<div dir="ltr"><div>Hi Brent,</div><div><br></div><div>Ah, ok, thanks... I will get the 5.1.4 and try the build again. </div><div><br></div><div>Answering your question, no there wasn't anything else specifically... frankly, I didn't even think of a bug and thought I had somehow misread the documentation :(....</div><div><br></div><div>Re. authentication, etc., I've already asked here what they want, but will go with the default until I hear back from them.<br></div><div><br></div><div>Thanks again! <br></div><div><br></div><div>Jim</div></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style="border-top:1px solid #d3d4de"><tr><td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://s-install.avcdn.net/ipm/preview/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td><td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a></td></tr></table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Sat, Apr 5, 2025 at 10:48 PM Brent Putman via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p><br>
</p>
<div>On 4/5/25 8:41 PM, o haya via users
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>Hi,</div>
<div><br>
</div>
<div>I installed Shibboleth IdP,</div>
</div>
</blockquote>
<p>See below, but presumably you installed 5.1.3? You'll want to
update to 5.1.4 just to avoid any other bugs that were fixed,
aside from the one below.</p>
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr"><br>
<div>However, when I was looking at the metadata file that was
produced (in /opt/shibboleth-idp/metadata), it seems to be
missing some information (e.g., EntityID is missing)</div>
</div>
</blockquote>
<p><br>
</p>
<p>The "missing" entityID is the only thing you specifically mention
and that's due to this bug:</p>
<p><a href="https://shibboleth.atlassian.net/browse/OSJ-409" target="_blank">https://shibboleth.atlassian.net/browse/OSJ-409</a></p>
<p>which was fixed in the recent 5.1.4 patch. It's actually there in
your example, just without the space between element name and
attribute:</p>
<blockquote type="cite"><md:EntityDescriptorentityID="<a href="https://idp01.xxx.com/idp/shibboleth" target="_blank">https://idp01.xxx.com/idp/shibboleth</a>"
...<br>
</blockquote>
<p>You can fix by simply adding a space: <md:EntityDescriptor
entityID=... <br>
</p>
<p><br>
</p>
<p>
</p><blockquote type="cite">and also the metadata file fails to parse
(i.e., xmllint --format fails), </blockquote>
<p></p>
<p><br>
</p>
<p>What were the specific error messages, etc?<br>
</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div>Should I have explicitly used a command line options, e.g.,
"-e <a href="https://idp01.xxx.com/idp/shibboleth" target="_blank">https://idp01.xxx.com/idp/shibboleth</a>",
etc., and the other options, such as "-h <a href="http://idp01.xxx.com" target="_blank">idp01.xxx.com</a>",
as shown on that web page?</div>
</div>
</blockquote>
<p><br>
</p>
<p>Not those 2 specific ones for the entityID issue, that was simply
a bug. (You'd use those if you wanted the domain name and/or
entityID to be something other than based on the hostname of the
machine you are installing on, such as when you install on a
multi-node cluster. Or just want to "virtualize" things to be not
based on the physical name).<br>
</p>
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div><br>
</div>
<div>Also, I have a question about the order of the steps under
the section labelled "Typical Next Steps". If I get through
steps 1-3 and the Hello World app works, is that indicative
that the IdP should be functional? Or is there still
additional configuration that needs to be done?</div>
</div>
</blockquote>
<p><br>
</p>
<p>I think for basic functionality testing (no config mistakes,
etc), that's all you need.</p>
<p>Of course, for real-world use you have to install actual metadata
for actual SPs; configure authN the way you want actual users to
authenticate; configure attribute resolution for attributes
needed/requested by the actual SPs, including attribute release
policies; etc.</p>
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div><br>
</div>
<div>FYI, here's the metadata:</div>
</div>
</blockquote>
<p><br>
</p>
<p>Aside from the entityID bug, I don't offhand see anything wrong
there. (But I could just be missing). Was there something else
specific that you were expecting to see that isn't there?</p>
<p>The generated metadata is just a starter template. It's not
necessarily expected that you give that out to SPs or federations
as-is. For some things you configure or enable in the IdP, you'd
have to adjust the generated metadata accordingly.</p>
<p>--Brent</p>
<p><br>
</p>
<br>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>