<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
Hi all,</div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
We (Ball State University) are in the process of updating our identity provider. We are rolling in the changes so individual systems are being moved from using "shibboleth.bsu.edu" to using "federate.bsu.edu". It is lon-capa's turn.</div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
I found all the files that referenced "shibboleth.bsu.edu" and copied them to a different location:</div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
cp /etc/shibboleth/attribute-map.xml /root/sso/attribute-map.xml.old<br>
cp /etc/shibboleth/shibboleth2.xml /root/sso/shibboleth2.xml.old<br>
cp /etc/shibboleth/metadata/shibboleth.bsu.edu.xml /root/sso/shibboleth.bsu.edu.xml<br>
<br>
I then made copies of the two .old files as .new and edited them to replace "shibboleth.bsu.edu" with "federate.bsu.edu"<br>
I also got the new metadata (with wget https://federate.bsu.edu/FederationMetadata/2007-06/FederationMetadata.xml) and saved it as federate.bsu.edu.xml<br>
<br>
This morning I stopped shibd, copied the .new files to /etc/shibboleth/ and federate.bsu.edu.xml to /etc/shibboleth/metadata/<br>
<br>
I checked for "shibboleth.bsu.edu":<br>
[root@lon-capa01 ~]# grep -H -r -i 'shibboleth.bsu.edu' /etc<br>
[root@lon-capa01 ~]#<br>
which shows that I had eliminated all references to it.<br>
<br>
I restarted shibd and when I tried to log in, I got:</div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
---------------------------------<br>
Unknown or unusable identity provider<br>
The identity provider supplying your login credentials is not authorized for use with this service or does not support the necessary capabilities.<br>
To report this problem, please contact the site administrator at security@bsu.edu.<br>
Please include the following error message in any email:<br>
Identity provider lookup failed at (https:lonn-capa01.aws.bsu.edu/adm/sso)<br>
EntityID: http://shibboleth.bsu.edu/sso<br>
opensaml::saml2md::MetadataException: Unable to locate metadata for identity provider (http://shibboleth.bsu.edu/sso)<br>
---------------------------------</div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
For some reason it was still looking for the EntityID http://shibboleth.bsu.edu/sso<br>
I did a system reboot but got the same thing. </div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
I reverted to the old files and we are working, but that will only last a couple of weeks before our cert expires for our old identity provider site and it goes down.</div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
I am totally lost. is there somewhere else with shibboleth configuration data?</div>
<div><br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt;">
Thanks,<br>
Paul<br>
<br>
</div>
</body>
</html>