Excellent work!

[peppelinux]

Excellent work!

[ljudva]

Indeed, that is a possibility.
Yes, I've seen your repos. Would be great to have you on board for http://jam-py.com project. It is way more sophisticated than web2py appadmin from Massimo Di Pierro.
Grazie

[peppelinux]

The port :4443 would be the problem, see /etc/shibboleth/shibboleth.xml, the entity id used for the idp it's there. Does it have that port in it?

I put a troubleshooting with these elements, see:
https://github.com/peppelinux/Ansible-Shibboleth-IDP-SP-Debian#fatalprofileexception-sp

[ljudva]

Updated the above, not sure if you've seen it...
/etc/shibboleth/shibboleth2.xml: entityID="https://idp.testunical.it:4443/idp/shibboleth">

This works now though:

https://idp.testunical.it:4443/idp/profile/admin/resolvertest?requester=https://sp.testunical.it:4443/shibboleth&principal=gino

{
"requester": "https://sp.testunical.it:4443/shibboleth",
"principal": "gino",
"attributes": [


  {
    "name": "givenName",
    "values": [
        "gino"
    ]
  },
  

  {
    "name": "schacHomeOrganizationType",
    "values": [
        "urn:schac:homeOrganizationType:eu:higherEducationalInstitution"
    ]
  },
  

  {
    "name": "schacPersonalUniqueID",
    "values": [
        "urn:schac:personalUniqueID:it:CF:CODICEFISCALEgino"
    ]
  },
  

  {
    "name": "eduPersonAffiliation",
    "values": [
        "affiliate"
    ]
  },
  

  {
    "name": "eduPersonEntitlement",
    "values": [
        "urn:mace:dir:entitlement:common-lib-terms"
    ]
  },
  

  {
    "name": "email",
    "values": [
        "[email protected]"
    ]
  },
  

  {
    "name": "sn",
    "values": [
        "rossi"
    ]
  },
  

  {
    "name": "title",
    "values": [
        "ospite"
    ]
  },
  

  {
    "name": "schacPersonalUniqueCode",
    "values": [
        "urn:schac:personalUniqueCode:it:testunical.it:dipendente:15432",
        "urn:schac:personalUniqueCode:it:testunical.it:studente:126145"
    ]
  },
  

  {
    "name": "mail",
    "values": [
        "[email protected]"
    ]
  },
  

  {
    "name": "eduPersonScopedAffiliation",
    "values": [
        "[email protected]",
        "[email protected]"
    ]
  },
  

  {
    "name": "uid",
    "values": [
        "gino"
    ]
  },
  

  {
    "name": "eduPersonPrincipalName",
    "values": [
        "[email protected]"
    ]
  },
  

  {
    "name": "displayName",
    "values": [
        "rossi gino"
    ]
  },
  

  {
    "name": "schacHomeOrganization",
    "values": [
        "testunical.it"
    ]
  },
  

  {
    "name": "cn",
    "values": [
        "gino rossi"
    ]
  }
  

]
}

This is also working:

debian:/opt/shibboleth-idp/conf# /opt/shibboleth-idp/bin/aacli.sh -n gino -r https://sp.testunical.it:4443/shibboleth --saml2 -u http://localhost:8080/idp

I suspect it is SP:

This service requires information about you that your identity provider did not release. To gain access to this service, your identity provider must release the required information.
 You were trying to access the following URL:

    https://sp.testunical.it:4443/secure/index.php

hmmm....

[peppelinux]

Yes, It seems to be sp's attrchecker.
Is there some custom specification in sp configuration regarding the required attributes?

[ljudva]

Thanks for reply.

I did try to add into attribute-filter-local... as you did, but does not make any difference.

Would it help if I send you the VM image? Basically I replaced everything with xxx.it:4443, that's all. And obviously did set Port Forwarding on VirtualBox to host 4443 and guest 443.
Also touched /etc/hosts to reflect 127.0.0.1 for everything.

Cheers

[peppelinux]

I think that you should use samltracer and sniff the saml2 assertions, you should see those release to sp.

That's the place where we filter attributes to SPs:
https://github.com/peppelinux/Ansible-Shibboleth-IDP-SP-Debian/blob/master/roles/shib4idp_configure/templates/attribute-filter-local.xml#L10

please share your playbook.yml for acknoledgement.
Remember to restart shibboleth-idp (or single service) everytime you make modifications to its configuration files.
If you need a working image you just have to use the playbook without any changements

[ljudva]

Cool thanks. Did not change playbook tho. Just IP's

Clean VM will not work over VB port forwarding, thats the problem. I think you and me are the only one on the Planet with a knowledge to provide VB image for the developers :)
Django/Flask/Jam.py devs at my Uni need it for research.

[peppelinux]

could you use VB bridged interface?
This would avois DNAT and port forwariding. I still didn't understand the problem but hope to gve you the needed help
I am also a django/python programmer, you're welcome