<div dir="ltr">Hey Everyone,<div><br></div><div>When inputting the IdP URI into my SP (ONTAP), I receive the following error. </div><div><br></div><div>"
Complete: SAML job failed, Reason: IdP metadata downloaded from the 
provided URL does not have the "entityID" attribute with namespace 
"urn:oasis:names:tc:SAML:2.0:metadata". [12320809]"</div><div><br></div><div>I confirmed that the SP and my server that hosts Shibboleth are successfully talking and the SP can download the metadata but I'm missing the entityID somewhere within the idp.metadata.xml. I tried placing it between <Extensions> </Extensions>, however, that caused the SP to not have the ability to download the metadata. </div><div><br></div><div>I pasted my idp-metadata.xml below but just took out some environment specific details. </div><div><br></div><div>I appreciate any insight yall may be able to provide. </div><div><br></div><div><br></div><div><br></div><div><?xml version="1.0" encoding="UTF-8"?><br><!--<br>     This is example metadata only. Do *NOT* supply it as is without review,<br>     and do *NOT* provide it in real time to your partners.<br><br>     This metadata is not dynamic - it will not change as your configuration changes.<br>--><br><EntityDescriptor  xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="<a href="http://www.w3.org/XML/1998/namespace">http://www.w3.org/XML/1998/namespace</a>" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:req-attr="urn:oasis:names:tc:SAML:protocol:ext:req-attr" validUntil="2022-08-25T17:27:44.480Z" entityID="<a href="https://Test.com/shibboleth/idp">https://Test.com/shibboleth/idp</a>"><br><br>    <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0"><br><br>        <Extensions><br>            <shibmd:Scope regexp="false">.com</shibmd:Scope><br><br>    Fill in the details for your IdP here <br><br>            <mdui:UIInfo><br>                <mdui:DisplayName xml:lang="en">Test (display Name)</mdui:DisplayName><br>                <mdui:Description xml:lang="en">Test (Description)</mdui:Description><br>                <mdui:Logo height="80" width="80"><a href="https://Test.com/shibboleth/idp/Path/To/Logo.png">https://Test.com/shibboleth/idp/Path/To/Logo.png</a></mdui:Logo><br>            </mdui:UIInfo><br><br>        </Extensions><br><br>        <!-- First signing certificate is BackChannel, the Second is FrontChannel --><br>        <KeyDescriptor use="signing"><br>            <ds:KeyInfo><br>                    <ds:X509Data><br>                        <ds:X509Certificate><br>k=<br>                        </ds:X509Certificate><br>                    </ds:X509Data><br>            </ds:KeyInfo><br><br>        </KeyDescriptor><br>        <KeyDescriptor use="signing"><br>            <ds:KeyInfo><br>                    <ds:X509Data><br>                        <ds:X509Certificate><br><br>                        </ds:X509Certificate><br>                    </ds:X509Data><br>            </ds:KeyInfo><br><br>        </KeyDescriptor><br>        <KeyDescriptor use="encryption"><br>            <ds:KeyInfo><br>                    <ds:X509Data><br>                        <ds:X509Certificate><br><br>                        </ds:X509Certificate><br>                    </ds:X509Data><br>            </ds:KeyInfo><br><br>        </KeyDescriptor><br><br>        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="<a href="https://Test.com:8443/idp/profile/SAML1/SOAP/ArtifactResolution">https://Test.com:8443/idp/profile/SAML1/SOAP/ArtifactResolution</a>" index="1"/><br>        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://

Test.com:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/><br><br>        <!--<br>        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://

Test.com/idp/profile/SAML2/Redirect/SLO"/><br>        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://Test.com/idp/profile/SAML2/POST/SLO">https://Test.com/idp/profile/SAML2/POST/SLO</a>"/><br>        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://Test.com/idp/profile/SAML2/POST-SimpleSign/SLO">https://Test.com/idp/profile/SAML2/POST-SimpleSign/SLO</a>"/><br>        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://Test.com:8443/idp/profile/SAML2/SOAP/SLO">https://Test.com:8443/idp/profile/SAML2/SOAP/SLO</a>"/><br>        --><br><br>        <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="<a href="https://Test.coml/idp/profile/Shibboleth/SSO">https://Test.coml/idp/profile/Shibboleth/SSO</a>"/><br>        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" req-attr:supportsRequestedAttributes="true" Location="<a href="https://Test.com/idp/profile/SAML2/POST/SSO">https://Test.com/idp/profile/SAML2/POST/SSO</a>"/><br>        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" req-attr:supportsRequestedAttributes="true" Location="Test.com/idp/profile/SAML2/POST-SimpleSign/SSO"/><br>        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" req-attr:supportsRequestedAttributes="true" Location="<a href="https://Test.com/idp/profile/SAML2/Redirect/SSO">https://Test.com/idp/profile/SAML2/Redirect/SSO</a>"/><br><br>    </IDPSSODescriptor><br><br><br>    <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol"><br><br>        <Extensions><br>            <shibmd:Scope regexp="false">.com</shibmd:Scope><br>        </Extensions><br><br>        <!-- First signing certificate is BackChannel, the Second is FrontChannel --><br>        <KeyDescriptor use="signing"><br>            <ds:KeyInfo><br>                    <ds:X509Data><br>                        <ds:X509Certificate><br><br><br>                        </ds:X509Certificate><br>                    </ds:X509Data><br>            </ds:KeyInfo><br><br>        </KeyDescriptor><br>        <KeyDescriptor use="signing"><br>            <ds:KeyInfo><br>                    <ds:X509Data><br>                        <ds:X509Certificate><br><br>                        </ds:X509Certificate><br>                    </ds:X509Data><br>            </ds:KeyInfo><br><br>        </KeyDescriptor><br>        <KeyDescriptor use="encryption"><br>            <ds:KeyInfo><br>                    <ds:X509Data><br>                        <ds:X509Certificate><br><br>                        </ds:X509Certificate><br>                    </ds:X509Data><br>            </ds:KeyInfo><br><br>        </KeyDescriptor><br><br>        <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="<a href="https://Test.com:8443/idp/profile/SAML1/SOAP/AttributeQuery">https://Test.com:8443/idp/profile/SAML1/SOAP/AttributeQuery</a>"/><br>        <!-- <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://Test.com:8443/idp/profile/SAML2/SOAP/AttributeQuery">https://Test.com:8443/idp/profile/SAML2/SOAP/AttributeQuery</a>"/> --><br>        <!-- If you uncomment the above you should add urn:oasis:names:tc:SAML:2.0:protocol to the protocolSupportEnumeration above --><br><br>    </AttributeAuthorityDescriptor><br><br></EntityDescriptor><br></div></div>