" style>md</span>="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:<span class="" style>metadata</span>" <span class="" style>xmlns</span>:<span class="" style>ds</span>="<a href="http://www.w3.org/2000/09/">http://www.w3.org/2000/09/</a><span class="" style>xmldsig</span>#" <span class="" style>entityID</span>="<a href="https://app1.corp.com/customer2301/Shibboleth">https://app1.corp.com/customer2301/Shibboleth</a>.<span class="" style>sso</span>"></div>
<div> <<span class="" style>md</span>:<span class="" style>SPSSODescriptor</span> <span class="" style>protocolSupportEnumeration</span>="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:protocol urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:1.1:protocol"></div>
<div> <<span class="" style>md</span>:<span class="" style>KeyDescriptor</span>></div><div> <<span class="" style>ds</span>:<span class="" style>KeyInfo</span>></div><div> <<span class="" style>ds</span>:X509Data></div>
<div> <<span class="" style>ds</span>:X509Certificate></div><div> <<span class="" style>ds</span>:X509Certificate><span class="" style>dklsfjklsdfkljslf</span>;<span class="" style>fjsfjweiorjds</span>;f;<span class="" style>JSDFSDFJ</span>;<span class="" style>ASDFSJDF</span></div>
<div><br></div><div><CERT LINES HERE></div><div><br></div><div><span class="" style>dklsfjklsdfkljslf</span>;<span class="" style>fjsfjweiorjds</span>;f;<span class="" style>JSDFSDFJ</span>;<span class="" style>ASDFSJDF</span>==</div>
<div> </<span class="" style>ds</span>:X509Certificate></div><div> </<span class="" style>ds</span>:X509Data></div><div> </<span class="" style>ds</span>:<span class="" style>KeyInfo</span>></div>
<div> </<span class="" style>md</span>:<span class="" style>KeyDescriptor</span>></div><div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:HTTP-POST" Location="<a href="https://app1.corp.com/customer2301/Shibboleth">https://app1.corp.com/customer2301/Shibboleth</a>.<span class="" style>sso</span>/SAML2/POST" index="1"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:HTTP-POST-<span class="" style>SimpleSign</span>" Location="<a href="https://app1.corp.com/customer2301/Shibboleth">https://app1.corp.com/customer2301/Shibboleth</a>.<span class="" style>sso</span>/SAML2/POST-<span class="" style>SimpleSign</span>" index="2"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:2.0:bindings:<span class="" style>PAOS</span>" Location="<a href="https://app1.corp.com/customer2301/Shibboleth">https://app1.corp.com/customer2301/Shibboleth</a>.<span class="" style>sso</span>/SAML2/<span class="" style>ECP</span>" index="3"/></div>
<div> <<span class="" style>md</span>:<span class="" style>AssertionConsumerService</span> Binding="urn:oasis:names:<span class="" style>tc</span>:<span class="" style>SAML</span>:1.0:profiles:browser-post" Location="<a href="https://app1.corp.com/customer2301/Shibboleth">https://app1.corp.com/customer2301/Shibboleth</a>.<span class="" style>sso</span>/<span class="" style>SAML</span>/POST" index="4"/></div>
<div> </<span class="" style>md</span>:<span class="" style>SPSSODescriptor</span>></div><div></<span class="" style>md</span>:<span class="" style>EntityDescriptor</span>></div><div><span class="" style="white-space:pre"> </span><!-- customer2301 --></div>
</div><div style><br></div><div style><br></div><div style>This <span class="" style>metadata</span> also has the same <<span class="" style>md</span>:..</<span class="" style>md</span> pairs. However, none of our partners or customers could import the new file. All complained that the XML was rejected.</div>
<div style><br></div><div style>We tried a XML validation tool, and it reported the problem starting at the new addition (not surprising) right at the first "<<span class="" style>md</span>: " element.</div>
<div style><br></div><div style>So 2 questions:</div><div style><br></div><div style>We're using the supplied tools (<span class="" style>keygen</span>.sh, <span class="" style>metagen</span>.sh) to create <span class="" style>metadata</span> files for new customers (who appear as a different path in our application tree). We want to add the customer endpoints and <span class="" style>entityID's</span> to the main <span class="" style>metadata</span> file that we publish. We know we have to care/craft/adjust/edit our <span class="" style>metadata</span>. Clearly the supplied tools are just a starting point, but what guides to people use to make sure the XML is correct for Shibboleth <span class="" style>IdP's</span> to "consume." Is there a "generic <span class="" style>metadata</span> file" or documented guide that we can refer to for this type of additional meta?</div>
<div style><br></div><div style>2) Would just stripping off the " <<span class="" style>md</span>: .. </<span class="" style>md</span> pairs be enough to correct the problem? Meaning that only one pair of <<span class="" style>md</span>:<span class="" style>EntityDescriptor</span>>...</<span class="" style>md</span>:<span class="" style>EntityDescriptor</span>> is allowed and subsequent lines cannot have the <<span class="" style>md</span>: .. </<span class="" style>md</span>: notation.</div>
<div style><br></div><div style><br></div><div style>-- <span class="" style>RGS</span></div><div><div><br>==================================<br>Roy G. Specter<br><a href="mailto:roygspectech8@gmail.com" target="_blank">roygspectech8@gmail.com</a><br>
========================================<br></div>
</div></div>