<div dir="ltr"><div dir="ltr"><div dir="ltr">Hi Peter,<div>Thank you for replying me so quickly.</div><div><br><div>I configured installed shibboleth IDP and can be accessd with <a href="https://idp.shibboleth.com">https://idp.shibboleth.com</a>.</div><div><br></div><div>My shibboleth protected SP is at <a href="https://localhost/myservice/">https://localhost/myservice/</a></div><div><br></div><div><div>When I send the request to the SP using the ECP client the response is </div><div><br></div><div><h1 style="color:rgb(0,0,0);font-family:"Times New Roman"">shibsp::ConfigurationException</h1><p style="color:rgb(0,0,0);font-family:"Times New Roman";font-size:medium">The system encountered an error at Wed Aug 29 09:24:24 2018</p><p style="color:rgb(0,0,0);font-family:"Times New Roman";font-size:medium">To report this problem, please contact the site administrator at <a href="mailto:winma@test">winma@test</a>.</p><p style="color:rgb(0,0,0);font-family:"Times New Roman";font-size:medium">Please include the following message in any email:</p><p class="error" style="color:rgb(0,0,0);font-family:"Times New Roman";font-size:medium">shibsp::ConfigurationException at (<a href="https://localhost/myservice/">https://localhost/myservice/</a>)</p><p style="color:rgb(0,0,0);font-family:"Times New Roman";font-size:medium">No session initiator found with id (ECP), check requireSessionWith command.</p></div></div><div><br></div><div>My Apache .conf file is as below.</div><div><br></div><div><div><IfModule mod_ssl.c></div><div><span style="white-space:pre"> </span><VirtualHost _default_:443></div><div><span style="white-space:pre"> </span>ServerAdmin winma@localhost</div><div><br></div><div><span style="white-space:pre"> </span>DocumentRoot /var/www/html</div><div><br></div><div><span style="white-space:pre"> </span># Available loglevels: trace8, ..., trace1, debug, info, notice, warn,</div><div><span style="white-space:pre"> </span># error, crit, alert, emerg.</div><div><span style="white-space:pre"> </span># It is also possible to configure the loglevel for particular</div><div><span style="white-space:pre"> </span># modules, e.g.</div><div><span style="white-space:pre"> </span>#LogLevel info ssl:warn</div><div><br></div><div><span style="white-space:pre"> </span>ErrorLog ${APACHE_LOG_DIR}/error.log</div><div><span style="white-space:pre"> </span>CustomLog ${APACHE_LOG_DIR}/access.log combined</div><div><br></div><div><span style="white-space:pre"> </span># For most configuration files from conf-available/, which are</div><div><span style="white-space:pre"> </span># enabled or disabled at a global level, it is possible to</div><div><span style="white-space:pre"> </span># include a line for only one particular virtual host. For example the</div><div><span style="white-space:pre"> </span># following line enables the CGI configuration for this host only</div><div><span style="white-space:pre"> </span># after it has been globally disabled with "a2disconf".</div><div><span style="white-space:pre"> </span>#Include conf-available/serve-cgi-bin.conf</div><div><br></div><div><span style="white-space:pre"> </span># SSL Engine Switch:</div><div><span style="white-space:pre"> </span># Enable/Disable SSL for this virtual host.</div><div><span style="white-space:pre"> </span>SSLEngine on</div><div><br></div><div><span style="white-space:pre"> </span># A self-signed (snakeoil) certificate can be created by installing</div><div><span style="white-space:pre"> </span># the ssl-cert package. See</div><div><span style="white-space:pre"> </span># /usr/share/doc/apache2/README.Debian.gz for more info.</div><div><span style="white-space:pre"> </span># If both key and certificate are stored in the same file, only the</div><div><span style="white-space:pre"> </span># SSLCertificateFile directive is needed.</div><div><span style="white-space:pre"> </span>SSLCertificateFile<span style="white-space:pre"> </span>/etc/apache2/ssl/apache.crt</div><div><span style="white-space:pre"> </span>SSLCertificateKeyFile /etc/apache2/ssl/apache.key</div><div><br></div><div><span style="white-space:pre"> </span># Server Certificate Chain:</div><div><span style="white-space:pre"> </span># Point SSLCertificateChainFile at a file containing the</div><div><span style="white-space:pre"> </span># concatenation of PEM encoded CA certificates which form the</div><div><span style="white-space:pre"> </span># certificate chain for the server certificate. Alternatively</div><div><span style="white-space:pre"> </span># the referenced file can be the same as SSLCertificateFile</div><div><span style="white-space:pre"> </span># when the CA certificates are directly appended to the server</div><div><span style="white-space:pre"> </span># certificate for convinience.</div><div><span style="white-space:pre"> </span>#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt</div><div><br></div><div><span style="white-space:pre"> </span># Certificate Authority (CA):</div><div><span style="white-space:pre"> </span># Set the CA certificate verification path where to find CA</div><div><span style="white-space:pre"> </span># certificates for client authentication or alternatively one</div><div><span style="white-space:pre"> </span># huge file containing all of them (file must be PEM encoded)</div><div><span style="white-space:pre"> </span># Note: Inside SSLCACertificatePath you need hash symlinks</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> to point to the certificate files. Use the provided</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> Makefile to update the hash symlinks after changes.