<html>
<head>
</head>
<body class='hmmessage'><div dir='ltr'>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style>
<div dir="ltr"> <div class="message-text adbayes-content" id="message7591616"> Hi <br><br><br>We need to use SAML single sign on to the other company’s portal. They have simpleSAMLPhp SP. <br><br><br>Our environment is J2ee. So we installed shibboleth2.4 on linux which is already hosting a Java/web application and followed <a href="http://wiki.aaf.edu.au/tech-info/identity-provider/new-idp-install-guide-2-4-0-uApprove-2-5-0#TOC-Install-packages" target="_top" rel="nofollow" link="external">http://wiki.aaf.edu.au/tech-info/identity-provider/new-idp-install-guide-2-4-0-uApprove-2-5-0#TOC-Install-packages</a> to install and configure IDP <br><br><br><a href="http://testidp.mycompany.com:8080/idp/Authn/UserPassword" target="_top" rel="nofollow" link="external">http://testidp.mycompany.com:8080/idp/Authn/UserPassword</a> shows login screen <br><br><a href="http://testidp.mycompany.com:8080/idp/shibboleth" target="_top" rel="nofollow" link="external">http://testidp.mycompany.com:8080/idp/shibboleth</a> shows metadata.xml <br><br><br>Here some errors I am encountering: <br><br><br>1. I notice when I browsehttp://testidp.mycompany.com:8080/idp/shibboleth, I notice EntityID shown as <a href="https://testidp.mycompany.com:8080/idp/shibboleth" target="_top" rel="nofollow" link="external">https://testidp.mycompany.com:8080/idp/shibboleth</a>, <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://testidp.mycompany.com/idp/profile/SAML2/POST/SLO%22" target="_top" rel="nofollow" link="external">https://testidp.mycompany.com/idp/profile/SAML2/POST/SLO"</a> />, <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="<a href="http://testidp.mycompany.com/idp/profile/Shibboleth/SSO%22/%3E" target="_top" rel="nofollow" link="external">http://testidp.mycompany.com/idp/profile/Shibboleth/SSO"/></a><br><br>if I browse <a href="https://testidp.mycompany.com:8080/idp/shibboleth" target="_top" rel="nofollow" link="external">https://testidp.mycompany.com:8080/idp/shibboleth</a>, it shows certificate error and when I click continue, it shows error. <br><br>2. When I configure relying-party.xml <br><br>a) Add below code after </rp:DefaultRelyingParty><br><rp:RelyingParty id="<a href="http://remote/" target="_top" rel="nofollow" link="external">http://remote</a> simpleSAMLphp SP IP address" <br><br>provider="<a href="http://testidp.mycompany.com:8080/idp/shibboteth%22" target="_top" rel="nofollow" link="external">http://testidp.mycompany.com:8080/idp/shibboteth"</a><br><br>defaultSigningCredentialRef="IdPCredential" ><br><br><rp: ProfileConfiguration xsi:type="saml:SAML2SSOProfile" <br><br>encryptNameIds="never" /><br><br></rp: RelyingParty><br><br><br>b) Add <metadata:MetadataProvider id="TESTMD" xsi:type="metadata:FileBackedHTTPMetadataProvider" <br><br>metadataURL="<a href="http://remote/" target="_top" rel="nofollow" link="external">http://remote</a> simplesamlphp SP IP address/simplesamlphp/www/module.php/saml/sp/metadata.php/default-sp" <br><br>backingFile="/opt/shibboleth-idp/metadata/sp.xml" ><br><br><metadata:MetadataFilter xsi:type="metadata:ChainingFilter"><br><br><metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil" <br><br>maxValidityInterval="P7D" /><br><br><metadata:MetadataFilter xsi:type="metadata:SignatureValidation" <br><br>trustEngineRef="shibboleth.MetadataTrustEngine" <br><br>requireSignedMetadata="true" /><br><br><metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList"><br><br><metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole><br><br></metadata:MetadataFilter><br><br></metadata:MetadataFilter><br><br></metadata:MetadataProvider><br><br>Sp.xml is saved from metadatURL and put under credentials directory <br><br>c) Add below code for security configuration <br><br><security:Credential id="TESTMD" xsi:type="security:X509Filesystem"><br><br><security:PrivateKey>/opt/shibboleth-idp/credentials/saml.key</security:PrivateKey><br><br><security:Certificate>/opt/shibboleth-idp/credentials/saml.crt</security:Certificate><br><br></security:Credential><br><br><br><br>I restart the tomcat 6. I found /idp application on Tomcat manager did not start. And all <a href="http://testidp.mycompany.com:8080/idp/shibboleth" target="_top" rel="nofollow" link="external">http://testidp.mycompany.com:8080/idp/shibboleth</a> not work, and I got the following error: <br><br>10:17:34.552 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:158] - Loading new configuration for service shibboleth.RelyingPartyConfigurationManager <br><br>10:17:34.579 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.RelyingPartyConfigurationManager service, error creating components. The root cause of this error was: org.xml.sax.SAXParseException: Element or attribute do not match QName production: QName::=(NCName':')?NCName. <br><br>Can anyone here tell me how to fix it? <br><br>Thank you ahead. </div></div>
</div></body>
</html>