<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">So just noticed that my metadata file (sent to IDP) shows all of the “Location” items for my server as http:// instead of https://. I generated the file using the URL https://<mydomain>/Shibboleth.sso/Metadata<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">And sent that file to my IDP. Any ideas why it would show http:// instead of https:// if I am using ELB listener with AWS certs?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Deirdre Kirmis<o:p></o:p></p>
<p class="MsoNormal">Technology Services<o:p></o:p></p>
<p class="MsoNormal">Arizona State University Library<o:p></o:p></p>
<p class="MsoNormal">480-965-7240<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Deirdre Kirmis <br>
<b>Sent:</b> Tuesday, November 26, 2019 2:48 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> RE: configuring shibboleth on AWS using ELB<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks, Nate. You did suggest creating the SSL certs locally, which is what I will try next. I had already gotten so far with the ACM certs that I was trying to make that work first, but not really having luck. I’ll try your suggestions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Deirdre Kirmis<o:p></o:p></p>
<p class="MsoNormal">Technology Services<o:p></o:p></p>
<p class="MsoNormal">Arizona State University Library<o:p></o:p></p>
<p class="MsoNormal">480-965-7240<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>>
<b>On Behalf Of </b>Nate Klingenstein<br>
<b>Sent:</b> Tuesday, November 26, 2019 2:41 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: configuring shibboleth on AWS using ELB<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Deirdre,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Beware the wildcard certificate, especially as ACM is effectively free and zero maintenance. The domain in the cookie and the certificate used for encryption to the SP are more important, but it's wise to use dedicated TLS certificates
anyway.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I wouldn't have ELB listen on port 80, but instead write a redirect rule.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The error doesn't sound like a Shibboleth error. Try going to /Shibboleth.sso/Session. I suspect it's not integrated right with the application or not receiving the right data in the assertion even though the SAML transaction is probably
successful.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best wishes,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Nate.<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Nov 26, 2019, 2:31 PM Deirdre Kirmis <<a href="mailto:Deirdre.Kirmis@asu.edu">Deirdre.Kirmis@asu.edu</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I figured out the certs issue…do you mind if I ask if I have set this up correctly? I have an application load balancer, listening on ports 80 and 443, directing to a target group
(with currently only 1 EC2 instance registered). I set up the ELB using our AWS wildcard certificate in ACM, and did not configure anything specifically on the EC2 to enforce https and regarding certs (ssl.conf is pointing to the localhost.key and .crt files).
I guess the “wired together properly” part is where I’m stuck. I installed shib, added the Location section for it in ssl.conf, configured shibboleth2.xml with servername and to point to my metadata file, which I got from my host provider (my organization
is an IDP). Added shib as an authentication provider. <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I see my provider on the login page of my app, but when I try to login I get an error “The login service was unable to identify a compatible way to respond to the requested application.
This is generally due to a misconfiguration on the part of the application and should be reported to the application's support team or owner.”<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Any ideas what I missed? Thank you!<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Deirdre Kirmis<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Technology Services<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Arizona State University Library<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">480-965-7240<o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>>
<b>On Behalf Of </b>Nate Klingenstein<br>
<b>Sent:</b> Monday, November 25, 2019 5:54 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> RE: configuring shibboleth on AWS using ELB<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Deirdre,</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">For what it's worth, we've configured a lot of IdP's and SP's in AWS, including SAMLtest. It's pretty straightforward: ELB, target groups, and instances,
just wired together properly. There's really nothing special about it.</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">I often do it for single instances just because I like having ELB in between the world and me. It doesn't really provide anything that security groups
wouldn't other than IP address obfuscation, so it's more of a security blanket than a necessary piece of infrastructure, but hey.</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Take care,</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">Nate.</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">--------</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif;border:solid windowtext 1.0pt;padding:0in"><img border="0" width="100" height="100" style="width:1.0416in;height:1.0416in" id="m_-1198035815259949932_x005f_x0000_i1025" src="cid:image001.jpg@01D5A504.2AC8E9C0" alt="Image removed by sender."></span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:13.5pt;font-family:"Arial",sans-serif">The Art of Access</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif">
<strong><span style="font-family:"Arial",sans-serif">®</span></strong></span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Nate Klingenstein</span></strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif"> | Principal</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.signet.id_&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=DKyXVdvZv_W0BxCMlPe5V6NyJWWVhQZynmMLKEIxOg4&s=PIehe9gqAJbDbVJPUhq8JhjM-UPEkeVHjaz6e2VSOhs&e=" target="_blank">https://www.signet.id/</a>
</span><o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<blockquote style="border:none;border-left:solid #B0B0B7 1.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">-----Original message-----<br>
<strong><span style="font-family:"Calibri",sans-serif">From:</span></strong> Deirdre Kirmis<br>
<strong><span style="font-family:"Calibri",sans-serif">Sent:</span></strong> Monday, November 25 2019, 4:30 pm<br>
<strong><span style="font-family:"Calibri",sans-serif">To:</span></strong> <a href="mailto:users@shibboleth.net" target="_blank">
users@shibboleth.net</a><br>
<strong><span style="font-family:"Calibri",sans-serif">Subject:</span></strong> configuring shibboleth on AWS using ELB<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hi all…prefacing this to say that I am new to AWS and new to configuring shibboleth. I was wondering if anyone has successfully configured shibboleth on an AWS instance that is
running https via a load balancer. I installed and configured shib, send/received metadata from my IDP, but when I generate my metadata file, the certs are not included, and the sp-cert.pem and sp-key.pem files did not get created. Do I still need to “configure”
https locally on the server, and if so, how, and how do I fix my shib config?<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks for any help!<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<pre>-- <o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=sqANvdo-pk4xMc-5_iT2zb4zkizPauGoywFExzSpVTM&s=kIf-cAbo_9TAnkon9__fNxvH0qm7mV0Y4cv_LoMrPJU&e=" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><o:p></o:p></pre>
</blockquote>
</div>
</div>
<p class="MsoNormal">-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=sqANvdo-pk4xMc-5_iT2zb4zkizPauGoywFExzSpVTM&s=kIf-cAbo_9TAnkon9__fNxvH0qm7mV0Y4cv_LoMrPJU&e=" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
</body>
</html>