<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Fazla,</div><div><br></div><div>You need to make sure that your IdP downloaded SAMLtest's metadata successfully. The configuration:</div><div><br></div><div><MetadataProvider id="SAMLtest"<br>
xsi:type="<wbr>FileBackedHTTPMetadataProvider<wbr>"<br>
backingFile="%{idp.home}/<wbr>metadata/SAMLtest.xml"<br>
metadataURL="<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.<wbr>id/saml/sp</a>"><br>
<br>
</MetadataProvider></div><div><br></div><div>needs to be active in your IdP and working successfully. It should go next to the other MetadataProvider elements in metadata-providers.xml, and make sure it's not commented out. You will see an error message in the logs when you start up your IdP if the configuration is wrong, and you will see a success message if it does work, and nothing at all if the configuration is missing or really broken. Here's the example on my testing machine.</div><div><br></div><div>2018-09-07 16:34:30,448 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:504] - Metadata Resolver FileBackedHTTPMetadataResolver SAMLtest: New metadata successfully loaded for '<a href="https://samltest.id/saml/sp">https://samltest.id/saml/sp</a>'<br>2018-09-07 16:34:30,455 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:324] - Metadata Resolver FileBackedHTTPMetadataResolver SAMLtest: Next refresh cycle for metadata provider '<a href="https://samltest.id/saml/sp">https://samltest.id/saml/sp</a>' will occur on '2018-09-07T19:34:30.230Z' ('2018-09-07T19:34:30.230Z' local time</div><div><br></div><div>And this is what the last part of my metadata-providers.xml looks like:</div><div><br></div><div> <!--<br> Example file metadata provider. Use this if you want to load metadata<br> from a local file. You might use this if you have some local SPs<br> which are not "federated" but you wish to offer a service to.<br><br> If you do not provide a SignatureValidation filter, then you have the<br> responsibility to ensure that the contents on disk are trustworthy.<br> --><br><br> <!--<br> <MetadataProvider id="LocalMetadata" xsi:type="FilesystemMetadataProvider" metadataFile="PATH_TO_YOUR_METADATA"/><br> --> <br><br> <!-- SAMLtest SP metadata --><br> <MetadataProvider id="SAMLtest"<br> xsi:type="FileBackedHTTPMetadataProvider"<br> backingFile="%{idp.home}/metadata/SAMLtest.xml"<br> metadataURL="<a href="https://samltest.id/saml/sp">https://samltest.id/saml/sp</a>"><br> <!-- You should always check the signature and freshness of remote<br> metadata. It's commented out until you get the basics working.<br> <MetadataFilter xsi:type="SignatureValidation"<br> certificateFile="%{idp.home}/credentials/signet.crt" /><br> <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D"/><br> --><br> </MetadataProvider><br></div><div><br></div><div></MetadataProvider></div><div><br></div><div>The metadata configuration is a list of the SP's that your IdP trusts. Each one is named by a MetadataProvider. They are all wrapped in one big <MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider" element at the beginning of the configuration file, and the last line with the closing </MetadataProvider> tag in my example closes the chain.</div><div><br></div><div>If you put the <?xml version="1.0" encoding="UTF-8"?> declaration in the middle of the file, I would expect parsing to fail, and your IdP probably doesn't trust any SP's. Look for an ERROR when you start the IdP. When I tried this configuration:</div></div><div dir="ltr"><br></div><div dir="ltr"><?xml version="1.0" encoding="UTF-8"?><br><MetadataProvider id="SAMLtest"<br> xsi:type="FileBackedHTTPMetadataProvider"<br> backingFile="%{idp.home}/metadata/SAMLtest.xml"<br> metadataURL="<a href="https://samltest.id/saml/sp">https://samltest.id/saml/sp</a>"><br> <br></MetadataProvider><br><div><br></div><div> I got:</div><div><br></div><div>018-09-07 16:47:12,749 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.MetadataResolverService': Initial load failed<br>net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 62 in XML document from file [/opt/shibboleth-idp/conf/metadata-providers.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 62; columnNumber: 6; The processing instruction target matching "[xX][mM][lL]" is not allowed.<br> at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:336)<br>Caused by: org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 62 in XML document from file [/opt/shibboleth-idp/conf/metadata-providers.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 62; columnNumber: 6; The processing instruction target matching "[xX][mM][lL]" is not allowed.<br> at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:399)<br>Caused by: org.xml.sax.SAXParseException: The processing instruction target matching "[xX][mM][lL]" is not allowed.