title: Single Sign On(SSO) using SAML with Spring Security
body: <p>I done my 2 projects(i.e web portals) using spring mvc + hibernate with JAVA. MySQL as db and Apache as server.
  Now my requirement is to get SSO(Single Sign On) for these two Portals. i previously posted about this but only one person responded.
  Again i google and got SAML extension. And i got some sample <a href="https://github.com/spring-projects/spring-security-saml" rel="nofollow">https://github.com/spring-projects/spring-security-saml</a> .
  And followed this <a href="https://docs.secureauth.com/display/docs/Spring+Security+Instructions" rel="nofollow">https://docs.secureauth.com/display/docs/Spring+Security+Instructions</a> to get SSO for my portals.</p>
  
  <p>I just integrated only one portal with the  procedure given in above link.
  <strong>In the above link of process i didn't understood secureAuth20.xml and Post auth.</strong></p>
  
  <p>But i stuck getting the error on web page when i run on server.
  ERROR:</p>
  
  <p>Error</p>
  
  <p>An error occurred.
  Message:
  Metadata for entity localhost and role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor wasn't found 
  StackTrace:</p>
  
  <p>org.opensaml.saml2.metadata.provider.MetadataProviderException: Metadata for entity <a href="http://localhost:6060/AxisCustomer/" rel="nofollow">http://localhost:6060/AxisCustomer/</a> and role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor wasn't found</p>
  
  <p>in Consloe of my STS :</p>
  
  <ul>
  <li>Refreshing Root WebApplicationContext: startup date [Wed Feb 11 14:10:34 IST 2015]; root of context hierarchy</li>
  <li>Loading XML bean definitions from ServletContext resource [/WEB-INF/securityContext.xml]</li>
  </ul>
  
  <p><strong>securityContext.xml</strong></p>
  
  <pre><code> &lt;?xml version="1.0" encoding="UTF-8" ?&gt;
   &lt;beans xmlns="http://www.springframework.org/schema/beans"
     xmlns:security="http://www.springframework.org/schema/security"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns:context="http://www.springframework.org/schema/context"
     xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
            http://www.springframework.org/schema/security 
  http://www.springframework.org/schema/security/spring-security-3.1.xsd   
      http://www.springframework.org/schema/context 
   http://www.springframework.org/schema/context/spring-context-3.1.xsd"&gt;
  
    &lt;!-- Enable auto-wiring --&gt;
    &lt;context:annotation-config/&gt;
  
    &lt;!-- Scan for auto-wiring classes in spring saml packages --&gt;
       &lt;context:component-scan 
      base-package="org.springframework.security.saml"/&gt;
  
   &lt;!-- Unsecured pages --&gt;
   &lt;security:http security="none" pattern="/favicon.ico"/&gt;
   &lt;security:http security="none" pattern="/images/**"/&gt;
   &lt;security:http security="none" pattern="/css/**"/&gt;
   &lt;security:http security="none" pattern="/logout.jsp"/&gt;
  
    &lt;!-- Security for the administration UI --&gt;
     &lt;security:http pattern="/saml/web/**" 
       access-denied-page="/saml/web/metadata/login"&gt;
      &lt;security:form-login login-processing-url="/saml/web/login" login-
         page="/saml/web/metadata/login" 
        default-target-url="/saml/web/metadata"/&gt;
      &lt;security:intercept-url pattern="/saml/web/metadata/login" 
     access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
      &lt;security:intercept-url pattern="/saml/web/**" access="ROLE_ADMIN"/&gt;
      &lt;security:custom-filter before="FIRST" 
       ref="metadataGeneratorFilter"/&gt;
    &lt;/security:http&gt;
  
     &lt;!-- Secured pages with SAML as entry point --&gt;
    &lt;security:http entry-point-ref="samlEntryPoint"&gt;
      &lt;security:intercept-url pattern="/**" 
     access="IS_AUTHENTICATED_FULLY"/&gt;
      &lt;security:custom-filter before="FIRST"   
    ref="metadataGeneratorFilter"/&gt;
      &lt;security:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/&gt;
    &lt;/security:http&gt;
  
    &lt;!-- Filters for processing of SAML messages --&gt;
    &lt;bean id="samlFilter" 
   class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;security:filter-chain-map request-matcher="ant"&gt;
          &lt;security:filter-chain pattern="/saml/login/**" 
   filters="samlEntryPoint"/&gt;
          &lt;security:filter-chain pattern="/saml/logout/**" 
    filters="samlLogoutFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/metadata/**" 
   filters="metadataDisplayFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SSO/**" 
   filters="samlWebSSOProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SSOHoK/**" 
   filters="samlWebSSOHoKProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SingleLogout/**" 
    filters="samlLogoutProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/discovery/**" 
   filters="samlIDPDiscovery"/&gt;
      &lt;/security:filter-chain-map&gt;
     &lt;/bean&gt;
  
   &lt;!-- Handler deciding where to redirect user after successful login --&gt;
   &lt;bean id="successRedirectHandler"
        class= "org.springframework.security.web.authentication.
       SavedRequestAwareAuthenticationSuccessHandler"&gt;
      &lt;property name="defaultTargetUrl" value="/"/&gt;
   &lt;/bean&gt;
     &lt;!-- Handler deciding where to redirect user after failed login --&gt;
    &lt;bean id="failureRedirectHandler"
        class= "org.springframework.security.web.authentication.
   SimpleUrlAuthenticationFailureHandler"&gt;
      &lt;property name="useForward" value="true"/&gt;
      &lt;property name="defaultFailureUrl" value="/error.jsp"/&gt;
     &lt;/bean&gt;
  
