<html>
<head>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
</head>
<body alink="#EE0000" bgcolor="#ffffff" link="#0B6CDA" text="#000000"
vlink="#551A8B">
<p>Hi guys,</p>
<p>I am setting up ADFS 3.0 and SAML 2.0 using Shibboleth as a
Service Provider (SP). I have successfully imported the
certificates to ADFS. The ADFS Claims Provider (or ADFS IDP) login
page works, because the user is redirected to:<br>
<br>
<a class="moz-txt-link-freetext"
href="https://c-adfs01.contoso.com/Shibboleth.sso/SAML2/POST">https://c-adfs01.contoso.com/Shibboleth.sso/SAML2/POST</a><br>
<br>
after logging in to:<br>
<br>
<a class="moz-txt-link-freetext"
href="https://c-adfs01.contoso.com/adfs/ls/idpinitiatedsignon">https://c-adfs01.contoso.com/adfs/ls/idpinitiatedsignon</a><br>
<br>
However, whenever I run this command: <br>
<br>
systemctl restart shibd && systemctl restart httpd<br>
<br>
I get the following errors:<br>
<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 2732, message: grammar not found for namespace '<a
class="moz-txt-link-freetext"
href="http://docs.oasis-open.org/wsfed/federation/200706">http://docs.oasis-open.org/wsfed/federation/200706</a>'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 2732, message: attribute 'ServiceDisplayName' is
not declared for element 'RoleDescriptor'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 3923, message: no declaration found for element
'fed:ClaimTypesRequested'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 24961, message: no declaration found for element
'fed:TargetScopes'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 25333, message: no declaration found for element
'fed:ApplicationServiceEndpoint'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 25536, message: no declaration found for element
'fed:PassiveRequestorEndpoint'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 25724, message: element 'fed:ClaimTypesRequested'
is not allowed for content model
'(Signature?,Extensions?,KeyDescriptor*,Organization?,ContactPerson*)'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 26099, message: grammar not found for namespace '<a
class="moz-txt-link-freetext"
href="http://docs.oasis-open.org/wsfed/federation/200706">http://docs.oasis-open.org/wsfed/federation/200706</a>'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 26099, message: attribute 'ServiceDisplayName' is
not declared for element 'RoleDescriptor'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 27277, message: no declaration found for element
'fed:TokenTypesOffered'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 27444, message: no declaration found for element
'fed:ClaimTypesOffered'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 48496, message: no declaration found for element
'fed:SecurityTokenServiceEndpoint'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 49192, message: no declaration found for element
'fed:PassiveRequestorEndpoint'<br>
2016-11-09 16:54:36 ERROR XMLTooling.ParserPool : error on
line 1, column 49380, message: element 'fed:TokenTypesOffered' is
not allowed for content model
'(Signature?,Extensions?,KeyDescriptor*,Organization?,ContactPerson*)'<br>
2016-11-09 16:54:36 ERROR OpenSAML.MetadataProvider.XML :
error while loading resource
(<a class="moz-txt-link-freetext"
href="https://c-adfs01.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml">https://c-adfs01.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml</a>):
XML error(s) during parsing, check log for specifics<br>
2016-11-09 16:54:36 WARN OpenSAML.MetadataProvider.XML :
adjusted reload interval to 600 seconds<br>
2016-11-09 16:54:36 CRIT Shibboleth.Application : error
initializing MetadataProvider: XML error(s) during parsing, check
log for specifics<br>
<br>
Here's my shibboleth.xml configuration<br>
<br>
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"<br>
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"<br>
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br>
xmlns:samlp="urn:oasis:names:tc:SAML::2.0:protocol"<br>
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br>
clockSkew="180"><br>
<br>
<br>
<!-- ADFS Extension --><br>
<OutOfProcess><br>
<Extensions><br>
<Library path="/usr/lib64/shibboleth/adfs.so"
fatal="true"/><br>
</Extensions><br>
</OutOfProcess><br>
<InProcess logger="native.log" checkSpoofing="true"><br>
<Extensions><br>
<Library
