<div dir="ltr"><div>Hi kevin,</div><div>Thank you very much for your reply!</div><div>Ok, probably I solved my issues:</div><div>- I uploaded my metadata file on testshib service;</div><div>- I editaed my relying-party.xml file in this way:</div>
<div><br></div><div> <metadata:MetadataProvider id="URLMD" xsi:type="metadata:FileBackedHTTPMetadataProvider"</div><div> metadataURL="<a href="http://www.testshib.org/metadata/testshib-providers.xml" target="_blank">http://www.testshib.org/metadata/testshib-providers.xml</a>"</div>
<div> backingFile="/opt/shibboleth-idp/metadata/testshib.xml"></div><div> <!--</div><div> <metadata:MetadataFilter xsi:type="metadata:ChainingFilter"></div>
<div> <metadata:MetadataFilter xsi:type="metadata:RequiredValidUntil"</div><div> maxValidityInterval="P7D" /></div><div> <metadata:MetadataFilter xsi:type="metadata:SignatureValidation"</div>
<div> trustEngineRef="shibboleth.MetadataTrustEngine"</div><div> requireSignedMetadata="true" /></div><div> <metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList"></div>
<div> <metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole></div><div> </metadata:MetadataFilter></div><div> </metadata:MetadataFilter></div>
<div> --></div><div> </metadata:MetadataProvider></div><div><br></div><div>Now when I try to test my service using testshib I not receive the previous error (metadata error).</div><div><br></div><div>
I configurated my shibboleth Idp to use my CAS server. </div><div>I followed this documentation: <a href="https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration">https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration</a></div>
<div><br></div><div>So:</div><div><br></div><div>1) I included CAS Client Libraries in Idp;</div><div>2) I have modified $SHIB_HOME/conf/handler.xml file where I added:</div><div><div><br></div><div><!-- Remote User handler for CAS support --></div>
<div><LoginHandler xsi:type="RemoteUser"></div><div> <AuthenticationMethod></div><div> urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</div><div> </AuthenticationMethod></div><div> <AuthenticationMethod></div>
<div> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div><div> </AuthenticationMethod></div><div></LoginHandler></div><div><br></div><div>About this point I added the ph: suffix like in the following block:</div>
<div><br></div><div><!-- Remote User handler for CAS support --></div><div><ph:LoginHandler xsi:type="ph:RemoteUser"></div><div> <ph:AuthenticationMethod></div><div> urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</div>
<div> </ph:AuthenticationMethod></div><div> <ph:AuthenticationMethod></div><div> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div><div> </ph:AuthenticationMethod></div><div></ph:LoginHandler></div>
<div><br></div><div>in the same file I commented the default block</div><div><br></div><div>3) In the web.xml file I added this block file '<ph:LoginHandler xsi:type="ph:RemoteUser">' (is correct??)</div>
<div><br></div><div><!-- For CAS client support --></div><div><context-param></div><div> <param-name>serverName</param-name></div><div> <param-value><a href="http://vincenteservices.resiltech.net">vincenteservices.resiltech.net</a></param-value></div>
<div></context-param></div><div><br></div><div><!-- CAS client filters --></div><div><filter></div><div> <filter-name>CAS Authentication Filter</filter-name></div><div> <filter-class></div>
<div> org.jasig.cas.client.authentication.AuthenticationFilter</div><div> </filter-class></div><div> <init-param></div><div> <param-name>casServerLoginUrl</param-name></div><div> <param-value><a href="https://vincenteservices.resiltech.net/cas/login">https://vincenteservices.resiltech.net/cas/login</a></param-value></div>
<div> </init-param></div><div></filter></div><div> </div><div><filter-mapping></div><div> <filter-name>CAS Authentication Filter</filter-name></div><div> <url-pattern>/Authn/RemoteUser</url-pattern></div>
<div></filter-mapping></div><div> </div><div><filter></div><div> <filter-name>CAS Validation Filter</filter-name></div><div> <filter-class></div><div> org.jasig.cas.client.validation.Cas20ProxyReceivingTicketValidationFilter</div>
<div> </filter-class></div><div> <init-param></div><div> <param-name>casServerUrlPrefix</param-name></div><div> <param-value><a href="https://vincenteservices.resiltech.net/cas">https://vincenteservices.resiltech.net/cas</a></param-value></div>
<div> </init-param></div><div> <init-param></div><div> <param-name>redirectAfterValidation</param-name></div><div> <param-value>true</param-value></div><div> </init-param></div>
<div></filter></div><div> </div><div><filter-mapping></div><div> <filter-name>CAS Validation Filter</filter-name></div><div> <url-pattern>/Authn/RemoteUser</url-pattern></div><div></filter-mapping></div>
<div> </div><div><filter></div><div> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name></div><div> <filter-class></div><div> org.jasig.cas.client.util.HttpServletRequestWrapperFilter</div>
<div> </filter-class></div><div></filter></div><div> </div><div><filter-mapping></div><div> <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name></div><div> <url-pattern>/Authn/RemoteUser</url-pattern></div>
<div></filter-mapping></div><div><br></div><div>- Is correct to change these blocks in this way (change only the url to my CAS server)? Is necessary to change also <context-param></div><div> <param-name>serverName</param-name> ? Is necessary to change something else? </div>
<div><br></div><div>With this configuration when I try to test my Shibbolet Idp (using testshib service) I have a 500 internal error and I see (in my browser) a redirect url (in the browser url bar) similar to my host /Authn/RemoteUser</div>
<div><br></div><div>All these steps are correct?</div><div>I possible to have same info to configure shibboleth with a CAS server?</div><div><br></div><div>Thank to all</div></div>
<div><br></div><div><br></div><div><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">
2013/11/27 Kevin P. Foote <span dir="ltr"><<a href="mailto:kpfoote@iup.edu" target="_blank">kpfoote@iup.edu</a>></span><br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><br>
On Wed, 27 Nov 2013, Gianluigi Ruggeri wrote:<br>
<br>
> Probably I not have understood very well the question about Shibbolteth<br>
> metadata.<br>
<br>
</div>Metadata is how the two ends of the SAML exchange know how to<br>
communicate with each other.<br>
<br>
<<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/Metadata" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/Metadata</a>><br>
<div><br>
> Are correct these steps? Why I obtain an error about the metadata?<br>
> An other question: I use a tomcat with my certificate (SSL)...is correct<br>
> regenerate an other certificate as requested during the shibbolteh<br>
> instalaltion? Is possibile that this is a problem?<br>
<br>
</div>Yes so far your steps are ok .. you just need to continue on a bit.<br>
<br>
I do not see your metadata in the testshib service currently. You need to<br>
take your metadata file and register with the testshib service. [1]<br>
<br>
You then need to load the testshib metadata into your IdP config. [2]<br>
<br>
When these two steps are done then you can make a request to the<br>
testshib sp. [3]<br>
<br>
<br>
<br>
<br>
<br>
[1] <a href="https://testshib.org/register.html" target="_blank">https://testshib.org/register.html</a><br>
<br>
[2] <a href="https://testshib.org/configure.html" target="_blank">https://testshib.org/configure.html</a><br>
<br>
[3] <a href="https://sp.testshib.org/" target="_blank">https://sp.testshib.org/</a><br>
<div><div><br>
<br>
<br>
------<br>
thanks<br>
kevin.foote<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>