<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<base href="x-msg://1000/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Ben,
<div><br>
</div>
<div>TestShib uses file names to allow you to replace metadata that you had uploaded previously. It's basically your tiny shared secret with TestShib. If you uploaded the metadata again under a different file name with the same entityID, expect the unexpected
because you will have two different copies of information for the same service.</div>
<div><br>
</div>
<div>If you don't know the file names that you used, please let me know and I'll go in there with the plunger.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Nate.</div>
<div><br>
<div>
<div>On Jul 8, 2014, at 1:05 PM, Ben Branch <<a href="mailto:BBranch@uco.edu">BBranch@uco.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
All,<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
This is my very first Shibboleth installation and I had it working fine as of about 5 hours ago. I had it working against the<span class="Apple-converted-space"> </span><a href="http://Testshib.org" style="color: purple; text-decoration: underline; ">Testshib.org</a><span class="Apple-converted-space"> </span>website
without any issues. I had been struggling to understand what people meant by “Updating the Metadata”. I googled and googled till I finally found a site that discussed updating Idp metadata. So, I did the following:<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Made a backup of the /opt/shibboleth-idp/metadata/idp-metadata.xml<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Made backups of the /opt/shibboleth-idp/credentials files (idp.crt, idp.key, and idp,jks).<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Used the following to create a new X509 certificate/key:<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
# cat > idp-cert.cnf <<EOF<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
[req]<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
prompt=no<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
default_bits=2048<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
encrypt_key=no<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
default_md=sha1<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
distinguished_name=dn<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
# PrintableStrings only<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
string_mask=MASK:0002<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
x509_extensions=ext<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
[dn]<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
CN=<a href="http://casdev.uco.edu" style="color: purple; text-decoration: underline; ">casdev.uco.edu</a><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
[ext]<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
subjectAltName=DNS:casdev.uco.edu,URI:https://<a href="http://casdev.uco.edu/idp/shibboleth" style="color: purple; text-decoration: underline; ">casdev.uco.edu/idp/shibboleth</a><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
subjectKeyIdentifier=hash<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
EOF<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
openssl req -config idp-cert.cnf -new -x509 -keyout idp.new.key -out idp.new.crt 2> /dev/null<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
After creating the new crt and key files, I copied them into the /opt/shibboleth-idp/credentials directory and renamed them to the right names and double checked ownership of the files. After renaming them, I did a “cat idp.crt” to get the X509 key and put
that into my /opt/shibboleth-idp/metadata/idp-metadata.xml. I then uploaded my metadata to<span class="Apple-converted-space"> </span><a href="http://testshib.org" style="color: purple; text-decoration: underline; ">testshib.org</a><span class="Apple-converted-space"> </span>to
test and see if my new certs are working and now I am getting the following error messages in their log:<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<b>2014-07-08 14:29:42 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [245]: unable to verify message signature with supplied trust engine<o:p></o:p></b></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<b>2014-07-08 14:29:42 WARN Shibboleth.SSO.SAML2 [245]: detected a problem with assertion: Message was signed, but signature could not be verified.<o:p></o:p></b></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<b> </b></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Additionally, I used the ./install.sh renew-cert to do this exact same thing, and I am still getting the same error message from<span class="Apple-converted-space"> </span><a href="http://testshib.org" style="color: purple; text-decoration: underline; ">testshib.org</a>and
I have uploaded the metadata file multiple times now with no luck. Is there something I’m missing? Or am I just being stupid and missing the obvious?<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 10pt; font-family: Verdana, sans-serif; ">Ben Branch<br>
UNIX/Linux Administrator</span><span style=""><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 10pt; font-family: Verdana, sans-serif; ">University of Central Oklahoma</span><span style=""><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 10pt; font-family: Verdana, sans-serif; ">ITIL Foundation v3, Network+, RHCSA<br>
<br>
100 N. University Drive, Box 122<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 10pt; font-family: Verdana, sans-serif; ">Edmond, OK 73034</span><span style=""><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 10pt; font-family: Verdana, sans-serif; ">D: 405.974.2649 | M: 405.550.6804 |<span class="Apple-converted-space"> </span></span><u><span style="font-size: 10pt; font-family: Verdana, sans-serif; color: blue; "><a href="mailto:bbranch@uco." style="color: purple; text-decoration: underline; "><span style="color: blue; ">bbranch@uco.</span></a>edu</span></u><span style="font-size: 10pt; font-family: Verdana, sans-serif; "><span class="Apple-converted-space"> </span>|<a href="http://www.uco.edu/" style="color: purple; text-decoration: underline; "><span style="color: blue; ">www.uco.edu</span></a></span><span style=""><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 10pt; font-family: Verdana, sans-serif; "> </span><span style=""><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 10pt; font-family: Verdana, sans-serif; ">“</span>I am wiser than this man, for neither of us appears to know anything great and good; but he fancies he knows something, although he knows nothing; whereas I, as I do not know anything,
so I do not fancy I do. In this trifling particular, then, I appear to be wiser than he, because I do not fancy I know what I do not know.<span style="font-size: 10pt; font-family: Verdana, sans-serif; ">” - Socrates</span><span style=""><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
</div>
<b>**Bronze+Blue=Green**</b><span class="Apple-converted-space"> </span>The University of Central Oklahoma is Bronze, Blue, and Green! Please print this e-mail only if absolutely necessary!<span class="Apple-converted-space"> </span><br>
<br>
<b>**CONFIDENTIALITY**</b><span class="Apple-converted-space"> </span>-This e-mail (including any attachments) may contain confidential, proprietary and privileged information. Any unauthorized disclosure or use of this information is prohibited. --<br>
To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: purple; text-decoration: underline; ">users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br>
</div>
</body>
</html>