<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,</p>
<p>I read many posts about this problem on the list.</p>
<p>The error most of the time is a wrong path in the shibboleth2.xml
of the sp or a wronf EntityId in the metadata of the IDP.</p>
<p>I checked both, but I still get this error :<br>
</p>
<blockquote>Unable to locate metadata for identity provider
(<a class="moz-txt-link-freetext" href="http://idp.docker.localhost/idp/shibboleth">http://idp.docker.localhost/idp/shibboleth</a>)<br>
Unknown or Unusable Identity Provider<br>
The identity provider supplying your login credentials is not
authorized
for use with this service or does not support the necessary
capabilities.<br>
To report this problem, please contact the site administrator at
<a href="mailto:admin@idp.docker.localhost">admin@idp.docker.localhost</a>.
<br>
Please include the following error message in any email:<br>
Identity provider lookup failed at
(<a class="moz-txt-link-freetext" href="http://sp.docker.localhost/secure">http://sp.docker.localhost/secure</a>)<br>
<strong>EntityID:</strong>
<a class="moz-txt-link-freetext" href="http://idp.docker.localhost/idp/shibboleth">http://idp.docker.localhost/idp/shibboleth</a><br>
<p>opensaml::saml2md::MetadataException: Unable to locate metadata
for identity provider
(<a class="moz-txt-link-freetext" href="http://idp.docker.localhost/idp/shibboleth">http://idp.docker.localhost/idp/shibboleth</a>)</p>
</blockquote>
<p><br>
</p>
<p>Do you see something wrong with any of these files? Thanks for
your help.</p>
<p>My shibboleth2.xml on the sp is this :</p>
<p><SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"<br>
xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"<br>
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br>
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"<br>
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br>
clockSkew="180"><br>
<br>
<!-- The ApplicationDefaults element is where most of
Shibboleth's SAML bits are defined. --><br>
<ApplicationDefaults
entityID=<a class="moz-txt-link-rfc2396E" href="http://sp.docker.localhost/idp/shibboleth">"http://sp.docker.localhost/idp/shibboleth"</a>
REMOTE_USER="eppn uid persistent-id targeted-id"><br>
<br>
<Sessions lifetime="28800" timeout="3600"
relayState="ss:mem"<br>
checkAddress="false" handlerSSL="true"
cookieProps="https"><br>
<br>
<SSO
entityID=<a class="moz-txt-link-rfc2396E" href="http://idp.docker.localhost/idp/shibboleth">"http://idp.docker.localhost/idp/shibboleth"</a>><br>
SAML2<br>
</SSO><br>
<br>
<!-- SAML and local-only logout. --><br>
<Logout>SAML2 Local</Logout><br>
<br>
<!-- Extension service that generates "approximate"
metadata based on SP configuration. --><br>
<Handler type="MetadataGenerator"
Location="/Metadata" signing="false"/><br>
<br>
<!-- Status reporting service. --><br>
<Handler type="Status" Location="/Status"
acl="127.0.0.1 ::1"/><br>
<br>
<!-- Session diagnostic service. --><br>
<Handler type="Session" Location="/Session"
showAttributeValues="false"/><br>
<br>
<!-- JSON feed of discovery information. --><br>
<Handler type="DiscoveryFeed"
Location="/DiscoFeed"/><br>
</Sessions><br>
<br>
<!--<br>
Allows overriding of error template information/filenames.
You can<br>
also add attributes with values that can be plugged into
the templates.<br>
--><br>
<Errors supportContact=<a class="moz-txt-link-rfc2396E" href="mailto:admin@idp.docker.localhost">"admin@idp.docker.localhost"</a><br>
helpLocation="/about.html"<br>
styleSheet="/shibboleth-sp/main.css"/><br>
<br>
<MetadataProvider type="XML" validate="true"
path="metadata/idp-metadata.xml" legacyOrgNames="true"/><br>
<br>
<!-- Map to extract attributes from SAML assertions.
