<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I am still struggling with this and trying to get it working. Shibboleth works perfectly on my server until I put it behind an AWS load balancer. Posting my configs, and wondering if anyone sees anything that could be causing an issue? I appreciate any suggestions.
I am using an application load balancer in AWS and have an https listener configured with a wildcard SSL cert from ACM. I also have a "Let's Encrypt" cert configured locally on the EC2.<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
These are the default configs that came from the vendor, and I used them exactly as is and changed to our server name and environment:
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">----------------------------------------<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><b>ssl.conf:</b></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><br>
</div>
<span>Listen 443 https<br>
</span>
<div><br>
</div>
<div>SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog<br>
</div>
<div>SSLSessionCache shmcb:/run/httpd/sslcache(512000)<br>
</div>
<div>SSLSessionCacheTimeout 300<br>
</div>
<div>SSLRandomSeed startup file:/dev/urandom 256<br>
</div>
<div>SSLRandomSeed connect builtin<br>
</div>
<div>SSLCryptoDevice builtin<br>
</div>
<div><br>
</div>
<div><VirtualHost _default_:443><br>
</div>
<div><br>
</div>
<div> ServerName {{ servername }}:443<br>
</div>
<div> ErrorLog logs/ssl_error_log<br>
</div>
<div> TransferLog logs/ssl_access_log<br>
</div>
<div> LogLevel warn<br>
</div>
<div><br>
</div>
<div> SSLEngine on<br>
</div>
<div> SSLProtocol all -SSLv2<br>
</div>
<div> SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5<br>
</div>
<div> SSLCertificateFile /etc/pki/tls/certs/{{ apache_ssl_cert }}<br>
</div>
<div> SSLCertificateKeyFile /etc/pki/tls/private/{{ apache_ssl_key }}<br>
</div>
<div> SSLCertificateChainFile /etc/pki/tls/certs/{{ apache_ssl_interm }}<br>
</div>
<div><br>
</div>
<div> <Files ~ "\.(cgi|shtml|phtml|php3?)$"><br>
</div>
<div> SSLOptions +StdEnvVars<br>
</div>
<div> </Files><br>
</div>
<div> <Directory "/var/www/cgi-bin"><br>
</div>
<div> SSLOptions +StdEnvVars<br>
</div>
<div> </Directory><br>
</div>
<div><br>
</div>
<div> CustomLog logs/ssl_request_log \<br>
</div>
<div> "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"<br>
</div>
<div><br>
</div>
<div> # custom error document when Glassfish isn't responding<br>
</div>
<div> ErrorDocument 503 /503.html<br>
</div>
<div> ProxyPassMatch ^/503.html$ !<br>
</div>
<div><br>
</div>
<div> # don't pass paths used by rApache and TwoRavens to Glassfish<br>
</div>
<div> ProxyPassMatch ^/RApacheInfo$ !<br>
</div>
<div> ProxyPassMatch ^/custom !<br>
</div>
<div> ProxyPassMatch ^/dataexplore !<br>
</div>
<div><br>
</div>
<div> # don't pass paths used by Shibboleth to Glassfish<br>
</div>
<div> ProxyPassMatch ^/Shibboleth.sso !<br>
</div>
<div> ProxyPassMatch ^/shibboleth-ds !<br>
</div>
<div><br>
</div>
<div> # allow munin<br>
</div>
<div> ProxyPassMatch ^/munin !<br>
</div>
<div><br>
</div>
<div> # pass everything else to Glassfish<br>
</div>
<div> ProxyPass / ajp://localhost:8009/<br>
</div>
<div><br>
</div>
<div> <Location /shib.xhtml><br>
</div>
<div> AuthType shibboleth<br>
</div>
<div> ShibRequestSetting requireSession 1<br>
</div>
<div> require valid-user<br>
</div>
<div> </Location><br>
</div>
<div> <br>
</div>
<div> ServerAlias dataverse-dev.lib.asu.edu<br>
</div>
<div> SSLCertificateFile {{ cert file }}<br>
</div>
<div> SSLCertificateKeyFile {{ key file }}<br>
</div>
<div> Include /etc/letsencrypt/options-ssl-apache.conf<br>
</div>
<div> SSLCertificateChainFile {{ chain file }}<br>
</div>
<div><br>
</div>
<span></VirtualHost> <br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span>-----------------------</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<b><span><br>
</span></b></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<b><span>http.proxy.conf:</span></b></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><VirtualHost *:80><br>