path="/usr/lib64/shibboleth/adfs-lite.so" fatal="true"/><br>
</Extensions><br>
</InProcess><br>
<RequestMapper type="Native"<br>
sessionError="/var/log/shibboleth/session_error.log"<br>
metadataError="/var/log/shibboleth/metadata_error.log"<br>
accessError="/var/log/shibboleth/access_error.log"<br>
sslError="/var/log/shibboleth/ssl_error.log"><br>
<RequestMap applicationId="default"><br>
<Host name="c-app01"><br>
<Path name="secure" authType="shibboleth"
requireSession="true"/><br>
</Host><br>
</RequestMap><br>
</RequestMapper><br>
<br>
<!-- The ApplicationDefaults element is where most of
Shibboleth's SAML bits are defined. --><br>
<ApplicationDefaults entityID=<a
class="moz-txt-link-rfc2396E"
href="https://c-app01.contoso.com/Shibboleth.sso/Metadata.xml">"https://c-app01.contoso.com/Shibboleth.sso/Metadata.xml"</a><br>
REMOTE_USER="eppn persistent-id targeted-id"><br>
<Sessions lifetime="28800" timeout="3600"
relayState="ss:mem"<br>
checkAddress="false" handlerSSL="true"
cookieProps="https"><br>
<!-- Putting another SSO here will make shibd
fail. There should only be one SSO. --><br>
<SSO><br>
SAML2 SAML1 ADFS<br>
</SSO><br>
<!-- SAML and local-only logout. --><br>
<Logout>SAML2 Local</Logout><br>
<!-- Extension service that generates
"approximate" metadata based on SP configuration. --><br>
<Handler type="MetadataGenerator"
Location="/Metadata.xml" signing="false"/><br>
<!-- Status reporting service. --><br>
<Handler type="Status" Location="/Status"
acl="127.0.0.1 ::1"/><br>
<!-- Session diagnostic service. --><br>
<Handler type="Session" Location="/Session"
showAttributeValues="false"/><br>
<!-- JSON feed of discovery information. --><br>
<Handler type="DiscoveryFeed"
Location="/DiscoFeed"/><br>
</Sessions><br>
<Errors supportContact="root@localhost"<br>
helpLocation="/about.html"<br>
styleSheet="/shibboleth-sp/main.css"/><br>
<!-- Example of remotely supplied batch of signed
metadata. --><br>
<br>
<br>
<!-- using validate="true" will give errors in
Federationmetadata.xml--><br>
<MetadataProvider type="XML" validate="true"<br>
uri=<a class="moz-txt-link-rfc2396E"
href="https://c-adfs01.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml">"https://c-adfs01.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml"</a><br>
reloadInterval="3600"><br>
<DiscoveryFilter type="Blacklist"
matcher="EntityAttributes" trimTags="true"<br>
attributeName=<a class="moz-txt-link-rfc2396E"
href="http://macedir.org/entity-category">"http://macedir.org/entity-category"</a><br>
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"<br>
attributeValue=<a class="moz-txt-link-rfc2396E"
href="http://refeds.org/category/hide-from-discovery">"http://refeds.org/category/hide-from-discovery"</a>
/><br>
</MetadataProvider><br>
<!-- Example of locally maintained metadata. --><br>
<AttributeExtractor type="XML" validate="true"
reloadChanges="false" path="attribute-map.xml"/><br>
<!-- Use a SAML query if no attributes are supplied
during SSO. --><br>
<AttributeResolver type="Query"
subjectMatch="true"/><br>
<!-- Default filtering policy for recognized
attributes, lets other data pass. --><br>
<AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/><br>
<!-- Simple file-based resolver for using a single
keypair. --><br>
<CredentialResolver type="File"
key="c-app01.contoso.com.key"
certificate="c-app01.contoso.com.pem"/><br>
</ApplicationDefaults><br>
<br>
<br>
<!-- Policies that determine how to process and
authenticate runtime messages. --><br>
<SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/><br>
<br>
<br>
<!-- Low-level configuration about protocols and
bindings available for use. --><br>
<ProtocolProvider type="XML" validate="true"
reloadChanges="false" path="protocols.xml"/><br>
<br>
<br>
</SPConfig><br>
<br>
<br>
Here's my apache configuration: <br>
<br>
LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so<br>
<br>
ShibCompatValidUser Off<br>
<br>
<Location /Shibboleth.sso><br>
SetHandler shib<br>
AuthType None<br>
Require all granted<br>
</Location><br>
<br>
So, my question is... how do I configure the Service Provider to
get the ClaimTypesOffered, etc. (in the error) to remove the
errors?<br>
</p>
<br>
<pre class="moz-signature" cols="72">--
Franz Noel Tanglao
Database Analyst
ext.7126
<a class="moz-txt-link-abbreviated" href="mailto:ftanglao@musicreports.com">ftanglao@musicreports.com</a></pre>
</body>
</html>