Hi Julien Bastin, Thank you for reaching out gluu support , Please perform the following step and check if that works. 1) Go to https://sptest.iamshowcase.com/ 2) Navigate to instruction --> Idp inititated SSO. 3) download the meta data xml 4) Login to gluu server 5) Add trust relationship with downloaded metadata 6) configured nameid (if requried) 7) back to https://sptest.iamshowcase.com/ 8) place the content of https://yourgluuserver/idp/shibboleth. 9) on completion you will get the link to test SSO 10) Test the SSO flow. Thanks and Regards Mohit Mali

Hello, thank you. I've tried this and it's working, but in the ADFS I can't add a trust relationship with the url (https://gluu.xxx.xxx/idp/shibboleth). My error is : "Unable to create secure SSL / TLS channel", something like that.

Hi Julien Bastin, If you are unable to put as url , then download the xml content to file and upload it , Hope that works. Thanks and Regards Mohit Mali

Hello, No it's not working, I've got the same error.

Hi Julien, I will setup ADFS server and let you know my finding. Thanks and Regards Mohit Mali

Ok thank you !

Hello, The metadata file from ADFS is load but I've got these errors : On GUI Trust Relationship : https://ibb.co/bX5yFJZ On Gluu server /opt/shibboleth-idp/logs/idp-process.log ``` 2020-02-13 08:09:51,175 - - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:258] - Service 'shibboleth.MetadataResolverService': Reloading service configuration 2020-02-13 08:09:51,179 - - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [/opt/shibboleth-idp/conf/metadata-providers.xml] 2020-02-13 08:09:51,200 - - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [/opt/shibboleth-idp/system/conf/metadata-providers-system.xml] 2020-02-13 08:09:51,205 - - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:583] - Refreshing shibboleth.MetadataResolverService: startup date [Thu Feb 13 08:09:51 UTC 2020]; parent: Root WebApplicationContext 2020-02-13 08:09:51,240 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:574] - Metadata Resolver FilesystemMetadataResolver SiteSP1: New metadata successfully loaded for '/opt/shibboleth-idp/metadata/123777db-85c0-4cc7-b288-2f60cc60ade9-sp-metadata.xml' 2020-02-13 08:09:51,240 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:384] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Next refresh cycle for metadata provider '/opt/shibboleth-idp/metadata/123777db-85c0-4cc7-b288-2f60cc60ade9-sp-metadata.xml' will occur on '2020-02-13T11:09:51.233Z' ('2020-02-13T11:09:51.233Z' local time) 2020-02-13 08:09:51,249 - - INFO [net.shibboleth.idp.saml.metadata.RelyingPartyMetadataProvider:161] - Top level Metadata Provider 'ShibbolethMetadata' did not have a sort key; giving it value '9' 2020-02-13 08:09:51,249 - - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:421] - Service 'shibboleth.MetadataResolverService': Completed reload and swapped in latest configuration for service 'shibboleth.MetadataResolverService' 2020-02-13 08:09:51,249 - - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:984] - Closing shibboleth.MetadataResolverService: startup date [Thu Feb 13 08:08:51 UTC 2020]; parent: Root WebApplicationContext 2020-02-13 08:09:51,251 - - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:428] - Service 'shibboleth.MetadataResolverService': Reload complete 2020-02-13 08:11:51,231 - - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:364] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Error occurred while attempting to refresh metadata from '/opt/shibboleth-idp/metadata/$trustRelationship.spMetaDataFN' 2020-02-13 08:11:51,232 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:384] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Next refresh cycle for metadata provider '/opt/shibboleth-idp/metadata/$trustRelationship.spMetaDataFN' will occur on '2020-02-13T08:16:51.231Z' ('2020-02-13T08:16:51.231Z' local time) 2020-02-13 08:12:51,238 - - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:364] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Error occurred while attempting to refresh metadata from '/opt/shibboleth-idp/metadata/$trustRelationship.spMetaDataFN' 2020-02-13 08:12:51,239 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:384] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Next refresh cycle for metadata provider '/opt/shibboleth-idp/metadata/$trustRelationship.spMetaDataFN' will occur on '2020-02-13T08:17:51.238Z' ('2020-02-13T08:17:51.238Z' local time) ``` On Gluu server /opt/shibboleth-idp/logs/idp-warn.log ``` 2020-02-13 08:07:51,237 - - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:364] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Error occurred while attempting to refresh metadata from '/opt/shibboleth-idp/metadata/$trustRelationship.spMetaDataFN' 2020-02-13 08:11:51,231 - - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:364] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Error occurred while attempting to refresh metadata from '/opt/shibboleth-idp/metadata/$trustRelationship.spMetaDataFN' 2020-02-13 08:12:51,238 - - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:364] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Error occurred while attempting to refresh metadata from '/opt/shibboleth-idp/metadata/$trustRelationship.spMetaDataFN' 2020-02-13 08:16:51,231 - - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:364] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Error occurred while attempting to refresh metadata from '/opt/shibboleth-idp/metadata/$trustRelationship.spMetaDataFN' ``` Thank you.