--><br>
<AttributeExtractor type="XML" validate="true"
reloadChanges="false" path="attribute-map.xml"/><br>
<br>
<!-- Use a SAML query if no attributes are supplied
during SSO. --><br>
<AttributeResolver type="Query"
subjectMatch="true"/><br>
<br>
<!-- Default filtering policy for recognized
attributes, lets other data pass. --><br>
<AttributeFilter type="XML" validate="true"
path="attribute-policy.xml"/><br>
<br>
<!-- Simple file-based resolver for using a single
keypair. --><br>
<CredentialResolver type="File"
key="/run/secrets/sp_key"
certificate="credentials/sp-cert.pem"/><br>
<br>
</ApplicationDefaults><br>
<br>
<!-- Policies that determine how to process and
authenticate runtime messages. --><br>
<SecurityPolicyProvider type="XML" validate="true"
path="security-policy.xml"/><br>
<br>
<!-- Low-level configuration about protocols and bindings
available for use. --><br>
<ProtocolProvider type="XML" validate="true"
reloadChanges="false" path="protocols.xml"/><br>
<br>
</SPConfig><br>
</p>
<p>My IDP metadata is this :</p>
<p><?xml version="1.0" encoding="UTF-8"?><br>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2000/09/xmldsig#">"http://www.w3.org/2000/09/xmldsig#"</a>
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xml=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/XML/1998/namespace">"http://www.w3.org/XML/1998/namespace"</a>
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
xmlns:req-attr="urn:oasis:names:tc:SAML:protocol:ext:req-attr"
validUntil="2020-07-02T09:04:27.274Z"
entityID=<a class="moz-txt-link-rfc2396E" href="http://idp.docker.localhost/idp/shibboleth">"http://idp.docker.localhost/idp/shibboleth"</a>><br>
<br>
<IDPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0"><br>
<br>
<!-- First signing certificate is BackChannel, the
Second is FrontChannel --><br>
<KeyDescriptor use="signing"><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><br>
***<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
</KeyDescriptor><br>
<KeyDescriptor use="signing"><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><br>
***<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
</KeyDescriptor><br>
<KeyDescriptor use="encryption"><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><br>
***<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
</KeyDescriptor><br>
<br>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
req-attr:supportsRequestedAttributes="true"
Location=<a class="moz-txt-link-rfc2396E" href="http://idp.docker.localhost/idp/profile/SAML2/Redirect/SSO">"http://idp.docker.localhost/idp/profile/SAML2/Redirect/SSO"</a>/><br>
<SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location=<a class="moz-txt-link-rfc2396E" href="http://idp.docker.localhost/idp/profile/Shibboleth/SSO">"http://idp.docker.localhost/idp/profile/Shibboleth/SSO"</a>/><br>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
req-attr:supportsRequestedAttributes="true"
Location=<a class="moz-txt-link-rfc2396E" href="http://idp.docker.localhost/idp/profile/SAML2/POST-SimpleSign/SSO">"http://idp.docker.localhost/idp/profile/SAML2/POST-SimpleSign/SSO"</a>/><br>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
req-attr:supportsRequestedAttributes="true"
Location=<a class="moz-txt-link-rfc2396E" href="http://idp.docker.localhost/idp/profile/SAML2/POST/SSO">"http://idp.docker.localhost/idp/profile/SAML2/POST/SSO"</a>/><br>
<br>
</IDPSSODescriptor><br>
<br>
<br>
<AttributeAuthorityDescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol"><br>
<br>
<Extensions><br>
<shibmd:Scope
regexp="false">docker.localhost</shibmd:Scope><br>
</Extensions><br>
<br>
<!-- First signing certificate is BackChannel, the
Second is FrontChannel --><br>
<KeyDescriptor use="signing"><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><br>
***<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
</KeyDescriptor><br>
<KeyDescriptor use="signing"><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><br>
***<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
</KeyDescriptor><br>
<KeyDescriptor use="encryption"><br>
<ds:KeyInfo><br>
<ds:X509Data><br>
<ds:X509Certificate><br>
***<br>
</ds:X509Certificate><br>
</ds:X509Data><br>
</ds:KeyInfo><br>
<br>
</KeyDescriptor><br>
<br>
</AttributeAuthorityDescriptor><br>
<br>
</EntityDescriptor><br>
<br>
</p>
<p><br>
</p>
<p>-- </p>
<pre class="moz-signature" cols="72">Julien Cochennec
Pôle de compétences - gestion des identités
Mél <a class="moz-txt-link-abbreviated" href="mailto:julien.cochennec@ac-orleans-tours.fr">julien.cochennec@ac-orleans-tours.fr</a></pre>
</body>
</html>