</div><div><span style="white-space:pre"> </span>#SSLCACertificatePath /etc/ssl/certs/</div><div><span style="white-space:pre"> </span>#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt</div><div><br></div><div><span style="white-space:pre"> </span># Certificate Revocation Lists (CRL):</div><div><span style="white-space:pre"> </span># Set the CA revocation path where to find CA CRLs for client</div><div><span style="white-space:pre"> </span># authentication or alternatively one huge file containing all</div><div><span style="white-space:pre"> </span># of them (file must be PEM encoded)</div><div><span style="white-space:pre"> </span># Note: Inside SSLCARevocationPath you need hash symlinks</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> to point to the certificate files. Use the provided</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> Makefile to update the hash symlinks after changes.</div><div><span style="white-space:pre"> </span>#SSLCARevocationPath /etc/apache2/ssl.crl/</div><div><span style="white-space:pre"> </span>#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl</div><div><br></div><div><span style="white-space:pre"> </span># Client Authentication (Type):</div><div><span style="white-space:pre"> </span># Client certificate verification type and depth. Types are</div><div><span style="white-space:pre"> </span># none, optional, require and optional_no_ca. Depth is a</div><div><span style="white-space:pre"> </span># number which specifies how deeply to verify the certificate</div><div><span style="white-space:pre"> </span># issuer chain before deciding the certificate is not valid.</div><div><span style="white-space:pre"> </span>#SSLVerifyClient require</div><div><span style="white-space:pre"> </span>#SSLVerifyDepth 10</div><div><br></div><div><span style="white-space:pre"> </span># SSL Engine Options:</div><div><span style="white-space:pre"> </span># Set various options for the SSL engine.</div><div><span style="white-space:pre"> </span># o FakeBasicAuth:</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> Translate the client X.509 into a Basic Authorisation. This means that</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> the standard Auth/DBMAuth methods can be used for access control. The</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> user name is the `one line' version of the client's X.509 certificate.</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> Note that no password is obtained from the user. Every entry in the user</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> file needs this password: `xxj31ZMTZzkVA'.</div><div><span style="white-space:pre"> </span># o ExportCertData:</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> This exports two additional environment variables: SSL_CLIENT_CERT and</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> SSL_SERVER_CERT. These contain the PEM-encoded certificates of the</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> server (always existing) and the client (only existing when client</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> authentication is used). This can be used to import the certificates</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> into CGI scripts.</div><div><span style="white-space:pre"> </span># o StdEnvVars:</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> This exports the standard SSL/TLS related `SSL_*' environment variables.</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> Per default this exportation is switched off for performance reasons,</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> because the extraction step is an expensive operation and is usually</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> useless for serving static content. So one usually enables the</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> exportation for CGI and SSI requests only.</div><div><span style="white-space:pre"> </span># o OptRenegotiate:</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> This enables optimized SSL connection renegotiation handling when SSL</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> directives are used in per-directory context.</div><div><span style="white-space:pre"> </span>#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire</div><div><span style="white-space:pre"> </span><FilesMatch "\.