<div dir="ltr"><div><span style="font-family:courier new,monospace">Hi everyone. I'm new to the user list. I'm trying to set up a federation in my country; I've succesfully installed a test IdP and a test SP (with embedded DS)... but I'm having problems setting up a centralized discovery service.<br>
<br>My IdP and my SP work fine with each other, either directly or with the embedded DS.<br><br>I've set up the CDS on a Ubuntu 14.04 virtual server. The installation procedure was very similar to the the IdP. I set a federation XML available there, with only my IdP's and SP's. Here it is (trimmed for space reasons, I can post it complete to a PasteBin-like site if necessary):<br>
<br><EntitiesDescriptor Name="<a href="https://cdsserver.inca.net.pe/metadata/inca-federation.xml">https://cdsserver.inca.net.pe/metadata/inca-federation.xml</a>"<br> xmlns="urn:oasis:names:tc:SAML:2.0:metadata"<br>
xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"<br> xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"><br>
<!-- Actual providers go here. --><br> <!-- Start: <a href="http://idpserver.entidad.edu.pe">idpserver.entidad.edu.pe</a> --><br> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"<br>
entityID="<a href="https://idpserver.entidad.edu.pe/idp/shibboleth">https://idpserver.entidad.edu.pe/idp/shibboleth</a>"<br></span></div><span style="font-family:courier new,monospace"> [TRIMMED]<br>
</span><div><span style="font-family:courier new,monospace"> </EntityDescriptor><br> <!-- End: <a href="http://idpserver.entidad.edu.pe">idpserver.entidad.edu.pe</a> --><br> <!-- Start: <a href="http://idp.instituto.edu.pe">idp.instituto.edu.pe</a> --><br>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"<br> entityID="<a href="https://idp.instituto.edu.pe/idp/shibboleth">https://idp.instituto.edu.pe/idp/shibboleth</a>"<br></span></div>
<div><span style="font-family:courier new,monospace"> [TRIMMED]<br></span></div><div><span style="font-family:courier new,monospace"> </EntityDescriptor><br> <!-- End: <a href="http://idp.instituto.edu.pe">idp.instituto.edu.pe</a> --><br>
<!-- Start: <a href="http://spserver.redprivada.com.pe">spserver.redprivada.com.pe</a> --><br> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br> ID="_2f88be8f2520ab67291aa6e18c80c1e3c015bcdf"<br>
entityID="<a href="https://spserver.redprivada.com.pe/shibboleth">https://spserver.redprivada.com.pe/shibboleth</a>"><br> </span><span style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">[TRIMMED]<br>
</span> </md:EntityDescriptor><br> <!-- End: <a href="http://spserver.redprivada.com.pe">spserver.redprivada.com.pe</a> --><br></EntitiesDescriptor><br><br>Here's the content of the wayfconfig.xml file:<br>
<br><?xml version="1.0" encoding="UTF-8"?><br><WayfConfig xmlns="urn:mace:shibboleth:wayf:config:1.0"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"><br>
<Default jspFile="wayf.jsp"<br> errorJspFile="wayferror.jsp"<br> provideList="true"<br> provideListOfList="false"<br> warnOnBadBinding="false"<br>
warnOnNoSAML2="false"<br> showUnusableIdPs="false"><br> <SearchIgnore><br> <IgnoreText>Institution</IgnoreText><br> <IgnoreText>University</IgnoreText><br>
<IgnoreText>State </IgnoreText><br> <IgnoreText>School</IgnoreText><br> </SearchIgnore><br> </Default><br> <MetadataProvider<br> displayName="IDP Classic"<br>
identifier="<a href="https://idpserver.entidad.edu.pe">https://idpserver.entidad.edu.pe</a>"<br> backingFile="/opt/shibboleth-ds/metadata/idpserver.entidad.edu.pe-metadata.xml"<br> url="<a href="https://idpserver.entidad.edu.pe/idp/profile/Metadata/SAML">https://idpserver.entidad.edu.pe/idp/profile/Metadata/SAML</a>"/><br>
<MetadataProvider<br> displayName="SP Classic"<br> identifier="<a href="https://spserver.redprivada.com.pe">https://spserver.redprivada.com.pe</a>"<br> url="file:/opt/shibboleth-ds/metadata/spserver.redprivada.com.pe-metadata.xml"/><br>
