<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><div class="gmail_default">Hi Peter, thanks for the detailed answers. Unrelatedly, sorry for not replying in the thread. I can't figure out how to get Gmail to continue the thread.</div><div class="gmail_default"><br></div><div class="gmail_default">I actually got it working, thanks! Like I mentioned, I think I've read every page in that Shibboleth wiki, but I couldn't figure out how to piece it together. Here's the flow that I figured out for my use-case, for posterity:</div><div class="gmail_default"><br></div><div class="gmail_default">0. Use the unicon/shibboleth-idp Docker container</div><div class="gmail_default">1. Configure SP in `conf/metadata-providers.xml`</div><div class="gmail_default">    * <a href="https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP" target="_blank" style="font-family:Arial,Helvetica,sans-serif">https://wiki.shibboleth.net/confluence/display/CONCEPT/MetadataForSP</a></div><div class="gmail_default">2. Configure the "SAML2.SSO" profile in `conf/relying-party.xml`</div><div class="gmail_default">    * <a href="https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration" target="_blank" style="font-family:Arial,Helvetica,sans-serif">https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration</a></div><div class="gmail_default">    * Make sure you include `<property name="encryptionOptional" value="true" />` as a child of the SAML2.SSO bean</div><div class="gmail_default">    * I used the RelyingPartyByName bean in RelyingPartyOverrides</div><div class="gmail_default">3. Ensure the "authn/Password" is enabled in "conf/authn/general-authn.xml"</div><div class="gmail_default">    * <a href="https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-GeneralConfiguration" target="_blank" style="font-family:Arial,Helvetica,sans-serif">https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-GeneralConfiguration</a></div><div class="gmail_default">    * I deleted everything else just to be clean, but not necessary</div><div class="gmail_default">4. Enable just the "jaas-authn-config.xml" import in "conf/authn/password-authn-config.xml"</div><div class="gmail_default">    * <a href="https://wiki.shibboleth.net/confluence/display/IDP30/PasswordAuthnConfiguration#PasswordAuthnConfiguration-GeneralConfiguration" target="_blank" style="font-family:Arial,Helvetica,sans-serif">https://wiki.shibboleth.net/confluence/display/IDP30/PasswordAuthnConfiguration#PasswordAuthnConfiguration-GeneralConfiguration</a></div><div class="gmail_default">5. Configure ShibUserPassAuth in "conf/authn/jaas.config"</div><div class="gmail_default">    * <a href="https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration#JAASAuthnConfiguration-JAASConfiguration" target="_blank" style="font-family:Arial,Helvetica,sans-serif">https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration#JAASAuthnConfiguration-JAASConfiguration</a></div><div class="gmail_default">    * This is where I configured com.tagish.auth.FileLogin, by adding `tagishauth.jar` to `/opt/shibboleth/webapp/WEB-INF/lib/` and creating a password file of "username:md5-hash-of-password" lines</div><div class="gmail_default">6. Go to `localhost:4443/idp/profile/SAML2/Unsolicited/SSO?providerId=your-entity-id`</div><div style="font-family:Arial,Helvetica,sans-serif"><br></div><div style="font-family:Arial,Helvetica,sans-serif"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">That checklist ^ would've been so helpful for me, but I couldn't find anything like it anywhere. Thanks again for all your help!</div></div></div><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><span style="font-size:12.8000001907349px">Brandon Chinn</span><br></div><div>LeapYear Technologies (<a href="http://leapyear.io" target="_blank">http://leapyear.io</a>)</div></div></div></div></div></div></div></div>