</span>
<div><br>
</div>
<div> ServerName {{ servername }}<br>
</div>
<div><br>
</div>
<div> <Location "/prometheus"><br>
</div>
<div> ProxyPass "http://localhost:9090/prometheus"<br>
</div>
<div> ProxyPassReverse "http://localhost:9090/prometheus"<br>
</div>
<div> </Location><br>
</div>
<div><br>
</div>
<div> <Location "/grafana"><br>
</div>
<div> ProxyPass "http://localhost:3000"<br>
</div>
<div> ProxyPassReverse "http://localhost:3000"<br>
</div>
<div> </Location><br>
</div>
<div><br>
</div>
<div> # custom error document when Glassfish isn't responding<br>
</div>
<div> ErrorDocument 503 /503.html<br>
</div>
<div> ProxyPassMatch ^/503.html$ !<br>
</div>
<div><br>
</div>
<div> # don't pass paths used by rApache and TwoRavens to Glassfish<br>
</div>
<div> ProxyPassMatch ^/RApacheInfo$ !<br>
</div>
<div> ProxyPassMatch ^/custom !<br>
</div>
<div> ProxyPassMatch ^/dataexplore !<br>
</div>
<div><br>
</div>
<div> # don't pass paths used by Shibboleth to Glassfish<br>
</div>
<div> ProxyPassMatch ^/Shibboleth.sso !<br>
</div>
<div> ProxyPassMatch ^/shibboleth-ds !<br>
</div>
<div><br>
</div>
<div> # allow munin, if present<br>
</div>
<div> ProxyPassMatch ^/munin !<br>
</div>
<div><br>
</div>
<div> # pass everything else to Glassfish<br>
</div>
<div> ProxyPass / ajp://localhost:8009/<br>
</div>
<div><br>
</div>
<span></VirtualHost></span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span>----------------</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<b><span><br>
</span></b></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><b>shibboleth.xml: </b><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><span><!--<br>
</span>
<div>This is an example shibboleth2.xml generated originally by http://testshib.org<br>
</div>
<div>and tweaked for Dataverse. See also:<br>
</div>
<div><br>
</div>
<div>- attribute-map.xml<br>
</div>
<div>- dataverse-idp-metadata.xml<br>
</div>
<div><br>
</div>
<div>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfiguration<br>
</div>
<div>--><br>
</div>
<div><br>
</div>
<div><SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br>
</div>
<div> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br>
</div>
<div> clockSkew="1800"><br>
</div>
<div><br>
</div>
<div> <!-- FIXME: change the entityID to your hostname. --><br>
</div>
<div> <ApplicationDefaults entityID="https://dataverse.example.edu/sp"<br>
</div>
<div> REMOTE_USER="eppn" attributePrefix="AJP_"><br>
</div>
<div><br>
</div>
<div> <!-- You should use secure cookies if at all possible. See cookieProps in this Wiki article. --><br>
</div>
<div> <!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions --><br>
</div>
<div> <Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="false"><br>
</div>
<div><br>
</div>
<div> <SSO><br>
</div>
<div> SAML2 SAML1<br>
</div>
<div> </SSO><br>
</div>
<div><br>
</div>
<div> <!-- SAML and local-only logout. --><br>
</div>
<div> <!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout --><br>
</div>
<div> <Logout>SAML2 Local</Logout><br>
</div>
<div><br>
</div>
<div> <!--<br>
</div>
<div> Handlers allow you to interact with the SP and gather more information. Try them out!<br>
</div>
<div> Attribute values received by the SP through SAML will be visible at:<br>
</div>
<div> http://dataverse.example.edu/Shibboleth.sso/Session<br>
</div>
<div> --><br>
</div>
<div><br>
</div>
<div> <!-- Extension service that generates "approximate" metadata based on SP configuration. --><br>
</div>
<div> <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br>
</div>
<div><br>
</div>
<div> <!-- Status reporting service. --><br>
</div>
<div> <Handler type="Status" Location="/Status" acl="127.0.0.1"/><br>
</div>
<div><br>
</div>
<div> <!-- Session diagnostic service. --><br>
</div>
<div> <!-- showAttributeValues must be set to true to see attributes at /Shibboleth.sso/Session . --><br>
</div>
<div> <Handler type="Session" Location="/Session" showAttributeValues="true"/><br>
</div>
<div><br>
</div>