Hello, I managed to fix the problem, by default Windows Server ADFS 2019 uses TLS 1.0 and therefore it is necessary to activate TLS 1.2 on the ADFS (https://support.zoom.us/hc/en-us/articles/360033739531-How-to-enable-TLS-1-2-on-an-ADFS-Server-Windows-Server-2012-R2-), I saw it using Wireshark. But now I have another problem. https://ibb.co/bFvppb5

And in /opt/shibboleth-idp/logs/, still the same errors : ``` 2020-02-13 14:53:53,362 - - INFO [net.shibboleth.utilities.java.support.service.AbstractReloadableService:258] - Service 'shibboleth.MetadataResolverService': Reloading service configuration 2020-02-13 14:53:53,367 - - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [/opt/shibboleth-idp/conf/metadata-providers.xml] 2020-02-13 14:53:53,385 - - INFO [net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] - Loading XML bean definitions from file [/opt/shibboleth-idp/system/conf/metadata-providers-system.xml] 2020-02-13 14:53:53,390 - - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:583] - Refreshing shibboleth.MetadataResolverService: startup date [Thu Feb 13 14:53:53 UTC 2020]; parent: Root WebApplicationContext 2020-02-13 14:53:53,423 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:574] - Metadata Resolver FilesystemMetadataResolver SiteSP1: New metadata successfully loaded for '/opt/shibboleth-idp/metadata/123777db-85c0-4cc7-b288-2f60cc60ade9-sp-metadata.xml' 2020-02-13 14:53:53,423 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:384] - Metadata Resolver FilesystemMetadataResolver SiteSP1: Next refresh cycle for metadata provider '/opt/shibboleth-idp/metadata/123777db-85c0-4cc7-b288-2f60cc60ade9-sp-metadata.xml' will occur on '2020-02-13T17:53:53.417Z' ('2020-02-13T17:53:53.417Z' local time) 2020-02-13 14:53:53,445 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:574] - Metadata Resolver FileBackedHTTPMetadataResolver SiteSP2: New metadata successfully loaded for 'https://adfs.xxx.int/FederationMetadata/2007-06/FederationMetadata.xml' 2020-02-13 14:53:53,445 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:384] - Metadata Resolver FileBackedHTTPMetadataResolver SiteSP2: Next refresh cycle for metadata provider 'https://adfs.xxx.int/FederationMetadata/2007-06/FederationMetadata.xml' will occur on '2020-02-13T14:53:58.445Z' ('2020-02-13T14:53:58.445Z' local time) 2020-02-13 14:53:53,446 - - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:364] - Metadata Resolver FilesystemMetadataResolver SiteSP3: Error occurred while attempting to refresh metadata from '/opt/shibboleth-idp/metadata/20be926e-c903-48b5-b6cd-e583ed8eb66d-sp-metadata.xml' 2020-02-13 14:53:53,447 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:384] - Metadata Resolver FilesystemMetadataResolver SiteSP3: Next refresh cycle for metadata provider '/opt/shibboleth-idp/metadata/20be926e-c903-48b5-b6cd-e583ed8eb66d-sp-metadata.xml' will occur on '2020-02-13T14:58:53.446Z' ('2020-02-13T14:58:53.446Z' local time) 2020-02-13 14:53:53,447 - - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:290] - Metadata Resolver FilesystemMetadataResolver SiteSP3: Metadata provider failed to properly initialize, fail-fast=true, halting 2020-02-13 14:53:53,448 - - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:984] - Closing shibboleth.MetadataResolverService: startup date [Thu Feb 13 14:53:53 UTC 2020]; parent: Root WebApplicationContext 2020-02-13 14:53:53,448 - - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:231] - Service 'shibboleth.MetadataResolverService': Reload for shibboleth.MetadataResolverService failed net.shibboleth.utilities.java.support.service.ServiceException: