<div dir="auto">Check for SELinux errors in /var/log/messages? Apache can be finicky about those settings. Also if the server can't connect to <a href="http://ocsp.usertrust.com">ocsp.usertrust.com</a> maybe there is a firewall issue? That site should be reachable from anywhere... </div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 20, 2022, 4:47 PM Mathew, Sunil via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="m_7409934500240515974WordSection1">
<p class="MsoNormal">Hi,</p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am setting up a test instance of Shibboleth IdP 4.2.1 on Red Hat Linux VM following the steps here:</p>
<p class="MsoNormal"><a href="https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Identity%20Provider/CentOS/HOWTO%20Install%20and%20Configure%20a%20Shibboleth%20IdP%20v4.x%20on%20CentOS%20with%20Apache2%20%2B%20Jetty9.md" target="_blank" rel="noreferrer">https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Identity%20Provider/CentOS/HOWTO%20Install%20and%20Configure%20a%20Shibboleth%20IdP%20v4.x%20on%20CentOS%20with%20Apache2%20%2B%20Jetty9.md</a></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Jetty seems to be working fine.</p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"><span style="background:yellow"># curl <a href="http://127.0.0.1:8080/idp/status" target="_blank" rel="noreferrer">http://127.0.0.1:8080/idp/status</a></span></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">### Operating Environment Information</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">operating_system: Linux</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">operating_system_version: 4.18.0-372.19.1.el8_6.x86_64</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">operating_system_architecture: amd64</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">jdk_version: 11.0.16</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">available_cores: 4</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">used_memory: 229 MB</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">maximum_memory: 2048 MB</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">### Identity Provider Information</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">idp_version: 4.2.1</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">start_time: 2022-09-20T17:53:27.082Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">current_time: 2022-09-20T19:31:40.291983Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">uptime: PT1H38M13.209S</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">enabled modules:</span><span class="m_7409934500240515974apple-converted-space"> </span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-tab-span"> </span><span class="m_7409934500240515974s1">idp.authn.Password (Password Authentication)</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-tab-span"> </span><span class="m_7409934500240515974s1">idp.admin.Hello (Hello World)</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">installed plugins:</span><span class="m_7409934500240515974apple-converted-space"> </span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.LoggingService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:22.156155Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:22.156155Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.AttributeFilterService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:25.401245Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:25.401245Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.AttributeResolverService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:25.517952Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:25.517952Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-tab-span"> </span><span class="m_7409934500240515974s1">No Data Connector has ever failed</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.AttributeRegistryService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:24.896078Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:24.896078Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.NameIdentifierGenerationService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:25.608027Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:25.608027Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.RelyingPartyResolverService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:25.687792Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:25.687792Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.MetadataResolverService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:25.151731Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:25.151731Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-tab-span"> </span><span class="m_7409934500240515974s1">No Metadata Resolver has ever attempted a reload</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.ReloadableAccessControlService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:26.145038Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:26.145038Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.ReloadableCASServiceRegistry</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:26.192165Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:26.192165Z</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">service: shibboleth.ManagedBeanService</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last successful reload attempt: 2022-09-20T17:53:26.209593Z</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">last reload attempt: 2022-09-20T17:53:26.209593Z</span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I have setup Apache HTTP Server as a reverse proxy as per the instructions in the document above:</p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"><span style="background:yellow">more 000-sso.hbsstg.org.conf</span></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># This is an example Apache2 configuration for a Shibboleth Identity Provider</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># installed with IDEM Tutorials.