<br> at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:203)<br></div><div><br></div><div>When I delete the XML line 62, the logs change and I see success:</div><div><br></div><div>2018-09-07 16:50:31,211 - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:172] - Service 'shibboleth.MetadataResolverService': Performing initial load<br>2018-09-07 16:50:31,211 - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:258] - Service 'shibboleth.MetadataResolverService': Reloading service configuration<br>2018-09-07 16:50:31,213 - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [/opt/shibboleth-idp/conf/metadata-providers.xml]<br>2018-09-07 16:50:31,263 - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [/opt/shibboleth-idp/system/conf/metadata-providers-system.xml]<br>2018-09-07 16:50:31,268 - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:583] - Refreshing ApplicationContext:shibboleth.MetadataResolverService: startup date [Fri Sep 07 16:50:31 UTC 2018]; parent: Root WebApplicationContext<br>2018-09-07 16:50:31,571 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:504] - Metadata Resolver FileBackedHTTPMetadataResolver SAMLtest: New metadata successfully loaded for '<a href="https://samltest.id/saml/sp">https://samltest.id/saml/sp</a>'<br>2018-09-07 16:50:31,573 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:324] - Metadata Resolver FileBackedHTTPMetadataResolver SAMLtest: Next refresh cycle for metadata provider '<a href="https://samltest.id/saml/sp">https://samltest.id/saml/sp</a>' will occur on '2018-09-07T16:50:36.571Z' ('2018-09-07T16:50:36.571Z' local time)<br>2018-09-07 16:50:31,584 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:380] - Service 'shibboleth.MetadataResolverService': Completed reload and swapped in latest configuration for service 'shibboleth.MetadataResolverService'<br>2018-09-07 16:50:31,589 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:387] - Service 'shibboleth.MetadataResolverService': Reload complete<br><br></div><div>So, if you just delete that one line, it might be enough.</div><div><br></div><div>Take care,</div><div>Nate.<br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 7, 2018 at 8:04 AM, fazla <span dir="ltr"><<a href="mailto:fazlarabby043264@gmail.com" target="_blank">fazlarabby043264@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This is the SAMLtest.xml<br>
<br>
<?xml version="1.0" encoding="UTF-8"?><br>
<MetadataProvider id="SAMLtest"<br>
xsi:type="<wbr>FileBackedHTTPMetadataProvider<wbr>"<br>
backingFile="%{idp.home}/<wbr>metadata/SAMLtest.xml"<br>
metadataURL="<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.<wbr>id/saml/sp</a>"><br>
<br>
</MetadataProvider><br>
<span class=""><br>
<br>
<br>
this is the server log <br>
<br>
</span>2018-09-07 07:29:42,300 - WARN<br>
[net.shibboleth.idp.profile.<wbr>impl.<wbr>SelectProfileConfiguration:<wbr>111] - Profile<br>
Action SelectProfileConfiguration: Profile<br>
<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/<wbr>profiles/saml2/sso/browser</a> is not available for RP<br>
configuration shibboleth.<wbr>UnverifiedRelyingParty (RPID<br>
<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>)<br>
2018-09-07 07:29:42,300 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: InvalidProfileConfiguration<br>
2018-09-07 07:30:28,893 - INFO<br>
[org.opensaml.saml.common.<wbr>binding.impl.<wbr>SAMLMetadataLookupHandler:128] -<br>
Message Handler: No metadata returned for <a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a> in<br>
role {urn:oasis:names:tc:SAML:2.0:<wbr>metadata}SPSSODescriptor with protocol<br>
urn:oasis:names:tc:SAML:2.0:<wbr>protocol<br>
2018-09-07 07:30:28,893 - WARN<br>
[net.shibboleth.idp.profile.<wbr>impl.<wbr>SelectProfileConfiguration:<wbr>111] - Profile<br>
Action SelectProfileConfiguration: Profile<br>
<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/<wbr>profiles/saml2/sso/browser</a> is not available for RP<br>
configuration shibboleth.<wbr>UnverifiedRelyingParty (RPID<br>
<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>)<br>
2018-09-07 07:30:28,893 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: InvalidProfileConfiguration<br>
2018-09-07 07:30:34,565 - INFO<br>
[org.opensaml.saml.common.<wbr>binding.impl.<wbr>SAMLMetadataLookupHandler:128] -<br>
Message Handler: No metadata returned for <a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a> in<br>
role {urn:oasis:names:tc:SAML:2.0:<wbr>metadata}SPSSODescriptor with protocol<br>
urn:oasis:names:tc:SAML:2.0:<wbr>protocol<br>
2018-09-07 07:30:34,565 - WARN<br>
[net.shibboleth.idp.profile.<wbr>impl.<wbr>SelectProfileConfiguration:<wbr>111] - Profile<br>
Action SelectProfileConfiguration: Profile<br>
<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/<wbr>profiles/saml2/sso/browser</a> is not available for RP<br>
configuration shibboleth.<wbr>UnverifiedRelyingParty (RPID<br>
<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>)<br>
2018-09-07 07:30:34,565 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: InvalidProfileConfiguration<br>
2018-09-07 07:34:23,860 - INFO<br>
[org.opensaml.saml.common.<wbr>binding.impl.<wbr>SAMLMetadataLookupHandler:128] -<br>