Failed to load [file [/opt/shibboleth-idp/conf/metadata-providers.xml], file [/opt/shibboleth-idp/system/conf/metadata-providers-system.xml]] at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:387) Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ShibbolethMetadata': Cannot create inner bean '(inner bean)#33a3472b' of type [org.opensaml.saml.metadata.resolver.ChainingMetadataResolver] while setting bean property 'embeddedResolver'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#33a3472b': Cannot create inner bean '(inner bean)#db42696' of type [org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver] while setting bean property 'resolvers' with key [2]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#db42696': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313) Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#33a3472b': Cannot create inner bean '(inner bean)#db42696' of type [org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver] while setting bean property 'resolvers' with key [2]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#db42696': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313) Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#db42696': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1631) Caused by: net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.initMetadataResolver(AbstractReloadingMetadataResolver.java:315) Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: net.shibboleth.utilities.java.support.resolver.ResolverException: Metadata file '/opt/shibboleth-idp/metadata/20be926e-c903-48b5-b6cd-e583ed8eb66d-sp-metadata.xml' does not exist at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.refresh(AbstractReloadingMetadataResolver.java:365) Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: Metadata file '/opt/shibboleth-idp/metadata/20be926e-c903-48b5-b6cd-e583ed8eb66d-sp-metadata.xml' does not exist at org.opensaml.saml.metadata.resolver.impl.FilesystemMetadataResolver.validateMetadataFile(FilesystemMetadataResolver.java:142) ```

So I don't have "RoleDescriptor" in my metadata in /idp/shibboleth

Hi, Julien. Please note we don't usually help with configuring third-party software under Community support offer. Your task can be bolied down to pairing ADFS (as SP, I believe) to Shibboleth IDP (as IDP; Shib IDP is shipped as part of Gluu Server and can be configured from its web UI, but is mostly in its original state (we don't modify its code), so its official documentation still applies). You should be able to find a lot of information online on how to do this. That's up to you to study it and find the proper set of twiks - especially when it comes to ADFS. I can only recommend to not use direct urls when providing metadata in ADFS and Gluu if any of these use self-signed (or signed with non-trusted root CA cert) certificates for HTTPS at these endpoints; if certificate isn't trusted by any of the two sides, it may not be able to fetch metadata. It's solved by adding the certs to some list of trusted certs (I believe it was mentioned alrady how to do this in Gluu, you need to import it into the correct `cacerts` file; you'll need to find a proper procedure for ADFS yourself). You can upload metadata as file in Gluu's web UI; if ADFS allows it as well, please resort to this method, for now at least. I'm not sure about the part of a missing element in Shib IDP's metadata, but if it's true and you need to add it there, you can find some hints over the internet for sure (I still suspect you may not be using the correct procedure, please double-check ADFS documentation).

Ok thank you. I will check that.