<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 8/5/15 3:45 PM, Michael Dahlberg
wrote:<br>
</div>
<blockquote
cite="mid:CAB7JRmMLW8UcQMO=OUAO=k86B10bRWUJ7v4J9xWHRHupGWqUwg@mail.gmail.com"
type="cite">
<div dir="ltr">I'm having a strange problem that I'm hoping
someone could help with. In the Shibboleth IdP (v.2.40), I've
loaded metadata for the SP entity ID <a moz-do-not-send="true"
href="https://example.bucknell.edu">https://example.bucknell.edu</a>
</div>
</blockquote>
<br>
Based on the log below, that's actually not the entityID... <br>
<br>
<blockquote
cite="mid:CAB7JRmMLW8UcQMO=OUAO=k86B10bRWUJ7v4J9xWHRHupGWqUwg@mail.gmail.com"
type="cite">
<div dir="ltr">and included the endpoints <a
moz-do-not-send="true"
href="https://example.bucknell.edu/shibboleth"><a class="moz-txt-link-freetext" href="https://example.bucknell.edu/shibboleth">https://example.bucknell.edu/shibboleth</a></a>
and <a moz-do-not-send="true"
href="http://example.bucknell.edu/shibboleth">http://example.bucknell.edu/shibboleth</a>.
</div>
</blockquote>
<br>
Don't know what you mean by "endpoint" here. Those are not typical
endpoints for a Shibboleth SP (or IdP for that matter).<br>
<br>
<blockquote
cite="mid:CAB7JRmMLW8UcQMO=OUAO=k86B10bRWUJ7v4J9xWHRHupGWqUwg@mail.gmail.com"
type="cite">
<div dir="ltr">The attribute-filter.xml file is configured to
release the same attributes regardless of whether the
AttributeRequesterString is either the http or the https
variant. <br>
</div>
</blockquote>
<br>
The entityID scheme (if it's a URL) will never vary. It's either
https or http, period. That's because it's an identifier, not a
(necessarily) reachable endpoint. I think you're confused about
what the entityID is.<br>
<br>
<blockquote
cite="mid:CAB7JRmMLW8UcQMO=OUAO=k86B10bRWUJ7v4J9xWHRHupGWqUwg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>14:10:57.566 - INFO [Shibboleth-Audit:1028] -
20150805T181057Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_ffde89b008ca7d858f7f4ea8735d2eb2|<a
moz-do-not-send="true"
href="https://example.bucknell.edu/shibboleth%7Curn:mace:shibboleth:2.0:profiles:saml2:sso%7Chttps://shib.bucknell.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_dc9c3bfd14ebf25b51c8a1495d05a3d7%7Cfertig%7Curn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport%7C%7C_7cc0122db7f58781ffb4238839b9646c%7C_cac1d35e2b3dafdbecf6ba1563918a8c,%7C"><a class="moz-txt-link-freetext" href="https://example.bucknell.edu/shibboleth">https://example.bucknell.edu/shibboleth</a>|urn:mace:shibboleth:2.0:profiles:saml2:sso|<a class="moz-txt-link-freetext" href="https://shib.bucknell.edu/idp/shibboleth">https://shib.bucknell.edu/idp/shibboleth</a>|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_dc9c3bfd14ebf25b51c8a1495d05a3d7|fertig|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_7cc0122db7f58781ffb4238839b9646c|_cac1d35e2b3dafdbecf6ba1563918a8c,|</a><br>
</div>
<div><br>
</div>
</div>
</blockquote>
<br>
<br>
Based on that entry, the SP's entityID is:
<a class="moz-txt-link-freetext" href="https://example.bucknell.edu/shibboleth">https://example.bucknell.edu/shibboleth</a>. That's what you should be
configuring in your attribute filter - and should also match the
EntityDescriptor entityID attribute in the metadata you are loading.<br>
<br>
</body>
</html>