<div> <!-- JSON feed of discovery information. --><br>
</div>
<div> <Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br>
</div>
<div><br>
</div>
<div> </Sessions><br>
</div>
<div><br>
</div>
<div> <!-- Error pages to display to yourself if something goes horribly wrong. --><br>
</div>
<div> <Errors supportContact="root@localhost" logoLocation="/shibboleth-sp/logo.jpg"<br>
</div>
<div> styleSheet="/shibboleth-sp/main.css"/><br>
</div>
<div><br>
</div>
<div> <!-- Loads and trusts a metadata file that describes only the Testshib IdP and how to communicate with it. --><br>
</div>
<div> <!-- IdPs we want allow go in /etc/shibboleth/dataverse-idp-metadata.xml --><br>
</div>
<div> <MetadataProvider type="XML" path="dataverse-idp-metadata.xml" backingFilePath="local-idp-metadata.xml" legacyOrgNames="true" reloadInterval="7200"/><br>
</div>
<div> <!-- Uncomment to enable all the Research & Scholarship IdPs from InCommon --><br>
</div>
<div> <!--<br>
</div>
<div> <MetadataProvider type="XML" url="http://md.incommon.org/InCommon/InCommon-metadata.xml" backingFilePath="InCommon-metadata.xml" maxRefreshDelay="3600"><br>
</div>
<div> <DiscoveryFilter type="Whitelist" matcher="EntityAttributes"><br>
</div>
<div> <saml:Attribute<br>
</div>
<div> Name="http://macedir.org/entity-category-support"<br>
</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
</div>
<div> <saml:AttributeValue>http://id.incommon.org/category/research-and-scholarship</saml:AttributeValue><br>
</div>
<div> </saml:Attribute><br>
</div>
<div> <saml:Attribute<br>
</div>
<div> Name="http://macedir.org/entity-category-support"<br>
</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
</div>
<div> <saml:AttributeValue>http://refeds.org/category/research-and-scholarship</saml:AttributeValue><br>
</div>
<div> </saml:Attribute><br>
</div>
<div> </DiscoveryFilter><br>
</div>
<div> </MetadataProvider><br>
</div>
<div> --><br>
</div>
<div><br>
</div>
<div> <!-- Attribute and trust options you shouldn't need to change. --><br>
</div>
<div> <AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/><br>
</div>
<div> <AttributeResolver type="Query" subjectMatch="true"/><br>
</div>
<div> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/><br>
</div>
<div><br>
</div>
<div> <!-- Your SP generated these credentials. They're used to talk to IdP's. --><br>
</div>
<div> <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/><br>
</div>
<div><br>
</div>
<div> </ApplicationDefaults><br>
</div>
<div><br>
</div>
<div> <!-- Security policies you shouldn't change unless you know what you're doing. --><br>
</div>
<div> <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/><br>
</div>
<div><br>
</div>
<div> <!-- Low-level configuration about protocols and bindings available for use. --><br>
</div>
<div> <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/><br>
</div>
<div><br>
</div>
<div></SPConfig><br>
</div>
<span></span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span>---------------------------</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span>I don't see any strange errors in the logs, other than this:</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<b><span>shibd_warn.log:</span></b></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span>
<pre><span style="font-family: Calibri, Helvetica, sans-serif;">2019-12-11 16:28:25 WARN Shibboleth.Application : empty/missing cookieProps setting, set to "https" for SSL/TLS-only usage
2019-12-11 16:28:25 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites</span><br><br><span style="font-family: Calibri, Helvetica, sans-serif;"><b>glassfish.log:</b></span><br><pre><span style="font-family: Calibri, Helvetica, sans-serif;">The SAML assertion for "Shib-Identity-Provider" was null. Please contact support.|#]</span>
</pre>-------------------<br></pre>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span>I would appreciate any feedback that anyone can give me. Does anyone see anything in these that might cause shib to not work with AWS load balancer?