(cgi|shtml|phtml|php)$"></div><div><span style="white-space:pre"> </span>SSLOptions +StdEnvVars</div><div><span style="white-space:pre"> </span></FilesMatch></div><div><span style="white-space:pre"> </span><Directory /usr/lib/cgi-bin></div><div><span style="white-space:pre"> </span>SSLOptions +StdEnvVars</div><div><span style="white-space:pre"> </span></Directory></div><div><br></div><div><span style="white-space:pre"> </span># SSL Protocol Adjustments:</div><div><span style="white-space:pre"> </span># The safe and default but still SSL/TLS standard compliant shutdown</div><div><span style="white-space:pre"> </span># approach is that mod_ssl sends the close notify alert but doesn't wait for</div><div><span style="white-space:pre"> </span># the close notify alert from client. When you need a different shutdown</div><div><span style="white-space:pre"> </span># approach you can use one of the following variables:</div><div><span style="white-space:pre"> </span># o ssl-unclean-shutdown:</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> This forces an unclean shutdown when the connection is closed, i.e. no</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> SSL close notify alert is send or allowed to received. This violates</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> the SSL/TLS standard but is needed for some brain-dead browsers. Use</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> this when you receive I/O errors because of the standard approach where</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> mod_ssl sends the close notify alert.</div><div><span style="white-space:pre"> </span># o ssl-accurate-shutdown:</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> This forces an accurate shutdown when the connection is closed, i.e. a</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> SSL close notify alert is send and mod_ssl waits for the close notify</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> alert of the client. This is 100% SSL/TLS standard compliant, but in</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> practice often causes hanging connections with brain-dead browsers. Use</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> this only for browsers where you know that their SSL implementation</div><div><span style="white-space:pre"> </span>#<span style="white-space:pre"> </span> works correctly.</div><div><span style="white-space:pre"> </span># Notice: Most problems of broken clients are also related to the HTTP</div><div><span style="white-space:pre"> </span># keep-alive facility, so you usually additionally want to disable</div><div><span style="white-space:pre"> </span># keep-alive for those clients, too. Use variable "nokeepalive" for this.</div><div><span style="white-space:pre"> </span># Similarly, one has to force some clients to use HTTP/1.0 to workaround</div><div><span style="white-space:pre"> </span># their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and</div><div><span style="white-space:pre"> </span># "force-response-1.0" for this.</div><div><span style="white-space:pre"> </span>BrowserMatch "MSIE [2-6]" \</div><div><span style="white-space:pre"> </span>nokeepalive ssl-unclean-shutdown \</div><div><span style="white-space:pre"> </span>downgrade-1.0 force-response-1.0</div><div><span style="white-space:pre"> </span></div><div><span style="white-space:pre"> </span>BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown</div><div><br></div><div><span style="white-space:pre"> </span>Alias /myservice/ /var/www/myservice/</div><div> <Location /myservice/></div><div> AuthType shibboleth</div><div> ShibRequestSetting requireSessionWith ECP</div><div> Require valid-user</div><div> </Location></div><div><br></div><div><span style="white-space:pre"> </span></VirtualHost></div><div></IfModule></div><div><br></div><div>My shibboleth2.xml file is as below.</div><div><br></div><div><div><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"</div><div> xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"</div><div> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"</div><div> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" </div><div> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"</div><div> clockSkew="180"></div><div><br></div><div> <!--</div><div> By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache</div><div> are used. See example-shibboleth2.xml for samples of explicitly configuring them.</div><div> --></div><div><br></div><div> <!--</div><div> To customize behavior for specific resources on Apache, and to link vhosts or</div><div> resources to ApplicationOverride settings below, use web server options/commands.</div><div> See <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements</a> for help.</div><div> </div><div> For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml</div><div> file, and the <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapHowTo</a> topic.</div><div> --></div><div><br></div><div> <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. --></div><div> <ApplicationDefaults entityID="<a href="https://localhost/shibboleth">https://localhost/shibboleth</a>"</div><div> REMOTE_USER="eppn persistent-id targeted-id"></div><div><br></div><div> <!--</div><div> Controls session lifetimes, address checks, cookie handling, and the protocol handlers.</div><div> You MUST supply an effectively unique handlerURL value for each of your applications.</div><div> The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing</div><div> a relative value based on the virtual host. Using handlerSSL="true", the default, will force</div><div> the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.</div><div> Note that while we default checkAddress to "false", this has a negative impact on the</div><div> security of your site. Stealing sessions via cookie theft is much easier with this disabled.