<Plugin identifier="CookiePlugin"<br> type="edu.internet2.middleware.shibboleth.wayf.plugins.provider.SamlCookiePlugin"<br> alwaysFollow="FALSE"<br> deleteCookie="FALSE"<br>
cacheExpiration="604800"/><br> <Plugin identifier="DeleteCookiePlugin"<br> type="edu.internet2.middleware.shibboleth.wayf.plugins.provider.SamlCookiePlugin"<br> alwaysFollow="FALSE"<br>
deleteCookie="TRUE"<br> cacheExpiration="604800"/><br> <DiscoveryServiceHandler location=".+/WAYF" default="true"><br> <PluginInstance identifier="CookiePlugin"/><br>
</DiscoveryServiceHandler><br> <DiscoveryServiceHandler location=".+/ClearCache.wayf"><br> <PluginInstance identifier="DeleteCookiePlugin"/><br> </DiscoveryServiceHandler><br>
</WayfConfig><br><br>Now, on the side of the SP, this is the content of the shibboleth2.xml file:<br><br><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"<br> xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"<br>
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"<br> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br> clockSkew="180"><br>
<ApplicationDefaults entityID="<a href="https://spserver.redprivada.com.pe/shibboleth">https://spserver.redprivada.com.pe/shibboleth</a>"<br> homeURL="<a href="https://spserver.redprivada.com.pe/Shibboleth.sso/Session">https://spserver.redprivada.com.pe/Shibboleth.sso/Session</a>"<br>
REMOTE_USER="eppn persistent-id targeted-id"<br> signing="back"<br> requireTransportAuth="false"><br> <Sessions lifetime="28800"<br>
timeout="3600"<br> relayState="ss:mem"<br> checkAddress="true"<br> handlerSSL="true"<br>
cookieProps="https"><br> <SSO discoveryProtocol="SAMLDS"<br> discoveryURL="<a href="https://cdsserver.inca.net.pe/cds/index.htm">https://cdsserver.inca.net.pe/cds/index.htm</a>"><br>
SAML2 SAML1<br> </SSO><br> <Logout>SAML2 Local</Logout><br> <Handler type="MetadataGenerator"<br>
Location="/Metadata"<br> signing="false"/><br> <Handler type="Status"<br> Location="/Status"<br>
acl="127.0.0.1 ::1"/><br> <Handler type="Session"<br> Location="/Session"<br> showAttributeValues="false"/><br>
<Handler type="DiscoveryFeed"<br> Location="/DiscoFeed"/><br> </Sessions><br> <Errors supportContact="root@localhost"<br>
helpLocation="/about.html"<br> styleSheet="/shibboleth-sp/main.css"/><br> <MetadataProvider type="XML"<br> validate="true"<br>
uri="<a href="https://cdsserver.inca.net.pe/metadata/inca-federation.xml">https://cdsserver.inca.net.pe/metadata/inca-federation.xml</a>"<br> backingFilePath="/etc/shibboleth/metadata/inca-federation.xml"<br>
reloadInterval="3600"><br> <MetadataFilter type="RequireValidUntil"<br> maxValidityInterval="604800"/><br>
<MetadataFilter type="Signature"<br> certificate="/etc/shibboleth/certificate-data/inca.crt"/><br> </MetadataProvider><br>
<AttributeExtractor type="XML"<br> validate="true"<br> reloadChanges="false"<br> path="attribute-map.xml"/><br>
<AttributeResolver type="Query"<br> subjectMatch="true"/><br> <AttributeFilter type="XML"<br> validate="true"<br>
path="attribute-policy.xml"/><br> <CredentialResolver type="File"<br> key="sp-key.pem"<br> certificate="sp-cert.pem"/><br>
</ApplicationDefaults><br> <SecurityPolicyProvider type="XML"<br> validate="true"<br> path="security-policy.xml"/><br> <ProtocolProvider type="XML"<br>
validate="true"<br> reloadChanges="false"<br> path="protocols.xml"/><br></SPConfig><br><br>When I try to access a Shibboleth-protected resource on my SP, a page from the CDS server comes up saying:<br>
<br>Inter-institutional Access System Failure<br><br>The inter-institutional access system experienced a technical failure.<br><br>Please email administrator's name and include the following error message:<br><br>The Discovery Service should not be called directly<br>
<br>All my logs are set to "DEBUG", but I can't find anything on them pointing me to an error, neither from the SP side, nor the CDS side. I'm sure I'm doing something wrong, overlooking something... please, help me. Thanks in advance.<br>
</span></div></div>