<br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span> <br>
</span></div>
<br>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">Deirdre Kirmis
<div>Web Application Developer</div>
<div><span style="color:rgb(34,34,34); font-size:13.3333px; background-color:rgb(255,255,255)">Discovery Services</span></div>
<div><span style="color:rgb(34,34,34); font-size:13.3333px; background-color:rgb(255,255,255)">ASU </span>Library</div>
<div>Arizona State University </div>
<div>480-965-7240</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Deirdre Kirmis <Deirdre.Kirmis@asu.edu><br>
<b>Sent:</b> Tuesday, December 3, 2019 12:34 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: configuring shibboleth on AWS using ELB</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hi all...I'm still struggling with shibboleth not working on my system. Now, I'm just trying to use the samltest site that Nate sent...have uploaded my metadata to samltest, and have copied the samltest metadata to my site. Samltest shows as a provider on my
site...when I login using that, it goes through the process...lets me pick rick, then takes me back to my site, but does not log in rick or create his account. If I look at the session data, it shows all of the attributes correctly...however in my server log
I get an error that the attributes are null. When I try to "fetch" my site metadata, it just spins and never comes back as uploaded. When I manually upload the file, it acts like it was successful, but when I try the test it says my site is not registered.
What am I doing wrong?<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_Signature">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">
<div style="font-family:Tahoma; font-size:13px">Deirdre Kirmis
<div>Web Application Developer</div>
<div><span style="color:rgb(34,34,34); font-size:13.3333px; background-color:rgb(255,255,255)">Discovery Services</span></div>
<div><span style="color:rgb(34,34,34); font-size:13.3333px; background-color:rgb(255,255,255)">ASU </span>Library</div>
<div>Arizona State University </div>
<div>480-965-7240</div>
</div>
</div>
</div>
</div>
</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Deirdre Kirmis <Deirdre.Kirmis@asu.edu><br>
<b>Sent:</b> Wednesday, November 27, 2019 4:30 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> RE: configuring shibboleth on AWS using ELB</font>
<div> </div>
</div>
<div lang="EN-US">
<div class="x_x_WordSection1">
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
That is great! Thank you…it already told me that I’m missing the metadata for identity provider!</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<div>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
Deirdre Kirmis</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
Technology Services</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
Arizona State University Library</p>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
480-965-7240</p>
</div>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
<b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of </b>Nate Klingenstein<br>
<b>Sent:</b> Wednesday, November 27, 2019 4:26 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> RE: configuring shibboleth on AWS using ELB</p>
</div>
</div>
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
</p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif">Deirdre,</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif"> </span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif">You may find <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__samltest.id_&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=-p3_HucMP6fgoiaOsqwQOGvonEwN8AdOsl8FKuiYMeE&s=WLLruzqa9leUxPFfkRtb0oUfHYVehAPdDs_2-golteE&e=">
https://samltest.id/</a> to be a useful resource. It's basically a fully configured SP that will let you see its logs so you can know exactly what's going on, end to end.</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif"> </span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif">Best wishes,</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif">Nate.</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif"> </span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif">--------</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif"> </span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif; border:solid windowtext 1.0pt; padding:0in"><img id="x_x__x0000_i1025" alt="Image removed by sender." style="width:1.0416in; height:1.0416in" width="100" height="100" border="0" data-outlook-trace="F:2|T:2" src="cid:~WRD000.jpg"></span><span style="font-size:12.0pt; font-family:"Arial",sans-serif"></span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:13.5pt; font-family:"Arial",sans-serif">The Art of Access</span><span style="font-size:12.0pt; font-family:"Arial",sans-serif">
