<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
margin:0in;
font-size:8.5pt;
font-family:Menlo;
color:black;}
p.p2, li.p2, div.p2
{mso-style-name:p2;
margin:0in;
font-size:8.5pt;
font-family:Menlo;
color:black;}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.s1
{mso-style-name:s1;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am setting up a test instance of Shibboleth IdP 4.2.1 on Red Hat Linux VM following the steps here:</p>
<p class="MsoNormal"><a href="https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Identity%20Provider/CentOS/HOWTO%20Install%20and%20Configure%20a%20Shibboleth%20IdP%20v4.x%20on%20CentOS%20with%20Apache2%20%2B%20Jetty9.md">https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Identity%20Provider/CentOS/HOWTO%20Install%20and%20Configure%20a%20Shibboleth%20IdP%20v4.x%20on%20CentOS%20with%20Apache2%20%2B%20Jetty9.md</a></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Jetty seems to be working fine.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="p1"><span class="s1"><span style="background:yellow;mso-highlight:yellow"># curl http://127.0.0.1:8080/idp/status</span></span></p>
<p class="p1"><span class="s1">### Operating Environment Information</span></p>
<p class="p1"><span class="s1">operating_system: Linux</span></p>
<p class="p1"><span class="s1">operating_system_version: 4.18.0-372.19.1.el8_6.x86_64</span></p>
<p class="p1"><span class="s1">operating_system_architecture: amd64</span></p>
<p class="p1"><span class="s1">jdk_version: 11.0.16</span></p>
<p class="p1"><span class="s1">available_cores: 4</span></p>
<p class="p1"><span class="s1">used_memory: 229 MB</span></p>
<p class="p1"><span class="s1">maximum_memory: 2048 MB</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">### Identity Provider Information</span></p>
<p class="p1"><span class="s1">idp_version: 4.2.1</span></p>
<p class="p1"><span class="s1">start_time: 2022-09-20T17:53:27.082Z</span></p>
<p class="p1"><span class="s1">current_time: 2022-09-20T19:31:40.291983Z</span></p>
<p class="p1"><span class="s1">uptime: PT1H38M13.209S</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">enabled modules:</span><span class="apple-converted-space"> </span></p>
<p class="p1"><span class="apple-tab-span"> </span><span class="s1">idp.authn.Password (Password Authentication)</span></p>
<p class="p1"><span class="apple-tab-span"> </span><span class="s1">idp.admin.Hello (Hello World)</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">installed plugins:</span><span class="apple-converted-space"> </span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.LoggingService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:22.156155Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:22.156155Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.AttributeFilterService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:25.401245Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:25.401245Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.AttributeResolverService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:25.517952Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:25.517952Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="apple-tab-span"> </span><span class="s1">No Data Connector has ever failed</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.AttributeRegistryService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:24.896078Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:24.896078Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.NameIdentifierGenerationService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:25.608027Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:25.608027Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.RelyingPartyResolverService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:25.687792Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:25.687792Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.MetadataResolverService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:25.151731Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:25.151731Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="apple-tab-span"> </span><span class="s1">No Metadata Resolver has ever attempted a reload</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.ReloadableAccessControlService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:26.145038Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:26.145038Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.ReloadableCASServiceRegistry</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:26.192165Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:26.192165Z</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1">service: shibboleth.ManagedBeanService</span></p>
<p class="p1"><span class="s1">last successful reload attempt: 2022-09-20T17:53:26.209593Z</span></p>
<p class="p1"><span class="s1">last reload attempt: 2022-09-20T17:53:26.209593Z</span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have setup Apache HTTP Server as a reverse proxy as per the instructions in the document above:</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="p1"><span class="s1"><span style="background:yellow;mso-highlight:yellow">more 000-sso.hbsstg.org.conf</span></span></p>
<p class="p1"><span class="s1"># This is an example Apache2 configuration for a Shibboleth Identity Provider</span></p>
<p class="p1"><span class="s1"># installed with IDEM Tutorials.</span></p>
<p class="p1"><span class="s1">#</span></p>
<p class="p1"><span class="s1"># Edit this file and:</span></p>
<p class="p1"><span class="s1"># - Adjust "idp.example.org" with your IdP Full Qualified Domain Name</span></p>
<p class="p1"><span class="s1"># - Adjust "ServerAdmin" email address</span></p>
<p class="p1"><span class="s1"># - Adjust "CustomLog" and "ErrorLog" with Apache log files path (there are examples for Debian or CentOS distribution)</span></p>
<p class="p1"><span class="s1"># - Adjust "SSLCertificateFile", "SSLCertificateKeyFile" and "SSLCACertificateFile" with the correct file path</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1"># SSL general security improvements should be moved in global settings</span></p>
<p class="p1"><span class="s1"># OCSP Stapling, only in httpd/apache >= 2.3.3</span></p>
<p class="p1"><span class="s1">SSLUseStapling on</span></p>
<p class="p1"><span class="s1">SSLStaplingResponderTimeout 5</span></p>
<p class="p1"><span class="s1">SSLStaplingReturnResponderErrors off</span></p>
<p class="p1"><span class="s1">SSLStaplingCache shmcb:/var/run/ocsp(128000)</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1"><VirtualHost *:80></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ServerName "sso.hbsstg.org"</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">Redirect permanent "/" "https://sso.hbsstg.org/"</span></p>
