<div dir="ltr">All,<div><br></div><div>I&#39;m getting the idp up and running for some testing and am running into an issue.  The idp is running on CentOS 6.6 and tomcat 7 with openjdk and an apache 2.2 instance in front of it.  My steps to deploy were:</div><div><br></div><div>1.  Download the idp</div><div>2.  Run ./install.sh</div><div>3.  copy idp.war to tomcat7/webapps</div><div>4.  setn JAVA_OPTS=&quot;-Didp.home=...&quot;</div><div>5.  update ldap.properties</div><div>6.  Created a metadata file from the SP (below)</div><div><br></div><div>&lt;md:EntityDescriptor xmlns:md=&quot;urn:oasis:names:tc:SAML:2.0:metadata&quot; ID=&quot;fefb24095e308700eef9645f733ddb0f47649a80b&quot; entityID=&quot;<a href="http://sp.autoidm.com:9090/auth/SAML2Auth">http://sp.autoidm.com:9090/auth/SAML2Auth</a>&quot;&gt;&lt;md:SPSSODescriptor AuthnRequestsSigned=&quot;false&quot; WantAssertionsSigned=&quot;false&quot; protocolSupportEnumeration=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;&lt;md:SingleLogoutService Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect&quot; Location=&quot;<a href="http://sp.autoidm.com:9090/auth/SAML2Auth">http://sp.autoidm.com:9090/auth/SAML2Auth</a>&quot;/&gt;&lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified&lt;/md:NameIDFormat&gt;&lt;md:AssertionConsumerService Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&quot; Location=&quot;<a href="http://sp.autoidm.com:9090/auth/SAML2Auth">http://sp.autoidm.com:9090/auth/SAML2Auth</a>&quot; index=&quot;0&quot; isDefault=&quot;true&quot;/&gt;&lt;md:AssertionConsumerService Binding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect&quot; Location=&quot;<a href="http://sp.autoidm.com:9090/auth/SAML2Auth">http://sp.autoidm.com:9090/auth/SAML2Auth</a>&quot; index=&quot;1&quot; isDefault=&quot;false&quot;/&gt;&lt;/md:SPSSODescriptor&gt;&lt;/md:EntityDescriptor&gt;<br></div><div><br></div><div>7.  Configured the SP with the idp&#39;s metadata</div><div>8.  Restart tomcat</div><div>9.  Start an SSO request with the following authnrequest:</div><div><br></div><div>







<p class=""><span class="">&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;</span></p>
<p class=""><span class="">&lt;saml2p:AuthnRequest</span></p>
<p class=""><span class="">    AssertionConsumerServiceURL=&quot;<a href="http://sp">http://sp</a>.</span><span class="">autoidm</span><span class="">.com:9090/auth/SAML2Auth&quot;</span></p>
<p class=""><span class="">    Destination=&quot;<a href="http://shib2x.tremolo.lan/idp/profile/SAML2/Redirect/SSO">http://shib2x.tremolo.lan/idp/profile/SAML2/Redirect/SSO</a>&quot;</span></p>
<p class=""><span class="">    ForceAuthn=&quot;false&quot; ID=&quot;fd017028a1763d5962be00c5effe7b5a0a0a87260&quot;</span></p>
<p class=""><span class="">    IsPassive=&quot;false&quot; IssueInstant=&quot;2015-03-10T12:54:57.591Z&quot;</span></p>
<p class=""><span class="">    ProtocolBinding=&quot;urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&quot;</span></p>
<p class=""><span class="">    Version=&quot;2.0&quot; xmlns:saml2p=&quot;urn:oasis:names:tc:SAML:2.0:protocol&quot;&gt;</span></p>
<p class=""><span class="">    &lt;saml2:Issuer xmlns:saml2=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;&gt;<a href="http://sp">http://sp</a>.</span><span class="">autoidm</span><span class="">.com:9090/auth/SAML2Auth&lt;/saml2:Issuer&gt;</span></p>
<p class=""><span class="">    &lt;saml2p:RequestedAuthnContext Comparison=&quot;exact&quot;&gt;</span></p>
<p class=""><span class="">        &lt;saml2:AuthnContextClassRef xmlns:saml2=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/saml2:AuthnContextClassRef&gt;</span></p>
<p class=""><span class="">    &lt;/saml2p:RequestedAuthnContext&gt;</span></p>
<p class=""><span class="">&lt;/saml2p:AuthnRequest&gt;</span></p><p class=""><span class=""><br></span></p><p class=""><span class="">Instead of being prompted to login I get the following error:</span></p><p class="">







</p><p class=""><span class="">WARN [org.opensaml.xmlsec.impl.BasicEncryptionParametersResolver:221] - Validation failure: Failed to resolve both a data and a key encryption credential</span></p><p class=""><span class="">I&#39;m guessing this is because the idp expects the authnrequest to be signed and/or encrypted?  if so how do I disable that?</span></p><p class="">Any help would be greatly appreciated.</p><p class="">Thanks</p><p class="">Marc</p></div></div>