<div dir="ltr"><div>I missed one step. I didn't add</div><div>p:responderIdLookupStrategy-ref="profileResponderIdLookupFunction"</div><div>to <br>"shibboleth.UnverifiedRelyingParty" and "shibboleth.DefaultRelyingParty"</div><div>in relying-party.xml but I'm still getting the same error.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Apr 9, 2020 at 9:58 AM Darren Boss <<a href="mailto:darren.boss@computecanada.ca" target="_blank">darren.boss@computecanada.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">shibboleth.DefaultRelyingParty<div>I'm attaching my issue to this email thread since I'm in a very similar situation with the OpenID extension although I'm integrating with v4.0.0. I've followed that exact page form the wiki to get the extension configured but I'm stuck now with an error when testing an RP when the client tried to register or when I request the /idp/profile/oidc/discovery url. In the logs I keep seeing InvalidProfileConfiguration errors for both registration and for discovery. What files should I be focusing on to fix this issue?</div><div><br></div><div>Here are some of the errors in the logs:</div><div>||||||||||||Discovery||||||Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0<br>INFO [Shibboleth-Audit.OIDCSSO:282] - 142.182.228.204||2020-04-09T13:35:28.929456Z||||||||||||Discovery||||||Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0<br>WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:118] - Profile Action SelectProfileConfiguration: Profile <a href="http://csc.fi/ns/profiles/oidc/registration" target="_blank">http://csc.fi/ns/profiles/oidc/registration</a> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID null)<br>WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:118] - Profile Action SelectProfileConfiguration: Profile <a href="http://csc.fi/ns/profiles/oidc/registration" target="_blank">http://csc.fi/ns/profiles/oidc/registration</a> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID null)<br>WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration<br>WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration</div><div><br></div><div>I'm guessing that I should be scrutinizing relying-party.xml and oidc-relying-party.xml? I added the beans from the wiki to the shibboleth.DefaultRelyingParty as per the wiki instructions.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 8, 2020 at 11:53 PM Ronish Zadode <<a href="mailto:ronish_zadode@persistent.com" target="_blank">ronish_zadode@persistent.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div style="color:rgb(33,33,33);background-color:rgb(255,255,255);text-align:left" dir="auto">
Thanks kevin.. Will look into it </div>
<div id="gmail-m_7858903287146724719gmail-m_2611576305928074005gmail-m_1602648680455881070ms-outlook-mobile-signature">
<div><br>
</div>
Get <a href="https://aka.ms/ghei36" target="_blank">Outlook for Android</a></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_7858903287146724719gmail-m_2611576305928074005gmail-m_1602648680455881070divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Kevin Foote <<a href="mailto:kevin.foote@colorado.edu" target="_blank">kevin.foote@colorado.edu</a>><br>
<b>Sent:</b> Thursday, April 9, 2020 12:59:16 AM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Installation of OpenID connect extension in Shibboleth v3</font>
<div> </div>
</div>
<div><font size="2"><span style="font-size:11pt">
<div>Hi Ronish, <br>
<br>
Here is the best set of install instructions when starting off with the plugin. <br>
<br>
<a href="https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/Installing-from-archive" target="_blank">https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/Installing-from-archive</a><br>
<br>
--------<br>
thanks<br>
kevin.foote<br>
<br>
> On Apr 8, 2020, at 12:39 PM, Ronish Zadode <<a href="mailto:ronish_zadode@persistent.com" target="_blank">ronish_zadode@persistent.com</a>> wrote:<br>
> <br>
> Hi, <br>
> Can someone help me with fix set of steps to install and configure OpenID connect extension correctly in Shibboleth V3. (I'm using V3. 4.6)<br>
> <br>
> Thanks,<br>
> Ronish <br>
> <br>
> Get Outlook for Android<br>
> DISCLAIMER<br>
> ==========<br>
> This e-mail may contain privileged and confidential information which is the property of Persistent Systems Ltd. It is intended only for the use of the individual or entity to which it is addressed. If you are not the intended recipient, you are not authorized
to read, retain, copy, print, distribute or use this message. If you have received this communication in error, please notify the sender and delete all copies of this message. Persistent Systems Ltd. does not accept any liability for virus infected mails.<br>
> -- <br>
> For Consortium Member technical support, see <a href="https://secure-web.cisco.com/1KiHzGKUHh_cxiJKcwdrM2Ck-O79sbCp2eoE0auzC5kxaa_DwlFIUulMgn3CoLVcwIJaq2ah2EJF4kDLDpiGoeQeaHV8Ro595iCsQPK37vHPGpCLrz1hWhzXuaXnZl7pr0_VEDSKgwCoYgkWwbdK6ACHTNMMC4Xnpk3KbKdaPF_4IUC2hY7YZ_NsXmLmEqncaPsoXpUeN7L8iFqoV4MdIXCLLkPVcQuXmzA3ci2nvuenrXfMbVpf4yGZHGygWAQ5Cwuz675eUO8tl6k2twAdWS8gZR5_OQm3Pu3TAHbRTTCJqFIiMd8p57L5l7bWFhQZGr9wgTyme9yfvA8JOfStF8kKlxAbUsT4lgoNq4sb8ZezTQoB8uzJspfkkfE_Mr5MUDlygWcITckic_AT4ie_XH-Nf7unKa1CQaBn2VrkwxE9H1NnuSuNZRxNYFTP5RE7-D7tFEfl5za8u9j11EMbflg/https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg" target="_blank">
https://secure-web.cisco.com/1KiHzGKUHh_cxiJKcwdrM2Ck-O79sbCp2eoE0auzC5kxaa_DwlFIUulMgn3CoLVcwIJaq2ah2EJF4kDLDpiGoeQeaHV8Ro595iCsQPK37vHPGpCLrz1hWhzXuaXnZl7pr0_VEDSKgwCoYgkWwbdK6ACHTNMMC4Xnpk3KbKdaPF_4IUC2hY7YZ_NsXmLmEqncaPsoXpUeN7L8iFqoV4MdIXCLLkPVcQuXmzA3ci2nvuenrXfMbVpf4yGZHGygWAQ5Cwuz675eUO8tl6k2twAdWS8gZR5_OQm3Pu3TAHbRTTCJqFIiMd8p57L5l7bWFhQZGr9wgTyme9yfvA8JOfStF8kKlxAbUsT4lgoNq4sb8ZezTQoB8uzJspfkkfE_Mr5MUDlygWcITckic_AT4ie_XH-Nf7unKa1CQaBn2VrkwxE9H1NnuSuNZRxNYFTP5RE7-D7tFEfl5za8u9j11EMbflg/https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg</a><br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div>
</span></font></div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div><br clear="all"><br>-- <br><div dir="ltr">Darren Boss<br>Senior Programmer/Analyst<br>Programmeur-analyste principal<br><a href="mailto:darren.boss@computecanada.ca" target="_blank">darren.boss@computecanada.ca</a></div>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr">Darren Boss<br>Senior Programmer/Analyst<br>Programmeur-analyste principal<br><a href="mailto:darren.boss@computecanada.ca" target="_blank">darren.boss@computecanada.ca</a></div>