<div dir="ltr">Thanks Kevin and Simon for chiming in and helping out, maybe I am not going insane after all!<div><br></div><div>Ken</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jan 9, 2015 at 9:13 AM, Simon Gaeremynck <span dir="ltr"><<a href="mailto:gaeremyncks@gmail.com" target="_blank">gaeremyncks@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">If it helps,<br>
<br>
I was running into similar problems earlier this week. I had succesfully registered<br>
and tested our SP with testshib a couple of weeks ago. When doing some more<br>
work on it this week, the TestShib IdP gave me the same error as Ken is getting.<br>
<br>
Assuming TestShib prunes the list of SPs every few weeks, I registered a new entity<br>
and but when trying to go through the authentication workflow I got the same error.<br>
<br>
My entity ids:<br>
- <a href="https://shib-sp.qa0.timetable.grasshopper.fronteer.io/shibboleth" target="_blank">https://shib-sp.qa0.timetable.grasshopper.fronteer.io/shibboleth</a><br>
- <a href="https://shib-sp.qa0.timetable.grasshopper.fronteer.io/shibboleth2" target="_blank">https://shib-sp.qa0.timetable.grasshopper.fronteer.io/shibboleth2</a><br>
<br>
Hope that helps!<br>
<span class="HOEnZb"><font color="#888888"><br>
Simon<br>
</font></span><br>
PS: Many thanks for the awesome service btw, it’s been super helpful when trying to set things up!<br>
<div class="HOEnZb"><div class="h5"><br>
> On 9 Jan 2015, at 16:08, Kevin Foote <<a href="mailto:kpfoote@uoregon.edu">kpfoote@uoregon.edu</a>> wrote:<br>
><br>
> Ken -<br>
> I’ll take a look.<br>
> Seems you are not alone.<br>
><br>
><br>
> FYI put testshib in the subject it helps me out a bunch! :-)<br>
><br>
><br>
> --------<br>
> thanks<br>
> kevin.foote<br>
><br>
>> On Jan 9, 2015, at 8:06 AM, Ken Swift <<a href="mailto:swiftk77@gmail.com">swiftk77@gmail.com</a>> wrote:<br>
>><br>
>> I have been beating my head trying to register my SP with the testshib IdP for the past could of days. I have overhauled my shibboleth2.xml config multiple times and uploaded my metadata, but ever time to try to access my secured directory I get the following error:<br>
>><br>
>> SAML 2 SSO profile is not configured for relying party <a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a><br>
>><br>
>> I looked into the IdP logs and get the following details:<br>
>><br>
>> 11:00:15.532 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for <a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a><br>
>><br>
>> 11:00:15.532 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for<br>
>> <a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a><br>
>> , looking up configuration based on metadata groups.<br>
>> 11:00:15.533 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for<br>
>> <a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a><br>
>> . Using default relying party configuration.<br>
>> 11:00:15.533 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID '<br>
>> <a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a><br>
>> ' could not be resolved<br>
>> 11:00:15.534 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:387] - Decoded request from relying party '<br>
>> <a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a><br>
>> '<br>
>> 11:00:15.534 - WARN [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:305] - No metadata for relying party<br>
>> <a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a>, treating party as anonymous<br>
>> I looked on the TestShib.org About/Current Entity List and ensure that my EntityID is listed and it is:<br>
>><br>
>> EntityID <a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a><br>
>><br>
>> Anyone have any ideas?<br>
>><br>
>><br>
>> For reference here is my metadata:<br>
>><br>
>> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_989e564f01aa0e26eba49692bcfb9685a62e71af" entityID="<a href="https://shib.zurigroup.com/shibboleth" target="_blank">https://shib.zurigroup.com/shibboleth</a>"><br>
>><br>
>> <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"><br>
>> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha512" target="_blank">http://www.w3.org/2001/04/xmlenc#sha512</a>"/><br>
>> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#sha384" target="_blank">http://www.w3.org/2001/04/xmldsig-more#sha384</a>"/><br>
>> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#sha256" target="_blank">http://www.w3.org/2001/04/xmlenc#sha256</a>"/><br>
>> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#sha224" target="_blank">http://www.w3.org/2001/04/xmldsig-more#sha224</a>"/><br>
>> <alg:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#sha1</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512" target="_blank">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384" target="_blank">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256" target="_blank">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224" target="_blank">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" target="_blank">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" target="_blank">http://www.w3.org/2001/04/xmldsig-more#rsa-sha384</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" target="_blank">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2009/xmldsig11#dsa-sha256" target="_blank">http://www.w3.org/2009/xmldsig11#dsa-sha256</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1" target="_blank">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/><br>
