Frequently Asked Questions

Common problems and their solutions when installing Shibboleth for use within the MAMS Testbed Federation

• How do I make sure that I get the latest up-to-date metadata from the TestbedFederation?
• What do I need to do to join Level 2 or Level 3 of the Testbed Federation?
• Why can't I get my certificate request signed by the CA for Level-1 of the Testbed Federation?
• How do I configure my IdP or SP to use a certificate that was signed by an intermediate commercial Certificate Authority (CA), assuming the root CA is in the federation metadata?
• What is the relationship between organization EntityID and my IdP/SP providerID value?
• I've upgraded to level-2 but now my SP doesn't work anymore
• Cant compile xmlsec, complaining about XSECConfig file
• Failed compiling Shib SP with all required libraries, complains about a lot of warnings of existence of virtual function without its virtual destructor

Shibboleth IdP

• Why do we need to have port 443 and 8443 open for the IdP?
• How do I indicate to the Shibboleth SP the strength of authentication?
• How to verify IdP configuration file? (resolvertest)
• Why does my IdP die right after I restart tomcat?
• Tomcat fails to run when I use tomcat authentication connecting to LDAP
• https://MY_DNS/shibboleth-idp/SSO returns page not found 404 error
• Why do I get the error "java.security.SignatureException: RSA modulus too small" when I start up my IdP?
• Session Creation Error: Invalid credential
• Why do I get an error when using the resolver against an LDAP? The error message is: "An error occurred while retrieving data for principal (xyz) :[LDAP: error code 32]", where xyz is the user who logged in successfully.
• How to generate eduPersonTargetedID?
• Can't load configuration filename
• Can't authenticate at IdP
• Invalid Assertion Consumer Service URL
• How to use IP-based authentication
• Encountered an error during validation: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
• General error processing request

ShARPE

• Why my IdP throws exceptions and not running after deploying Sharpe?
• How to revert back to original IdP configuration
• No list of attributes or list of groups
• Where is location of ShARPE logs?
• Could not start SharpeCore: java.lang.ClassCastException

Shibboleth SP

• What is "lazy session" authentication? Why is it needed?
• Why doesn't the SP shibd daemon start?
• How to protect certain resources in SP by requiring user to supply certain attributes?
• Protecting folder in apache
• My tomcat application doesn't get REMOTE_USER
• How do I get REMOTE_USER in tomcat?
• The application doesn't get any headers at all
• How to introduce new attribute to application?
• Errors when using multiple certs
• Valid SP certificate but still rejected on IdP
• No valid authentication statement
• Socket in use or can't connect to listener
• I try to access the SP and it loops for ever between the SP and IdP
• Session Creation Error
• Browser/Artifact handler does not support HTTP method (POST)
• Error 500 Internal Server Error, cant serialize header values
• Shib SP daemon refuses to run
• How to find the certificate purpose? Can I use my certificate for back channel?
• Request Entity Too Large Error - related to exportSession setting
• IdP or SP spits error saying "Unauthenticated requesters"
• SAML Artifacts cannot be dereferenced for unauthenticated requesters

General Problems with Shibboleth

• Why do I get an error which says that my assertion has expired?
• I've got assertion condition invalid error, what does that mean?
• Clock skewed, what should i do?
• Common SSL Errors

Further help

• join our mailing list and post questions there
• or email to support AT federation DOT org DOT au