Hello Andrew I have the same issue EntityRoleCriterion i'm using miniorange SAML SSO for Moodle
Le mardi 7 mai 2024 à 22:53:14 UTC, Andrew Tillinghast a écrit : > Tried the suggested change, now the error is: > > *ERROR > [org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade] > > - <Unable to locate a valid SAML metadata resolver for > https://mdq.incommon.org/entities/{0} > <https://mdq.incommon.org/entities/%7B0%7D> to locate [EntityIdCriterion > [id=https://conncoll.reclaimhosting.com > <https://conncoll.reclaimhosting.com>]* > > But the upside it fails faster. > > On Fri, Feb 23, 2024 at 4:03 PM atilling <[email protected]> wrote: > >> This is an attempt to use "serviceId": ".+" as per the blog post. because >> it needs to be able to match any service it would need to load the whole >> metadata I would think. I can try to add the {0} but I was going off the >> example in https://fawnoos.com/2019/01/18/cas61-saml2-idp-incommon/ >> On Friday, February 23, 2024 at 11:22:42 AM UTC-5 David Gelhar wrote: >> >>> Rather than fetching the entire (huge) InCommon metadata aggregate for >>> each service, it might work better to use the metadata query >>> <https://apereo.github.io/cas/6.6.x/installation/Configuring-SAML2-DynamicMetadata-MDQ.html> >>> capability >>> in your service definitions to do a dynamic query for just the specific >>> service. >>> >>> For incommon, you would put this in your service definition: >>> >>> "metadataLocation" : "https://mdq.incommon.org/entities/{0}";, >>> >>> >>> >>> On Monday, February 19, 2024 at 11:34:11 AM UTC-5 atilling wrote: >>> >>>> Clarification attempting to follow >>>> https://fawnoos.com/2019/01/18/cas61-saml2-idp-incommon/+ >>>> >>>> Now have 3 SPs working using the incommon metadata all with the same >>>> metadataLocation, those 3 are working fine (Equivalent to the Almond and >>>> Coco in the example) but when attempting to add the "All Others" section >>>> getting an error that the metadata can't be parsed. Is there an issue with >>>> memory or something similar? >>>> On Friday, February 2, 2024 at 1:42:16 PM UTC-5 atilling wrote: >>>> >>>>> Trying to add a service provider from incommon, have one service >>>>> provider working getting an error when trying to access a second one: >>>>> >>>>> 2024-02-02 11:49:20,456 INFO >>>>> [org.apereo.cas.support.saml.services.idp.metadata.cache.resolver.UrlResourceMetadataResolver] >>>>> >>>>> - <Metadata file designated for service [PeopleAdmin] already exists at >>>>> path >>>>> [/etc/cas/saml/idp/metadata-backups/382b60a9f8c9677793e7711043ee8d9805fe2572.xml].> >>>>> >>>>> 2024-02-02 11:49:23,410 INFO >>>>> [org.apereo.cas.support.saml.services.idp.metadata.cache.resolver.BaseSamlRegisteredServiceMetadataResolver] >>>>> >>>>> - <Metadata signature location is undefined for [ >>>>> https://md.incommon.org/InCommon/InCommon-metadata.xml]; metadata >>>>> signature validation will not be invoked> >>>>> >>>>> 2024-02-02 11:49:42,961 INFO >>>>> [org.apereo.cas.support.saml.services.idp.metadata.cache.resolver.BaseSamlRegisteredServiceMetadataResolver] >>>>> >>>>> - <Initialized metadata resolver from [ >>>>> https://md.incommon.org/InCommon/InCommon-metadata.xml]> >>>>> >>>>> 2024-02-02 11:49:43,080 WARN >>>>> [org.apereo.cas.support.saml.services.idp.metadata.cache.SamlRegisteredServiceDefaultCachingMetadataResolver] >>>>> >>>>> - <SAML metadata resolver >>>>> [org.opensaml.saml.metadata.resolver.ChainingMetadataResolver] obtained >>>>> from the cache is unable to produce/resolve valid metadata from [ >>>>> https://md.incommon.org/InCommon/InCommon-metadata.xml]. Metadata >>>>> resolver cache entry with key >>>>> [ec3dbe763cb47bb5fb789f5daa2842e8fb8c7a8d76ae088017c5c20b2cdfe23d0406b562f2b6af931fbe2e4dce97fd1f7e2edf784be65dcc4c652eab1b37d147] >>>>> >>>>> has been invalidated. Retry attempt: [2]> >>>>> >>>>> *2024-02-02 11:49:43,080 ERROR >>>>> [org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade] >>>>> >>>>> - <Unable to locate a valid SAML metadata resolver for >>>>> https://md.incommon.org/InCommon/InCommon-metadata.xml >>>>> <https://md.incommon.org/InCommon/InCommon-metadata.xml> to locate >>>>> [EntityRoleCriterion >>>>> [role={urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor], >>>>> EntityIdCriterion [id=https://pa4078.peopleadmin.com/shibboleth >>>>> <https://pa4078.peopleadmin.com/shibboleth>]]* >>>>> >>>>> * >>>>> SamlRegisteredServiceDefaultCachingMetadataResolver.java:lambda$resolve$1:94* >>>>> >>>>> * RetryTemplate.java:doExecute:329* >>>>> >>>>> * RetryTemplate.java:execute:209* >>>>> >>>>> *>* >>>>> >>>>> 2024-02-02 11:49:43,080 WARN >>>>> [org.apereo.cas.support.saml.web.idp.profile.AbstractSamlIdPProfileHandlerController] >>>>> >>>>> - <No metadata could be found for [ >>>>> https://pa4078.peopleadmin.com/shibboleth]> >>>>> >>>>> 2024-02-02 11:49:43,080 WARN >>>>> [org.apereo.cas.util.function.FunctionUtils] - <Cannot find metadata >>>>> linked >>>>> to https://pa4078.peopleadmin.com/shibboleth >>>>> >>>>> >>>>> AbstractSamlIdPProfileHandlerController.java:verifySamlAuthenticationRequest:493 >>>>> >>>>> >>>>> AbstractSamlIdPProfileHandlerController.java:initiateAuthenticationRequest:311 >>>>> >>>>> >>>>> AbstractSamlIdPProfileHandlerController.java:lambda$handleSsoPostProfileRequest$4:648 >>>>> >>>>> > >>>>> >>>>> *2024-02-02 11:49:43,081 ERROR [org.apereo.cas.web.support.WebUtils] - >>>>> <Cannot find metadata linked to https://pa4078.peopleadmin.com/shibboleth >>>>> <https://pa4078.peopleadmin.com/shibboleth>* >>>>> >>>>> * >>>>> AbstractSamlIdPProfileHandlerController.java:verifySamlAuthenticationRequest:493* >>>>> >>>>> * >>>>> AbstractSamlIdPProfileHandlerController.java:initiateAuthenticationRequest:311* >>>>> >>>>> * >>>>> AbstractSamlIdPProfileHandlerController.java:lambda$handleSsoPostProfileRequest$4:648* >>>>> >>>>> *>* >>>>> >>>>> >>>>> Also have the entry in cas.properties for: >>>>> >>>>> cas.saml-sp.in-common.metadata= >>>>> https://md.incommon.org/InCommon/InCommon-metadata.xml >>>>> >>>>> service json looks like this >>>>> >>>>> { >>>>> @class: org.apereo.cas.support.saml.services.SamlRegisteredService >>>>> serviceId: https://pa4078.peopleadmin.com/shibboleth >>>>> name: PeopleAdmin >>>>> id: 1706734145472 >>>>> description: InCommon SAML SP Integration for PeopleAdmin >>>>> evaluationOrder: 2147483642 <(214)%20748-3642> >>>>> usernameAttributeProvider: >>>>> { >>>>> @class: >>>>> org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider >>>>> usernameAttribute: eduPersonPrincipalName >>>>> } >>>>> attributeReleasePolicy: >>>>> { >>>>> @class: org.apereo.cas.services.ChainingAttributeReleasePolicy >>>>> policies: >>>>> [ >>>>> java.util.ArrayList >>>>> [ >>>>> { >>>>> @class: >>>>> org.apereo.cas.services.ReturnMappedAttributeReleasePolicy >>>>> allowedAttributes: >>>>> { >>>>> @class: java.util.TreeMap >>>>> displayName: >>>>> [ >>>>> java.util.ArrayList >>>>> [ >>>>> urn:oid:2.16.840.1.113730.3.1.241 >>>>> ] >>>>> ] >>>>> eduPersonPrimaryAffiliation: >>>>> [ >>>>> java.util.ArrayList >>>>> [ >>>>> urn:oid:1.3.6.1.4.1.5923.1.1.1.5 >>>>> ] >>>>> ] >>>>> eduPersonPrincipalName: >>>>> [ >>>>> java.util.ArrayList >>>>> [ >>>>> urn:oid:1.3.6.1.4.1.5923.1.1.1.6 >>>>> emailaddress >>>>> ] >>>>> ] >>>>> givenName: >>>>> [ >>>>> java.util.ArrayList >>>>> [ >>>>> givenname >>>>> ] >>>>> ] >>>>> sn: >>>>> [ >>>>> java.util.ArrayList >>>>> [ >>>>> surname >>>>> ] >>>>> ] >>>>> } >>>>> } >>>>> ] >>>>> ] >>>>> mergingPolicy: REPLACE >>>>> principalAttributesRepository: >>>>> { >>>>> @class: >>>>> org.apereo.cas.authentication.principal.ChainingPrincipalAttributesRepository >>>>> } >>>>> consentPolicy: >>>>> { >>>>> @class: >>>>> org.apereo.cas.services.consent.ChainingRegisteredServiceConsentPolicy >>>>> } >>>>> authorizedToReleaseAuthenticationAttributes: true >>>>> } >>>>> metadataLocation: >>>>> https://md.incommon.org/InCommon/InCommon-metadata.xml >>>>> metadataCriteriaDirection: INCLUDE >>>>> metadataCriteriaPattern: https://authproxy.conity.com/saml2 >>>>> signingCredentialType: BASIC >>>>> } >>>>> >>>>> >>>>> cas.saml-sp.in-common.metadata= >>>>> >>>> > > -- > > Andrew Tillinghast > Sr. Tech Lead Identity and Access Management > [email protected] > 270 Mohegan Avenue > New London, CT 06320-4196 > Ph:860 439-5265 Fax: 860 439-2871 > P > *Think before you print*CONFIDENTIALITY: This email (including any > attachments) may contain confidential, proprietary and privileged > information, and unauthorized disclosure or use is prohibited. If you > received this email in error, please notify the sender and delete this > email from your system. > > -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/c84d0e50-ec83-4cb7-8c3e-d5b36230a4e0n%40apereo.org.
