Thanks all, delete all file works fine for me On Thursday, 13 July 2017 15:07:27 UTC+8, Bergner, Arnold wrote: > > Hi, > > > > as far as I can see, the metadata generation is only there to help you get > started. Once it’s there it should never need to be auto-generated again. I > just edit the files by hand. In the end, this document does not influence > CAS’s behaviour but informs your SPs about endpoints, capabilities etc. The > behaviour, e.g. issuer in SAML responses, is controlled by the properties > files, so there has to be a matching between properties and metadata for > your SPs to trust it. > > > > Also make sure your certificates contain the right hostname and so on. > > > > Cheers Arnold > > > > *Von:* [email protected] <javascript:> [mailto:[email protected] > <javascript:>] *Im Auftrag von *Ng Sek Long > *Gesendet:* Donnerstag, 13. Juli 2017 04:49 > *An:* CAS Community <[email protected] <javascript:>> > *Betreff:* [cas-user] SAML 2 unable to change idpEndPoint > > > > Hi all, first time posting, hopefully I am not asking a stupid question. > > *Scope*: > I am using CAS 5.1.1 with SAML 2 protocol, my server act as an idp. > > *Problem*: > When I tried to generate an *idp-metadata.xml* by modifying some CAS > properties, no matter how I change it I* can't* > > *modified out the cas.example.org <http://cas.example.org> *I found my > research that *cas.example.org <http://cas.example.org> links to an > variable called ${idpEndPoint}*, and it seems to link to *cas.host.name > <http://cas.host.name>*, but changing *cas.host.name > <http://cas.host.name>* and other host info doesn't seems to modified > ${idpEndPoint}, am I doing something wrong? > > I also tried removing idp-metadata.xml completely and try generate a new > one, didn't works too. > > Any helps would be appreciated :D > > *Code*: > *idp-metadata.xml* > > <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds=" > http://www.w3.org/2000/09/xmldsig#"; > xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" > xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" entityID=" > https://my.network.com/idp";> > > <IDPSSODescriptor > protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol > urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0"> > > <Extensions> > > <shibmd:Scope regexp="false">my.network.com</shibmd:Scope> > > </Extensions> > > <KeyDescriptor use="signing"> > > <ds:KeyInfo> > > <ds:X509Data> > > <ds:X509Certificate> > > ABCDE..... > > </ds:X509Certificate> > > </ds:X509Data> > > </ds:KeyInfo> > > </KeyDescriptor> > > <KeyDescriptor use="encryption"> > > <ds:KeyInfo> > > <ds:X509Data> > > <ds:X509Certificate> > > ABCDE..... > > </ds:X509Certificate> > > </ds:X509Data> > > </ds:KeyInfo> > > </KeyDescriptor> > > <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat> > > <NameIDFormat> > > urn:oasis:names:tc:SAML:2.0:nameid-format:transient > > </NameIDFormat> > > <SingleLogoutService > Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=" > https://cas.example.org:8443/cas/idp/profile/SAML2/POST/SLO"/> > > <SingleSignOnService > Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=" > https://cas.example.org:8443/cas/idp/profile/SAML2/POST/SSO"/> > > <SingleSignOnService > Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location=" > https://cas.example.org:8443/cas/idp/profile/SAML2/Redirect/SSO"/> > > <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" > Location="https://cas.example.org:8443/cas/idp/profile/SAML2/SOAP/ECP"/> > > </IDPSSODescriptor> > > </EntityDescriptor> > > > > > > *Relavent part in application.properties:* > > ## > > # CAS Server Context Configuration > > # > > server.context-path=/ > > server.port=8443 > > > > cas.host.name=my.network.com > > cas.server.name=https://my.network.com:8443 > > cas.server.prefix=https://my.network.com:8443/cas > > > > > > ## > > # CAS SAML2.0 IDP > > # > > cas.authn.samlIdp.entityId=https://my.network.com/idp > > cas.authn.samlIdp.scope=my.network.com > > > > cas.authn.samlIdp.metadata.cacheExpirationMinutes=30 > > cas.authn.samlIdp.metadata.failFast=false > > cas.authn.samlIdp.metadata.location=file:/etc/cas/saml/id > > > > cas.authn.samlIdp.metadata.privateKeyAlgName=RSA > > cas.authn.samlIdp.metadata.requireValidMetadata=true > > > > cas.authn.samlIdp.logout.forceSignedLogoutRequests=true > > cas.authn.samlIdp.logout.singleLogoutCallbacksDisabled=false > > > > cas.authn.samlIdp.response.skewAllowance=0 > > cas.authn.samlIdp.response.signError=false > > cas.authn.samlIdp.response.useAttributeFriendlyName=true > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: > https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] <javascript:>. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/fb196595-aaae-437a-bbef-b84c619f1791%40apereo.org > > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/fb196595-aaae-437a-bbef-b84c619f1791%40apereo.org?utm_medium=email&utm_source=footer> > . >
-- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/d0282cd0-17cc-4c4d-bb81-03b6b44865f2%40apereo.org.
