<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Tue, 26 Aug 2014, at 10:43 , Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On 8/26/14, 2:13 PM, "David Bantz" <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br><blockquote type="cite"><br>I¹m integrating my IdP with a vendor¹s Shibboleth SP. I¹m puzzled by the<br>error he reports is triggered after receiving my IdP¹s SAML:<br></blockquote><br>You're just confused because he's wrong. That's your IdP throwing the<br>usual "I have no metadata for the SP" error. He's not receiving anything<br>from you by that point.<br></blockquote><div><br></div><div>Ah yes, he didn’t believe or understand my statement that only my DEV/TEST IdP </div><div>was configured. Yes, he used the production IdP which doesn’t have the SP metadata</div><div>and got “the usual."</div><div>(The DEV/TEST IdP does have metadata and responds with good SAML assertion,</div><div>which I had dutifully copied before encryption and provided the vendor.)</div><br><blockquote type="cite"><blockquote type="cite">2) the entityID of my IdP is urn:mace:incommon:alaska.edu but apart from<br>the amusing typo,<br>why would Apache on the service side need my IdP¹s entityID?<br></blockquote><br>To avoid discovery, you give it the IdP to use.<br></blockquote><br>Apache, in addition to or instead of SP’s shibboleth2.xml for which I gave them</div><div>exact snippet to consume my IdP metadata?</div><div><br></div><div>Further communication from vendor indicates they have the following Apache config snippet:</div><div><span style="color: rgb(43, 46, 47); font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 13px; line-height: 22px; white-space: nowrap; background-color: rgb(248, 248, 248);"><span class="Apple-tab-span" style="white-space:pre"> </span><Location /></span><br style="color: rgb(43, 46, 47); font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 13px; line-height: 22px; white-space: nowrap;"><span style="color: rgb(43, 46, 47); font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 13px; line-height: 22px; white-space: nowrap; background-color: rgb(248, 248, 248);"><span class="Apple-tab-span" style="white-space:pre"> </span>ShibRequestSetting applicationId urn:mace:incommon:alaska.edu</span><br style="color: rgb(43, 46, 47); font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 13px; line-height: 22px; white-space: nowrap;"><span style="color: rgb(43, 46, 47); font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', 'Courier New', monospace, serif; font-size: 13px; line-height: 22px; white-space: nowrap; background-color: rgb(248, 248, 248);"><span class="Apple-tab-span" style="white-space:pre"> </span></Location></span></div><div>Isn’t that supposed to be the name of the vendor’s service instead of my IdP?</div><div>(and in any case bad syntax isn’t it? - how could that possibly work?)</div><div><br></div></body></html>