<div dir="ltr">Fair enough.<div><br></div><div>So, as embarrassing as it is to admit, the initial issue was my own fault. My locally maintained 3rd party aggregate file had this same SP entry in it already, overriding the ACS changes I was adding. I have removed the duplicate now and I it's working except with one caveat which I hope to resolve.</div><div><br></div><div>It seems the apache vhost ServerName is still in play in the SP. If in my vhost I define ServerName "<a href="http://vhost.uah.edu">vhost.uah.edu</a>" then auth fails and the IDP shows trying to reach <a href="http://vhost.uah.edu:443/Shibboleth.sso/SAML2/POST">http://vhost.uah.edu:443/Shibboleth.sso/SAML2/POST</a> which fails since 443 is listening to https requests, not http. But if in the apache vhosts file I define ServerName with an https prefix, <a href="https://vhost.uah.edu">https://vhost.uah.edu</a>, it works. And this may be what has to be but it just feels wrong.</div><div><br></div><div>Shouldn't the ACS lines in the metadata in the IDP take precedence over the (I assume) dynamically built ACS lines the SP builds and sends to it?</div><div><br></div><div>I've also tried with the vhost Location having "ShibRequestSetting applicationId <a href="http://vhost.uah.edu">vhost.uah.edu</a>" and shibboleth2.xml having "<ApplicationOverride signing="true" id="<a href="http://vhost.uah.edu">vhost.uah.edu</a>" entityID="<a href="https://host.ds.uah.edu/shibboleth">https://host.ds.uah.edu/shibboleth</a>"/>".</div><div><br></div><div>-W<br><br></div><div> </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 5, 2018 at 10:17 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* William Eubank <<a href="mailto:william.eubank@uah.edu">william.eubank@uah.edu</a>> [2018-03-05 16:55]:<br>
<span class="">> So I changed my SP to signing="true" and restarted shibd. Still no luck.<br>
><br>
> <ApplicationDefaults entityID="<a href="https://host.ds.uah.edu/shibboleth" rel="noreferrer" target="_blank">https://host.ds.uah.<wbr>edu/shibboleth</a>"<br>
> REMOTE_USER="eppn persistent-id targeted-id"<br>
> signing="true"><br>
><br>
> Or am I missing a step to get signing authn requests in play?<br>
<br>
</span>Sorry, "Still no luck" is not a technical error message.<br>
Are the requests now signed (just look at them in the browser,<br>
e.g. using Olav's SAMLtracer for Firefox) or not?<br>
<br>
If they are sigend, then this alone won't accomplish anything, you'd<br>
still have to change the skipEndpointValidationWhenSign<wbr>ed option in<br>
your IDP to make the signed request change anything.<br>
<br>
But first I'd get our IDP to work with the existing system w/o<br>
signing, since adding a line with an ACS for the vhost /is/ everything<br>
that's needed and should work.<br>
Only after that I'd look into the SP signing and IDP config change.<br>
<span class="HOEnZb"><font color="#888888"><br>
-peter<br>
</font></span><div class="HOEnZb"><div class="h5">--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">William Eubank<br>Sr Software Development Lead<br>VBRH, C-2A<br>Office of Information Technology (OIT)<br>University of Alabama in Huntsville<br>256-824-5375<br><a href="mailto:william.eubank@uah.edu" target="_blank">william.eubank@uah.edu</a><br><br>
<p><span style="color:rgb(31,73,125);font-family:"Helvetica Neue",Arial,Helvetica,Geneva,sans-serif;font-size:12.8px">“The only thing worse than a problem without a solution is a solution that does not address a problem.”</span><br></p><p><span style="color:rgb(31,73,125);font-family:"Helvetica Neue",Arial,Helvetica,Geneva,sans-serif;font-size:12.8px"><br></span></p><br> <br><br></div></div></div></div>
</div>