Message Handler: No metadata returned for <a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a> in<br>
role {urn:oasis:names:tc:SAML:2.0:<wbr>metadata}SPSSODescriptor with protocol<br>
urn:oasis:names:tc:SAML:2.0:<wbr>protocol<br>
2018-09-07 07:34:23,860 - WARN<br>
[net.shibboleth.idp.profile.<wbr>impl.<wbr>SelectProfileConfiguration:<wbr>111] - Profile<br>
Action SelectProfileConfiguration: Profile<br>
<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/<wbr>profiles/saml2/sso/browser</a> is not available for RP<br>
configuration shibboleth.<wbr>UnverifiedRelyingParty (RPID<br>
<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>)<br>
2018-09-07 07:34:23,860 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: InvalidProfileConfiguration<br>
2018-09-07 07:34:25,547 - INFO<br>
[org.opensaml.saml.common.<wbr>binding.impl.<wbr>SAMLMetadataLookupHandler:128] -<br>
Message Handler: No metadata returned for <a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a> in<br>
role {urn:oasis:names:tc:SAML:2.0:<wbr>metadata}SPSSODescriptor with protocol<br>
urn:oasis:names:tc:SAML:2.0:<wbr>protocol<br>
2018-09-07 07:34:25,579 - WARN<br>
[net.shibboleth.idp.profile.<wbr>impl.<wbr>SelectProfileConfiguration:<wbr>111] - Profile<br>
Action SelectProfileConfiguration: Profile<br>
<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/<wbr>profiles/saml2/sso/browser</a> is not available for RP<br>
configuration shibboleth.<wbr>UnverifiedRelyingParty (RPID<br>
<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>)<br>
2018-09-07 07:34:25,594 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: InvalidProfileConfiguration<br>
2018-09-07 07:34:42,813 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: ServiceNotSpecified<br>
2018-09-07 07:34:42,829 - INFO [Shibboleth-Audit.SSO:275] -<br>
20180907T073442Z||||<a href="https://www.apereo.org/cas/protocol/login|||||||||
2018-09-07" rel="noreferrer" target="_blank">https://<wbr>www.apereo.org/cas/protocol/<wbr>login|||||||||<br>
2018-09-07</a> 07:34:47,578 - INFO<br>
[org.opensaml.saml.common.<wbr>binding.impl.<wbr>SAMLMetadataLookupHandler:128] -<br>
Message Handler: No metadata returned for <a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a> in<br>
role {urn:oasis:names:tc:SAML:2.0:<wbr>metadata}SPSSODescriptor with protocol<br>
urn:oasis:names:tc:SAML:2.0:<wbr>protocol<br>
2018-09-07 07:34:47,578 - WARN<br>
[net.shibboleth.idp.profile.<wbr>impl.<wbr>SelectProfileConfiguration:<wbr>111] - Profile<br>
Action SelectProfileConfiguration: Profile<br>
<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/<wbr>profiles/saml2/sso/browser</a> is not available for RP<br>
configuration shibboleth.<wbr>UnverifiedRelyingParty (RPID<br>
<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>)<br>
2018-09-07 07:34:47,578 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: InvalidProfileConfiguration<br>
2018-09-07 07:35:14,828 - INFO<br>
[org.opensaml.saml.common.<wbr>binding.impl.<wbr>SAMLMetadataLookupHandler:128] -<br>
Message Handler: No metadata returned for <a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a> in<br>
role {urn:oasis:names:tc:SAML:2.0:<wbr>metadata}SPSSODescriptor with protocol<br>
urn:oasis:names:tc:SAML:2.0:<wbr>protocol<br>
2018-09-07 07:35:14,828 - WARN<br>
[net.shibboleth.idp.profile.<wbr>impl.<wbr>SelectProfileConfiguration:<wbr>111] - Profile<br>
Action SelectProfileConfiguration: Profile<br>
<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/<wbr>profiles/saml2/sso/browser</a> is not available for RP<br>
configuration shibboleth.<wbr>UnverifiedRelyingParty (RPID<br>
<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>)<br>
2018-09-07 07:35:14,828 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: InvalidProfileConfiguration<br>
2018-09-07 07:45:13,152 - INFO<br>
[org.opensaml.saml.common.<wbr>binding.impl.<wbr>SAMLMetadataLookupHandler:128] -<br>
Message Handler: No metadata returned for <a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a> in<br>
role {urn:oasis:names:tc:SAML:2.0:<wbr>metadata}SPSSODescriptor with protocol<br>
urn:oasis:names:tc:SAML:2.0:<wbr>protocol<br>
2018-09-07 07:45:13,168 - WARN<br>
[net.shibboleth.idp.profile.<wbr>impl.<wbr>SelectProfileConfiguration:<wbr>111] - Profile<br>
Action SelectProfileConfiguration: Profile<br>
<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/<wbr>profiles/saml2/sso/browser</a> is not available for RP<br>
configuration shibboleth.<wbr>UnverifiedRelyingParty (RPID<br>
<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>)<br>
2018-09-07 07:45:13,168 - WARN<br>
[org.opensaml.profile.action.<wbr>impl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: InvalidProfileConfiguration<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
<br>
<br>
--<br>
Sent from: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html" rel="noreferrer" target="_blank">http://shibboleth.1660669.n2.<wbr>nabble.com/Shibboleth-Users-<wbr>f1660767.html</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br></div>