>> <alg:SigningMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#dsa-sha1" target="_blank">http://www.w3.org/2000/09/xmldsig#dsa-sha1</a>"/><br>
>> </md:Extensions><br>
>><br>
>> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol"><br>
>> <md:Extensions><br>
>> <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/Login" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/Login</a>"/><br>
>> </md:Extensions><br>
>> <md:KeyDescriptor><br>
>> <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>"><br>
>> <ds:KeyName><a href="https://idp.testshib.org/idp/shibboleth" target="_blank">https://idp.testshib.org/idp/shibboleth</a></ds:KeyName><br>
>> <ds:KeyName><a href="http://shib.zurigroup.com" target="_blank">shib.zurigroup.com</a></ds:KeyName><br>
>> <ds:X509Data><br>
>> <ds:X509SubjectName>CN=<a href="http://shib.zurigroup.com" target="_blank">shib.zurigroup.com</a></ds:X509SubjectName><br>
>> <ds:X509Certificate>MIIDJjCCAg6gAwIBAgIJAKf+olmYWxHoMA0GCSqGSIb3DQEBBQUAMB0xGzAZBgNV<br>
>> BAMTEnNoaWIuenVyaWdyb3VwLmNvbTAeFw0xNTAxMDkwNDEzMjJaFw0yNTAxMDYw<br>
>> NDEzMjJaMB0xGzAZBgNVBAMTEnNoaWIuenVyaWdyb3VwLmNvbTCCASIwDQYJKoZI<br>
>> hvcNAQEBBQADggEPADCCAQoCggEBALbRR3ny9hEEV2ut8W4jokvzAnbWL6Z+FCHL<br>
>> yt/rppTwmVzX0HLwLo+oxzRaW2CkYGXNAc6VAPwawXPmm9oAQNrF8Q/ZUpUn1urs<br>
>> jMZbjf4Xdio9CfLq2Nokip/+txMf4RpCucAX6jHrq67QkaJfYFbmjiqYXNq3mZxe<br>
>> jx6J6tS32CZQC4k6+IpgMofCwFecwqjqnwAIM/Y60PdRjuIqwbkHBADEMkXmGkq3<br>
>> uviydm3trNUO9oa8pYpwbZ8ClLYHG5HVRxJs2SL7QX4PRH6KrrEgkI/EG0QvaWyq<br>
>> Me5XVPF7du3WF86/+VMR1VlrSDcPHj1/Ct5YvxcvCFTxT2RJuOMCAwEAAaNpMGcw<br>
>> RgYDVR0RBD8wPYISc2hpYi56dXJpZ3JvdXAuY29thidodHRwczovL2lkcC50ZXN0<br>
>> c2hpYi5vcmcvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFEhSSSTn6XlmnITYjLGQ<br>
>> LYjoR9lxMA0GCSqGSIb3DQEBBQUAA4IBAQAmNeU2pC/RatTwr3CicLEa/KB/RSl7<br>
>> Iff88J/+1OwHY3izVv2+8OQmjCy/nP8Bnco8XsNz2O3OqNvXISG0dpKu75lNBHzs<br>
>> vPK0qfoP2FPUwXkrJ24pQRt35FtrHAq/uSf+NMuupZdHq7yWoc5eTCBKekjFMD8I<br>
>> +3dksquQMGsIwFx2vs9Rg/RbAwgxJO0Ay51f3OBohFNVJsohe9Uf6dqXLi2WXvBQ<br>
>> I+C58dRZcN+ZQGNSJSVIGqoFcpW+jjf1jc47scUJPssQoECWWRq9vO0nm/5Ca8LB<br>
>> j1D19y89FUn9SYgL5K/eD7VlJ+jwoT7gTJP/XlxOdw1MhVcoe4OVKM6Z<br>
>> </ds:X509Certificate><br>
>> </ds:X509Data><br>
>> </ds:KeyInfo><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2009/xmlenc11#aes128-gcm" target="_blank">http://www.w3.org/2009/xmlenc11#aes128-gcm</a>"/><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2009/xmlenc11#aes192-gcm" target="_blank">http://www.w3.org/2009/xmlenc11#aes192-gcm</a>"/><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2009/xmlenc11#aes256-gcm" target="_blank">http://www.w3.org/2009/xmlenc11#aes256-gcm</a>"/><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc" target="_blank">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a>"/><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes192-cbc" target="_blank">http://www.w3.org/2001/04/xmlenc#aes192-cbc</a>"/><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes256-cbc" target="_blank">http://www.w3.org/2001/04/xmlenc#aes256-cbc</a>"/><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" target="_blank">http://www.w3.org/2001/04/xmlenc#tripledes-cbc</a>"/><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2009/xmlenc11#rsa-oaep" target="_blank">http://www.w3.org/2009/xmlenc11#rsa-oaep</a>"/><br>
>> <md:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" target="_blank">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</a>"/><br>
>> </md:KeyDescriptor><br>
>> <md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/Artifact/SOAP" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/Artifact/SOAP</a>" index="1"/><br>
>> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SLO/SOAP" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SLO/SOAP</a>"/><br>
>> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SLO/Redirect" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SLO/Redirect</a>"/><br>
>> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SLO/POST" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SLO/POST</a>"/><br>
>> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SLO/Artifact" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SLO/Artifact</a>"/><br>
>> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SAML2/POST" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SAML2/POST</a>" index="1"/><br>
>> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SAML2/POST-SimpleSign" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SAML2/POST-SimpleSign</a>" index="2"/><br>
>> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SAML2/Artifact" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SAML2/Artifact</a>" index="3"/><br>
>> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SAML2/ECP" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SAML2/ECP</a>" index="4"/><br>
>> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SAML/POST" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SAML/POST</a>" index="5"/><br>
>> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="<a href="https://shib.zurigroup.com/Shibboleth.sso/SAML/Artifact" target="_blank">https://shib.zurigroup.com/Shibboleth.sso/SAML/Artifact</a>" index="6"/><br>
>> </md:SPSSODescriptor><br>
>><br>
>> </md:EntityDescriptor><br>
>> --<br>
>> Ken Swift<br>
>> <a href="mailto:ken@netoutlook.com">ken@netoutlook.com</a><br>
>> --<br>
>> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Ken Swift<br><a href="mailto:ken@netoutlook.com">ken@netoutlook.com</a></div>
</div>