</div><div> --></div><div> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"</div><div> checkAddress="false" handlerSSL="true" cookieProps="https"></div><div><br></div><div> <!--</div><div> Configures SSO for a default IdP. To allow for >1 IdP, remove</div><div> entityID property and adjust discoveryURL to point to discovery service.</div><div> (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)</div><div> You can also override entityID on /Login query string, or in RequestMap/htaccess.</div><div> --></div><div> <SSO entityID="<a href="https://idp.shibboleth.com/idp/shibboleth">https://idp.shibboleth.com/idp/shibboleth</a>"</div><div> discoveryProtocol="SAMLDS" discoveryURL="<a href="https://ds.example.org/DS/WAYF">https://ds.example.org/DS/WAYF</a>"></div><div> SAML2 SAML1</div><div> </SSO></div><div><br></div><div> <!-- SAML and local-only logout. --></div><div> <Logout>SAML2 Local</Logout></div><div> </div><div> <!-- Extension service that generates "approximate" metadata based on SP configuration. --></div><div> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/></div><div><br></div><div> <!-- Status reporting service. --></div><div> <Handler type="Status" Location="/Status" acl="127.0.1.1 ::1"/></div><div><br></div><div> <!-- Session diagnostic service. --></div><div> <Handler type="Session" Location="/Session" showAttributeValues="false"/></div><div><br></div><div> <!-- JSON feed of discovery information. --></div><div> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/></div><div> </Sessions></div><div><br></div><div> <!--</div><div> Allows overriding of error template information/filenames. You can</div><div> also add attributes with values that can be plugged into the templates.</div><div> --></div><div> <Errors supportContact="winma@test"</div><div> helpLocation="/about.html"</div><div> styleSheet="/shibboleth-sp/main.css"/></div><div> </div><div> <!-- Example of remotely supplied batch of signed metadata. --></div><div><br></div><div><span style="white-space:pre"> </span><MetadataProvider type="XML"</div><div> file="idp-metadata.xml"/></div><div><br></div><div><br></div><div> <!--</div><div> <MetadataProvider type="XML" uri="<a href="http://federation.org/federation-metadata.xml">http://federation.org/federation-metadata.xml</a>"</div><div> backingFilePath="federation-metadata.xml" reloadInterval="7200"></div><div> <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/></div><div> <MetadataFilter type="Signature" certificate="fedsigner.pem"/></div><div> </MetadataProvider></div><div> --></div><div><br></div><div> <!-- Example of locally maintained metadata. --></div><div> <!--</div><div> <MetadataProvider type="XML" file="partner-metadata.xml"/></div><div> --></div><div><br></div><div> <!-- Map to extract attributes from SAML assertions. --></div><div> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/></div><div> </div><div> <!-- Use a SAML query if no attributes are supplied during SSO. --></div><div> <AttributeResolver type="Query" subjectMatch="true"/></div><div><br></div><div> <!-- Default filtering policy for recognized attributes, lets other data pass. --></div><div> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/></div><div><br></div><div> <!-- Simple file-based resolver for using a single keypair. --></div><div> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/></div><div><br></div><div> <!--</div><div> The default settings can be overridden by creating ApplicationOverride elements (see</div><div> the <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride</a> topic).</div><div> Resource requests are mapped by web server commands, or the RequestMapper, to an</div><div> applicationId setting.</div><div> </div><div> Example of a second application (for a second vhost) that has a different entityID.</div><div> Resources on the vhost would map to an applicationId of "admin":</div><div> --></div><div> <!--</div><div> <ApplicationOverride id="admin" entityID="<a href="https://admin.example.org/shibboleth">https://admin.example.org/shibboleth</a>"/></div><div> --></div><div> </ApplicationDefaults></div><div> </div><div> <!-- Policies that determine how to process and authenticate runtime messages. --></div><div> <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/></div><div><br></div><div> <!-- Low-level configuration about protocols and bindings available for use. --></div><div> <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/></div><div><br></div><div></SPConfig></div></div><div><br></div><div><br></div><div>Could you please tell me what I did wrong in my SP configuration?</div><div><br></div><div>Thank you!!!</div><div>Winma</div><div><br></div><div><br></div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Aug 28, 2018 at 5:20 PM Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">* winma heenatigala <<a href="mailto:winma2014al@gmail.com" target="_blank">winma2014al@gmail.com</a>> [2018-08-28 13:21]:<br>
> I tried many examples from internet but all failed. Can anyone<br>
> please give my some guidance or any documents to follow.<br>
<br>
Without knowing what you did and how exactly it failed it's hard to<br>
tell you what to do differently.<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div></div></div>