ShibAndEdugain - Laptörténet

Bajnokk(AT)niif.hu: /* Unable to connect */

2009-12-30T18:26:56Z

‎Unable to connect

Bajnokk(AT)niif.hu: autosave

2009-12-30T18:24:56Z

autosave

Bajnokk(AT)niif.hu: autosave

2009-12-30T17:54:03Z

autosave

Új lap

== Loading metadata ==
Metadata downloaded from https://mds.edugain.org

; Strange things
* Metadata is not signed by a third party
* Line breaks and indentation is quite by chance, however running through <code>xml_pp</code> of course invalidates the signature of the individual <code><EntityDescriptor></code>s
* Metadata cannot be validated to the schema (see later)

=== Problems loading metadata to Shibboleth SP ===
For perl processing, MDS output is run through <code>xml_pp</code>, an XML pretty-printer.
==== No default namespace ====
There is no default namespace for the outer <code>EntitiesDescriptor</code>, the root element. No problem with that, but there is at least one <code>EntityDescriptor</code>, which is not correctly namespaced (and assumes that the default namespace is <code>urn:oasis:names:tc:SAML:2.0:metadata</code>)

Solution:
| perl -pe 's/(<(md:)?EntitiesDescriptor)/\1 xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/;'

==== Invalid use of RoleDescriptor ====
SAML Metadata Schema declares that RoleDescriptor is an abstract element, whatever it means. Shibboleth (2.0) cannot load an entity with such an element.

Solution:
| perl -pe 's/.*RoleDescriptor.*//g;'
At the time of writing, it only affects Fresco-AAI. For some unknown reason, Fresco-AAI metadata is a one-liner (even after pretty printing), so it's possible to remove it such a way. If it wasn't the case, proper XSLT would be necessary.

==== Invalid extension of the schema ====
GIdP entity contains an <code>egmd:OnlineCADescriptor</code> element, which is not a standard extension of the SAML schema.

Solution:
| perl -pe 's/.*OnlineCA.*//g;'
At the time of writing, it only affects GIdP. For some unknown reason, GIdP metadata is a one-liner (even after pretty printing), so it's possible to remove it such a way. If it wasn't the case, proper XSLT would be necessary.

@@ 18. sor: / 18. sor: @@
 ==== Unable to connect ====
 For some reason, Shibboleth 2.0 cannot connect to https://mds.edugain.org. It seems to be a <code>libcurl</code> issue, which is not easy to circumvent. ([http://groups.google.com/group/shibboleth-users/browse_thread/thread/db6993fbaa3bd6ec# See this shib-users thread]) Newer cURL's can handle the SSL handshake (the ones in Ubuntu Intrepid and Debian Lenny can not). So it's necessary to <code>wget</code> the metadata.
 ==== No default namespace ====

@@ 9. sor: / 9. sor: @@
 === Problems loading metadata to Shibboleth SP ===
 For perl processing, MDS output is run through <code>xml_pp</code>, an XML pretty-printer.
 ==== No default namespace ====
 There is no default namespace for the outer <code>EntitiesDescriptor</code>, the root element. No problem with that, but there is at least one <code>EntityDescriptor</code>, which is not correctly namespaced (and assumes that the default namespace is <code>urn:oasis:names:tc:SAML:2.0:metadata</code>)