Page History
Testing authentication
New for IDP 4.1: In order to test/verify your IDP's authentication configuration it's easiest to use the Hello world feature (new for IDP 4.1):
- Add the login name of the account you want to test authentication with to the
AccessByAdminUserentry inconf/access-control.xml(and uncomment that section, of course) - Reload the access control config,
/opt/shibboleth-idp/bin/reload-service.sh -id shibboleth.ReloadableAccessControlService - Access
/idp/profile/admin/helloon your IDP server.
Older systems (or those who disabled the Hello world module for whatever reason) will have to complete a few more steps in order to test authentication:
Provided you already have completed your metadata configuration by follwing our instructions you can test your authentication configuration with a web browser using IDP-initiated SSO URLs. While the details for this (as always) are fully documented in the Shibboleth Wiki it should suffice to know that the URL needs to look like this:
...
| Note | ||||
|---|---|---|---|---|
| ||||
Until your IDP is known to Service Providers via Metadata (commonly by having your IDP's metadata registered within eduID.at) you'll end up at the SP – in the above example that's the entityID of the eduID.at SAML Demo SP – with an error message of some kind, letting you know that it doesn't know your IDP. That's fully expected before your IDP has joined eduID.at and does not limit your ability to test/verify your IDP's authentication configuration. |
Testing the attribute resolver and filter
...
Provided you already have completed our metadata configuration instructions you can test both your attribute resolver and attribute release from the command line , without the need for a "Test SP" that shows you what it recieved successfully. This greatly accelerates configuration verification of your IDP so do make use of this (before/after tests) when changing your resolver or filter or filter configuration. (You could also use this on a test maschine to verify the changed configuration works as expected before transferring the tested config to the production server.)
The official documentation of course has all the details, but commonly all you need is to run the following command on our IDP server:
...
Where "SOME_USERID" above needs to be replaced with the userid/login name people would enter as part of authenticating to your IDP. Then the attributes, their values as well as any NameIDs that would be sent to the SP identified by its entityID – in the above example that would be the eduID.at AML SAML Demo SP – will be shown, in XML the way it would be sent in a SAML Assertion (after encrypting and encoding the data to the SP named as recipient, of course).
Note that no data is sent to the specified SP using that method, this : This command simply provides an answer to the question "What attributes (and NameIDs) – if any – would the IDP send for account X to service Y using the current configuration?"
...
| Info | ||
|---|---|---|
| ||
The ACOnet Team can also add your IDP's metadata to the Demo SP locally, in order to faciltate end-to-end testing before your IDP has been registered in eduID.at. In that case you'll need to send a copy of your IDP's metadata (a basic version thereof has been created by the Shibboleth IDP's installer in The URL you'll be recieving from the ACOnet Team will look like this: https://sp.eduid.at/Shibboleth.sso/Login?entityID=YOUR-IDP-ENTITY-IDWhere "YOUR-IDP-ENTITY-ID" above needs to be replaced with the entityID of your IDP. |
...
Overview
Content Tools
Tasks