<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 4/5/25 8:41 PM, o haya via users
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CABbNdt6JiRbs8oX_MFoK6rG-ywoi5=_c_uX0eXEQQ-_OxgeNDg@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div>Hi,</div>
<div><br>
</div>
<div>I installed Shibboleth IdP,</div>
</div>
</blockquote>
<p>See below, but presumably you installed 5.1.3? You'll want to
update to 5.1.4 just to avoid any other bugs that were fixed,
aside from the one below.</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:CABbNdt6JiRbs8oX_MFoK6rG-ywoi5=_c_uX0eXEQQ-_OxgeNDg@mail.gmail.com">
<div dir="ltr"><br>
<div>However, when I was looking at the metadata file that was
produced (in /opt/shibboleth-idp/metadata), it seems to be
missing some information (e.g., EntityID is missing)</div>
</div>
</blockquote>
<p><br>
</p>
<p>The "missing" entityID is the only thing you specifically mention
and that's due to this bug:</p>
<p><a class="moz-txt-link-freetext" href="https://shibboleth.atlassian.net/browse/OSJ-409">https://shibboleth.atlassian.net/browse/OSJ-409</a></p>
<p>which was fixed in the recent 5.1.4 patch. It's actually there in
your example, just without the space between element name and
attribute:</p>
<blockquote type="cite"><md:EntityDescriptorentityID="<a
href="https://idp01.xxx.com/idp/shibboleth"
class="moz-txt-link-freetext">https://idp01.xxx.com/idp/shibboleth</a>"
...<br>
</blockquote>
<p>You can fix by simply adding a space: <md:EntityDescriptor
entityID=... <br>
</p>
<p><br>
</p>
<p>
<blockquote type="cite">and also the metadata file fails to parse
(i.e., xmllint --format fails), </blockquote>
</p>
<p><br>
</p>
<p>What were the specific error messages, etc?<br>
</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:CABbNdt6JiRbs8oX_MFoK6rG-ywoi5=_c_uX0eXEQQ-_OxgeNDg@mail.gmail.com">
<div dir="ltr">
<div>Should I have explicitly used a command line options, e.g.,
"-e <a href="https://idp01.xxx.com/idp/shibboleth"
moz-do-not-send="true" class="moz-txt-link-freetext">https://idp01.xxx.com/idp/shibboleth</a>",
etc., and the other options, such as "-h <a
href="http://idp01.xxx.com" moz-do-not-send="true">idp01.xxx.com</a>",
as shown on that web page?</div>
</div>
</blockquote>
<p><br>
</p>
<p>Not those 2 specific ones for the entityID issue, that was simply
a bug. (You'd use those if you wanted the domain name and/or
entityID to be something other than based on the hostname of the
machine you are installing on, such as when you install on a
multi-node cluster. Or just want to "virtualize" things to be not
based on the physical name).<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:CABbNdt6JiRbs8oX_MFoK6rG-ywoi5=_c_uX0eXEQQ-_OxgeNDg@mail.gmail.com">
<div dir="ltr">
<div><br>
</div>
<div>Also, I have a question about the order of the steps under
the section labelled "Typical Next Steps". If I get through
steps 1-3 and the Hello World app works, is that indicative
that the IdP should be functional? Or is there still
additional configuration that needs to be done?</div>
</div>
</blockquote>
<p><br>
</p>
<p>I think for basic functionality testing (no config mistakes,
etc), that's all you need.</p>
<p>Of course, for real-world use you have to install actual metadata
for actual SPs; configure authN the way you want actual users to
authenticate; configure attribute resolution for attributes
needed/requested by the actual SPs, including attribute release
policies; etc.</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:CABbNdt6JiRbs8oX_MFoK6rG-ywoi5=_c_uX0eXEQQ-_OxgeNDg@mail.gmail.com">
<div dir="ltr">
<div><br>
</div>
<div>FYI, here's the metadata:</div>
</div>
</blockquote>
<p><br>
</p>
<p>Aside from the entityID bug, I don't offhand see anything wrong
there. (But I could just be missing). Was there something else
specific that you were expecting to see that isn't there?</p>
<p>The generated metadata is just a starter template. It's not
necessarily expected that you give that out to SPs or federations
as-is. For some things you configure or enable in the IdP, you'd
have to adjust the generated metadata accordingly.</p>
<p>--Brent</p>
<p><br>
</p>
<br>
</body>
</html>