<p class="p1"><span class="s1"></VirtualHost></span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1"><IfModule mod_ssl.c></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"><VirtualHost _default_:443></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ServerName sso.hbsstg.org:443</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ServerAdmin admin@example.org</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"># Debian/Ubuntu</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">CustomLog /var/log/apache2/sso.hbsstg.org.log combined</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ErrorLog /var/log/apache2/sso.hbsstg.org-error.log</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"># Centos</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#CustomLog /var/log/httpd/sso.hbsstg.org.log combined</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#ErrorLog /var/log/httpd/sso.hbsstg.org-error.log</span></p>
<p class="p2"><span class="apple-converted-space"> </span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">DocumentRoot /var/www/html/sso.hbsstg.org</span></p>
<p class="p2"><span class="apple-converted-space"> </span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">SSLEngine On</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aR</span></p>
<p class="p1"><span class="s1">SA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">SSLHonorCipherOrder on</span></p>
<p class="p2"><span class="apple-converted-space"> </span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"># Disallow embedding your IdP's login page within an iframe and</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"># Enable HTTP Strict Transport Security with a 2 year duration</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"><IfModule headers_module></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">Header set X-Frame-Options DENY</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">Header set Strict-Transport-Security "max-age=63072000 ; includeSubDomains ; preload"</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"></IfModule></span></p>
<p class="p2"><span class="apple-converted-space"> </span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"># Debian/Ubuntu</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">SSLCertificateFile /etc/httpd/certs/sso_hbsstg_org.crt</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">SSLCertificateKeyFile /etc/httpd/certs/sso_hbsstg_org.key</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">SSLCertificateChainFile /etc/httpd/certs/sso_hbsstg_org_inter.crt</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#SSLCertificateChainFile /etc/httpd/certs/__hbsstg_org_interm-2.cer</span><span class="apple-converted-space"> </span></p>
<p class="p2"><span class="apple-converted-space"> </span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"># ACME-CA or GEANT_OV_RSA_CA_4 (For users who use GARR TCS/Sectigo RSA Organization Validation Secure Server CA)</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#SSLCACertificateFile /etc/ssl/certs/ACME-CA.pem</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#TODO:</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#SSLCACertificateFile /etc/ssl/certs/GEANT_OV_RSA_CA_4.pem</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"># Centos</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#SSLCertificateFile /etc/pki/tls/certs/sso.hbsstg.org.crt</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#SSLCertificateKeyFile /etc/pki/tls/private/sso.hbsstg.org.key</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"># ACME-CA or GEANT_OV_RSA_CA_4 (For users who use GARR TCS/Sectigo RSA Organization Validation Secure Server CA)</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#SSLCACertificateFile /etc/pki/tls/certs/ACME-CA.pem</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">#SSLCACertificateFile /etc/pki/tls/certs/GEANT_OV_RSA_CA_4.pem</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"><IfModule mod_proxy.c></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ProxyPreserveHost On</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">RequestHeader set X-Forwarded-Proto "https"</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ProxyPass /idp http://localhost:8080/idp retry=5</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ProxyPassReverse /idp http://localhost:8080/idp retry=5</span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"><Location /idp></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">Require all granted</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"></Location></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"></IfModule></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"></VirtualHost></span></p>
<p class="p1"><span class="s1"></IfModule></span></p>
<p class="p2"><o:p> </o:p></p>
<p class="p1"><span class="s1"># This virtualhost is only here to handle administrative commands for Shibboleth, executed from localhost</span></p>
<p class="p1"><span class="s1"><VirtualHost 127.0.0.1:80></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ProxyPass /idp http://localhost:8080/idp retry=5</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">ProxyPassReverse /idp http://localhost:8080/idp retry=5</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"><Location /idp></span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1">Require all granted</span></p>
<p class="p1"><span class="apple-converted-space"> </span><span class="s1"></Location></span></p>
<p class="p1"><span class="s1"></VirtualHost></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I try <a href="https://sso.hbsstg.org/idp/status">https://sso.hbsstg.org/idp/status</a> in a browser, I get the following error message in /var/log/apache2/sso.hbsstg.org-error.log</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="p1"><span class="s1">[Tue Sep 20 15:38:11.634673 2022] [ssl:error] [pid 1403216:tid 140419838465792] (13)Permission denied: [client 10.227.147.169:50290] AH01974: could not connect to OCSP responder 'ocsp.usertrust.com'</span></p>
<p class="p1"><span class="s1">[Tue Sep 20 15:38:11.634775 2022] [ssl:error] [pid 1403216:tid 140419838465792] AH01941: stapling_renew_response: responder error</span></p>
<p class="p1"><span class="s1">[Tue Sep 20 15:38:11.638356 2022] [ssl:error] [pid 1402919:tid 140419627005696] (13)Permission denied: [client 10.227.147.169:50289] AH01974: could not connect to OCSP responder 'ocsp.usertrust.com'</span></p>
<p class="p1"><span class="s1">[Tue Sep 20 15:38:11.638452 2022] [ssl:error] [pid 1402919:tid 140419627005696] AH01941: stapling_renew_response: responder error</span></p>
<p class="p1"><span class="s1">[Tue Sep 20 15:38:11.666173 2022] [proxy:error] [pid 1403216:tid 140419838465792] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:8080 (localhost) failed</span></p>
<p class="p1"><span class="s1">[Tue Sep 20 15:38:11.666222 2022] [proxy_http:error] [pid 1403216:tid 140419838465792] [client 10.227.147.169:50290] AH01114: HTTP: failed to make connection to backend: localhost</span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="background:yellow;mso-highlight:yellow">I can see the index page here:
<a href="https://sso.hbsstg.org">https://sso.hbsstg.org</a></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I was wondering if anyone has setup Shibboleth IdP 4.x following the installation instructions described above and what I might be doing wrong. Thanks for your help.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<br>
Sunil</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>