</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">#</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># Edit this file and:</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># - Adjust "<a href="http://idp.example.org" target="_blank" rel="noreferrer">idp.example.org</a>" with your IdP Full Qualified Domain Name</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># - Adjust "ServerAdmin" email address</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># - Adjust "CustomLog" and "ErrorLog" with Apache log files path (there are examples for Debian or CentOS distribution)</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># - Adjust "SSLCertificateFile", "SSLCertificateKeyFile" and "SSLCACertificateFile" with the correct file path</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># SSL general security improvements should be moved in global settings</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># OCSP Stapling, only in httpd/apache >= 2.3.3</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">SSLUseStapling on</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">SSLStaplingResponderTimeout 5</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">SSLStaplingReturnResponderErrors off</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">SSLStaplingCache shmcb:/var/run/ocsp(128000)</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"><VirtualHost *:80></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ServerName "<a href="http://sso.hbsstg.org" target="_blank" rel="noreferrer">sso.hbsstg.org</a>"</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">Redirect permanent "/" "<a href="https://sso.hbsstg.org/" target="_blank" rel="noreferrer">https://sso.hbsstg.org/</a>"</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"></VirtualHost></span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"><IfModule mod_ssl.c></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"><VirtualHost _default_:443></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ServerName <a href="http://sso.hbsstg.org:443" target="_blank" rel="noreferrer">sso.hbsstg.org:443</a></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ServerAdmin <a href="mailto:admin@example.org" target="_blank" rel="noreferrer">admin@example.org</a></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"># Debian/Ubuntu</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">CustomLog /var/log/apache2/sso.hbsstg.org.log combined</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ErrorLog /var/log/apache2/sso.hbsstg.org-error.log</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"># Centos</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#CustomLog /var/log/httpd/sso.hbsstg.org.log combined</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#ErrorLog /var/log/httpd/sso.hbsstg.org-error.log</span></p>
<p class="m_7409934500240515974p2"><span class="m_7409934500240515974apple-converted-space"> </span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">DocumentRoot /var/www/html/<a href="http://sso.hbsstg.org" target="_blank" rel="noreferrer">sso.hbsstg.org</a></span></p>
<p class="m_7409934500240515974p2"><span class="m_7409934500240515974apple-converted-space"> </span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">SSLEngine On</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aR</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">SA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">SSLHonorCipherOrder on</span></p>
<p class="m_7409934500240515974p2"><span class="m_7409934500240515974apple-converted-space"> </span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"># Disallow embedding your IdP's login page within an iframe and</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"># Enable HTTP Strict Transport Security with a 2 year duration</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"><IfModule headers_module></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">Header set X-Frame-Options DENY</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">Header set Strict-Transport-Security "max-age=63072000 ; includeSubDomains ; preload"</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"></IfModule></span></p>
<p class="m_7409934500240515974p2"><span class="m_7409934500240515974apple-converted-space"> </span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"># Debian/Ubuntu</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">SSLCertificateFile /etc/httpd/certs/sso_hbsstg_org.crt</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">SSLCertificateKeyFile /etc/httpd/certs/sso_hbsstg_org.key</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">SSLCertificateChainFile /etc/httpd/certs/sso_hbsstg_org_inter.crt</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#SSLCertificateChainFile /etc/httpd/certs/__hbsstg_org_interm-2.cer</span><span class="m_7409934500240515974apple-converted-space"> </span></p>
