<div dir="ltr"><div dir="ltr"><div dir="ltr">Hello, I'm new to Shibboleth and I'm trying to use Shibboleth IdP v5 as an Identity Provider, using the External authentication method, authenticating in a custom JSP page, similar to the example provided in the documentation at <a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369/ExternalAuthnConfiguration">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369/ExternalAuthnConfiguration</a>.</div><div dir="ltr">I'm trying to configure everything so that the IdP serves authentication requests sent from Google Workspace (i.e., Google acting as the Service Provider), but I'm not getting it to work.<br><br></div><div dir="ltr">For a proof of concept, I installed Shiboleth IdP v5.1.3 with Jetty 12.0.13 using the packaged Windows Installation installer.<br>I'm using a tunnel with ngrok to publish the IdP+Jetty host (ngrok http 443).<br><br>In Google Workspace (Google Admin console > Security > Authentication > SSO with third-party IdP), I configured the IdP name and uploaded the signing certificate generated during the IdP installation.<br>The URL of the sign-in page points to the JSP page that implements external authentication: https://<MY_NGROK_HOST>/idp/external.jsp<br><br>When receiving the authentication request, it throws the following exception:<br><font face="monospace">2025-03-17 12:52:46,330 - - ERROR [net.shibboleth.shared.spring.error.ErrorRaisingController:63] - Propagating exception thrown by request to /idp/external.jsp<br>2025-03-17 12:52:46,331 - - ERROR [net.shibboleth.idp.authn.ExternalAuthenticationException:144] -<br>net.shibboleth.idp.authn.ExternalAuthenticationException: No conversation key found in request<br>at net.shibboleth.idp.authn.ExternalAuthentication.startExternalAuthentication(ExternalAuthentication.java:159)<br></font><br>What I'm doing wrong? Can someone please help me?<br>Thank you very much!</div><div dir="ltr"><br></div><div dir="ltr">Martin<br><br>Configuration details, jsp page and IdP Status below:<br><b><br></b></div><div dir="ltr"><b>conf/authn/authn.properties:<br></b><font face="monospace">idp.authn.flows = External<br>idp.authn.External.addDefaultPrincipals = false<br>idp.authn.External.externalAuthnPath = contextRelative:external.jsp</font><br><br><b>conf/metadata-providers.xml:<br></b><font face="monospace"><?xml version="1.0" encoding="UTF-8"?><br><MetadataProvider ....><br>    <MetadataProvider id="LocalEntityMetadata" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/google-metadata.xml"/><br></MetadataProvider><br></font><br><br><b>metadata/google-metadata.xml:<br></b><font face="monospace"><md:EntityDescriptor entityID="<a href="https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx">https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx</a>" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><br>    <md:SPSSODescriptor WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>        <md:KeyDescriptor use="signing"><br>            <ds:KeyInfo><br>                <ds:X509Data><br>                    <ds:X509Certificate>CERTIFICATE_DATA</ds:X509Certificate><br>                </ds:X509Data><br>            </ds:KeyInfo><br>        </md:KeyDescriptor><br>        <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx/acs">https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx/acs</a>" /><br>        <md:AssertionConsumerService index="1" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx/acs">https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx/acs</a>" /><br>    </md:SPSSODescriptor><br></md:EntityDescriptor><br></font><br><br><b>edit-webapp/external.jsp:<br></b><font face="monospace"><%@page import="ch.qos.logback.core.net.SyslogOutputStream"%><br><%@ page language="java" contentType="text/html; charset=UTF-8"<br>pageEncoding="UTF-8"%><br><%@ page import="net.shibboleth.idp.authn.*"%><br><%@ page import="net.shibboleth.idp.attribute.*"%><br><%@ page import="net.shibboleth.idp.authn.principal.*"%><br><%@ page import="net.shibboleth.shared.primitive.LoggerFactory"%><br><%@ page import="java.util.*"%><br><%@ page import="java.security.*"%><br><%@ page import="javax.security.auth.*"%><br><%@ page import="org.slf4j.Logger"%><br><%<br>final Logger log = LoggerFactory.getLogger("external.jsp");<br><br>try {<br>    <a href="http://log.info">log.info</a>("Inicia autenticación externa");<br><br>    /**<br>     * External authentication logic<br>     **/<br><br>    final String key = ExternalAuthentication.startExternalAuthentication(request); // EXCEPTION THROWN HERE<br><br>    String userName = "myusername";<br>    HashSet<Principal> principals=new HashSet<Principal>();<br>    principals.add(new UsernamePrincipal(userName));<br><br></font></div><div dir="ltr"><font face="monospace">    IdPAttribute attr=new IdPAttribute("uid");<br>    attr.setValues(Collections.singletonList(new StringAttributeValue(userName)));<br>    principals.add(new IdPAttributePrincipal(attr));<br><br>    attr=new IdPAttribute("mail");<br>    attr.setValues(Collections.singletonList(new StringAttributeValue(userName + "@mydomain")));<br>    principals.add(new IdPAttributePrincipal(attr));<br><br>    attr=new IdPAttribute("displayName");<br>    attr.setValues(Collections.singletonList(new StringAttributeValue(userName)));<br>    principals.add(new IdPAttributePrincipal(attr));<br><br>    attr=new IdPAttribute("eduPersonAffiliation");<br>    attr.setValues(Collections.singletonList(new StringAttributeValue("member")));<br>    principals.add(new IdPAttributePrincipal(attr));<br><br>    request.setAttribute(ExternalAuthentication.SUBJECT_KEY,new Subject(false, principals, Collections.EMPTY_SET, Collections.EMPTY_SET));<br><br>    ExternalAuthentication.finishExternalAuthentication(key, request, response);<br>} catch (final ExternalAuthenticationException e) {<br>    log.error("Error processing external authentication request", e);<br>    throw new ServletException("Error processing external authentication request", e);<br>}<br>%></font><br><br><b>IDP Status:<br></b><font face="monospace">### Operating Environment Information<br>operating_system: Windows 11<br>operating_system_version: 10.0<br>operating_system_architecture: amd64<br>jdk_version: 17.0.14<br>available_cores: 12<br>used_memory: 86 MB<br>maximum_memory: 2048 MB<br><br>### Identity Provider Information<br>idp_version: 5.1.3<br>start_time: 2025-03-13T17:14:30.287Z<br>current_time: 2025-03-14T19:34:18.989696100Z<br>uptime: PT26H19M48.702S<br><br>enabled modules:<br>        idp.Core (Core IdP Functions (Required))<br>        idp.CommandLine (Command Line Scripts)<br>        idp.EditWebApp (Overlay Tree for WAR Build)<br>        idp.authn.Password (Password Authentication)<br>        idp.admin.Hello (Hello World)<br>        idp.plugin.MetadataGen (SAML Metadata Generator)<br><br>installed plugins:<br>        net.shibboleth.idp.plugin.metadatagen Version 2.0.0<br>        net.shibboleth.idp.plugin.nashorn Version 2.0.0</font></div>
</div>
</div>