<strong><span style="font-family:"Arial",sans-serif">®</span></strong></span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif"> </span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<strong><span style="font-size:10.0pt; font-family:"Arial",sans-serif">Nate Klingenstein</span></strong><span style="font-size:10.0pt; font-family:"Arial",sans-serif"> | Principal</span><span style="font-size:12.0pt; font-family:"Arial",sans-serif"></span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:10.0pt; font-family:"Arial",sans-serif"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.signet.id_&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=-p3_HucMP6fgoiaOsqwQOGvonEwN8AdOsl8FKuiYMeE&s=TGTv1t1GponuoVksgNyxYaNUwB0-U-468uHc-FilIgw&e=">https://www.signet.id/</a>
</span><span style="font-size:12.0pt; font-family:"Arial",sans-serif"></span></p>
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin:0in; margin-bottom:.0001pt">
<span style="font-size:12.0pt; font-family:"Arial",sans-serif"> </span></p>
<blockquote style="border:none; border-left:solid #B0B0B7 1.5pt; padding:0in 0in 0in 4.0pt; margin-left:3.75pt; margin-top:5.0pt; margin-right:0in; margin-bottom:5.0pt">
<p class="x_x_MsoNormal" style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: "Calibri", sans-serif;">
-----Original message-----<br>
<strong><span style="font-family:"Calibri",sans-serif">From:</span></strong> Deirdre Kirmis<br>
<strong><span style="font-family:"Calibri",sans-serif">Sent:</span></strong> Wednesday, November 27 2019, 12:14 pm<br>
<strong><span style="font-family:"Calibri",sans-serif">To:</span></strong> Shib Users<br>
<strong><span style="font-family:"Calibri",sans-serif">Subject:</span></strong> RE: configuring shibboleth on AWS using ELB<br>
</p>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">Eventually, we will want to set up as a federation SP, but this is just dev at this point, so we are only configuring our org IDP. </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">I did find the documentation on creating the metadata schema/rules, so thanks for that direction. </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">Deirdre Kirmis</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">Technology Services</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">Arizona State University Library</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">480-965-7240</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">-----Original Message-----</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">From: users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> On Behalf Of Cantor, Scott</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">Sent: Wednesday, November 27, 2019 10:39 AM</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">Subject: Re: configuring shibboleth on AWS using ELB</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">On 11/27/19, 12:23 PM, "users on behalf of Deirdre Kirmis" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:Deirdre.Kirmis@asu.edu">Deirdre.Kirmis@asu.edu</a>> wrote:</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">> How do I prepare the metadata myself?</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">It's an XML file with a very defined schema and set of rules for what's in it, but that's probably obvious so the intent of the question is not 100% clear.</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">Speaking in general terms, a federated SP (that is, one dealing with many IdPs of different organizations) really needs to be in a federation, and federations provide metadata management systems generally, though not always.</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">An enterprise SP is dealing with a single IdP and the IdP operator should be providing processes to follow. For myself, I don't ask SPs to give me metadata as a rule, I just expect them to inform me of the keys and hosts through a registration process, then I assign them entityID(s) to use, and I have processes to follow when changes are needed.</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">-- Scott</pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;"> </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">-- </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=vG7jnjpCDSN0QFq4AMsIaEJhlm75brYoTFKZaSTj9Dg&s=nmaRAJ-HfEKwZBp3UslR_FH2lQ7avk7fjdY0-PNAGIA&e">https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=vG7jnjpCDSN0QFq4AMsIaEJhlm75brYoTFKZaSTj9Dg&s=nmaRAJ-HfEKwZBp3UslR_FH2lQ7avk7fjdY0-PNAGIA&e</a>= </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">-- </pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=-p3_HucMP6fgoiaOsqwQOGvonEwN8AdOsl8FKuiYMeE&s=k8dS6UKC2v800qaZG6IlByEGw4QGJlOB7ZLSlCG9I0c&e=">https://wiki.shibboleth.net/confluence/x/coFAAg</a></pre>
<pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Consolas", serif;">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
</div>
</div>
</div>
</body>
</html>