<p class="m_7409934500240515974p2"><span class="m_7409934500240515974apple-converted-space"> </span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"># ACME-CA or GEANT_OV_RSA_CA_4 (For users who use GARR TCS/Sectigo RSA Organization Validation Secure Server CA)</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#SSLCACertificateFile /etc/ssl/certs/ACME-CA.pem</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#TODO:</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#SSLCACertificateFile /etc/ssl/certs/GEANT_OV_RSA_CA_4.pem</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"># Centos</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#SSLCertificateFile /etc/pki/tls/certs/sso.hbsstg.org.crt</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#SSLCertificateKeyFile /etc/pki/tls/private/sso.hbsstg.org.key</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"># ACME-CA or GEANT_OV_RSA_CA_4 (For users who use GARR TCS/Sectigo RSA Organization Validation Secure Server CA)</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#SSLCACertificateFile /etc/pki/tls/certs/ACME-CA.pem</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">#SSLCACertificateFile /etc/pki/tls/certs/GEANT_OV_RSA_CA_4.pem</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"><IfModule mod_proxy.c></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ProxyPreserveHost On</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">RequestHeader set X-Forwarded-Proto "https"</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ProxyPass /idp <a href="http://localhost:8080/idp" target="_blank" rel="noreferrer">http://localhost:8080/idp</a> retry=5</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ProxyPassReverse /idp <a href="http://localhost:8080/idp" target="_blank" rel="noreferrer">http://localhost:8080/idp</a> retry=5</span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"><Location /idp></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">Require all granted</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"></Location></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"></IfModule></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"></VirtualHost></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"></IfModule></span></p>
<p class="m_7409934500240515974p2"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"># This virtualhost is only here to handle administrative commands for Shibboleth, executed from localhost</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"><VirtualHost <a href="http://127.0.0.1:80" target="_blank" rel="noreferrer">127.0.0.1:80</a>></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ProxyPass /idp <a href="http://localhost:8080/idp" target="_blank" rel="noreferrer">http://localhost:8080/idp</a> retry=5</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">ProxyPassReverse /idp <a href="http://localhost:8080/idp" target="_blank" rel="noreferrer">http://localhost:8080/idp</a> retry=5</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"><Location /idp></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1">Require all granted</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974apple-converted-space"> </span><span class="m_7409934500240515974s1"></Location></span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1"></VirtualHost></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">When I try <a href="https://sso.hbsstg.org/idp/status" target="_blank" rel="noreferrer">https://sso.hbsstg.org/idp/status</a> in a browser, I get the following error message in /var/log/apache2/sso.hbsstg.org-error.log</p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">[Tue Sep 20 15:38:11.634673 2022] [ssl:error] [pid 1403216:tid 140419838465792] (13)Permission denied: [client <a href="http://10.227.147.169:50290" target="_blank" rel="noreferrer">10.227.147.169:50290</a>] AH01974: could not connect to OCSP responder '<a href="http://ocsp.usertrust.com" target="_blank" rel="noreferrer">ocsp.usertrust.com</a>'</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">[Tue Sep 20 15:38:11.634775 2022] [ssl:error] [pid 1403216:tid 140419838465792] AH01941: stapling_renew_response: responder error</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">[Tue Sep 20 15:38:11.638356 2022] [ssl:error] [pid 1402919:tid 140419627005696] (13)Permission denied: [client <a href="http://10.227.147.169:50289" target="_blank" rel="noreferrer">10.227.147.169:50289</a>] AH01974: could not connect to OCSP responder '<a href="http://ocsp.usertrust.com" target="_blank" rel="noreferrer">ocsp.usertrust.com</a>'</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">[Tue Sep 20 15:38:11.638452 2022] [ssl:error] [pid 1402919:tid 140419627005696] AH01941: stapling_renew_response: responder error</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">[Tue Sep 20 15:38:11.666173 2022] [proxy:error] [pid 1403216:tid 140419838465792] (13)Permission denied: AH00957: HTTP: attempt to connect to <a href="http://127.0.0.1:8080" target="_blank" rel="noreferrer">127.0.0.1:8080</a> (localhost) failed</span></p>
<p class="m_7409934500240515974p1"><span class="m_7409934500240515974s1">[Tue Sep 20 15:38:11.666222 2022] [proxy_http:error] [pid 1403216:tid 140419838465792] [client <a href="http://10.227.147.169:50290" target="_blank" rel="noreferrer">10.227.147.169:50290</a>] AH01114: HTTP: failed to make connection to backend: localhost</span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="background:yellow">I can see the index page here:
<a href="https://sso.hbsstg.org" target="_blank" rel="noreferrer">https://sso.hbsstg.org</a></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I was wondering if anyone has setup Shibboleth IdP 4.x following the installation instructions described above and what I might be doing wrong. Thanks for your help.</p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Regards,<br>
Sunil</p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" rel="noreferrer">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>