    &lt;!-- Handler for successful logout --&gt;
    &lt;bean id="successLogoutHandler" class=   
      "org.springframework.security.web.authentication.logout.   
     SimpleUrlLogoutSuccessHandler"&gt;
      &lt;property name="defaultTargetUrl" value="/logout.jsp"/&gt;
      &lt;/bean&gt;
  
     &lt;security:authentication-manager alias="authenticationManager"&gt;
      &lt;!-- Register authentication manager for SAML provider --&gt;
      &lt;security:authentication-provider ref="samlAuthenticationProvider"/&gt;
      &lt;!-- Register authentication manager for administration UI --&gt;
      &lt;security:authentication-provider&gt;
          &lt;security:user-service id="adminInterfaceService"&gt;
              &lt;security:user name="admin" password="admin" authorities 
       ="ROLE_ADMIN"/&gt;
          &lt;/security:user-service&gt;
      &lt;/security:authentication-provider&gt;
      &lt;/security:authentication-manager&gt;
  
     &lt;!-- Logger for SAML messages and events --&gt;
    &lt;bean id="samlLogger" class= 
     "org.springframework.security.saml.log.SAMLDefaultLogger"/&gt;
  
      &lt;!-- Central storage of cryptographic keys --&gt;
     &lt;bean id="keyManager" class=  
      "org.springframework.security.saml.key.JKSKeyManager"&gt;
      &lt;constructor-arg value="classpath:security/samlKeystore.jks"/&gt;
      &lt;constructor-arg type="java.lang.String" value="nalle123"/&gt;
      &lt;constructor-arg&gt;
          &lt;map&gt;
              &lt;entry key="apollo" value="nalle123"/&gt;
          &lt;/map&gt;
      &lt;/constructor-arg&gt;
      &lt;constructor-arg type="java.lang.String" value="apollo"/&gt;
    &lt;/bean&gt;
  
    &lt;!-- Entry point to initialize authentication, default values taken  
     from properties file --&gt;
     &lt;bean id="samlEntryPoint" class= 
     "org.springframework.security.saml.SAMLEntryPoint"&gt;
      &lt;property name="defaultProfileOptions"&gt;
          &lt;bean class=     
     "org.springframework.security.saml.websso.WebSSOProfileOptions"&gt;
              &lt;property name="includeScoping" value="false"/&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
     &lt;/bean&gt;
  
     &lt;!-- IDP Discovery Service --&gt;
     &lt;bean id="samlIDPDiscovery" 
      class="org.springframework.security.saml.SAMLDiscovery"&gt;
      &lt;property name="idpSelectionPath" value="/WEB-INF/security  
     /idpSelection.jsp"/&gt;
       &lt;/bean&gt;
  
  &lt;!-- Filter automatically generates default SP metadata --&gt;
    &lt;bean id="metadataGeneratorFilter" class= 
    "org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
      &lt;constructor-arg&gt;
          &lt;bean class=
    "org.springframework.security.saml.metadata.MetadataGenerator"&gt;
              &lt;property name="extendedMetadata"&gt;
                  &lt;bean class="     
       org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                      &lt;property name="idpDiscoveryEnabled" value="true"/&gt;
                  &lt;/bean&gt;
              &lt;/property&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
     &lt;/bean&gt;
  
     &lt;!-- The filter is waiting for connections on URL suffixed with 
    filterSuffix and presents SP metadata there --&gt;
    &lt;bean id="metadataDisplayFilter" class=    
    "org.springframework.security.saml.metadata.MetadataDisplayFilter"/&gt;
  
     &lt;!-- IDP Metadata configuration - paths to metadata of IDPs in circle 
   of trust is here --&gt;
  &lt;bean id="metadata" class=
      "org.springframework.security.saml.metadata.CachingMetadataManager"&gt;
  &lt;constructor-arg&gt;
      &lt;list&gt;
          &lt;!-- IDP metadata --&gt;
          &lt;bean  class="     
    org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider"&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="java.util.Timer"/&gt;
              &lt;/constructor-arg&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="    
    org.opensaml.util.resource.ClasspathResource"&gt;
                      &lt;constructor-arg value="/metadata/idp.xml"/&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
              &lt;property name="parserPool" ref="parserPool"/&gt;
          &lt;/bean&gt;
          &lt;!-- SP metadata --&gt;
          &lt;bean class="  
   org.springframework.security.saml.metadata.ExtendedMetadataDelegate"&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class=" 
   org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider"&gt;
                      &lt;constructor-arg&gt;
                          &lt;bean class="java.util.Timer"/&gt;
                      &lt;/constructor-arg&gt;
                      &lt;constructor-arg&gt;
                          &lt;bean class="
    org.opensaml.util.resource.ClasspathResource"&gt;
                              &lt;constructor-arg value="/metadata
        /localhost_sp.xml"/&gt;
                          &lt;/bean&gt;
                      &lt;/constructor-arg&gt;
                      &lt;property name="parserPool" ref="parserPool"/&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="  
  org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                      &lt;property name="local" value="true"/&gt;
                      &lt;property name="alias" value="localhost"/&gt;
                      &lt;property name="securityProfile" value="metaiop"/&gt;
                      &lt;property name="sslSecurityProfile" value="metaiop"/&gt;
                      &lt;property name="sslHostnameVerification" 
       value="allowAll"/&gt;
                      &lt;property name="signMetadata" value="true"/&gt;
                      &lt;property name="signingKey" value="apollo"/&gt;
                      &lt;property name="encryptionKey" value="apollo"/&gt;
                      &lt;property name="requireArtifactResolveSigned" 
       value="false"/&gt;
                      &lt;property name="requireLogoutRequestSigned" 
        value="false"/&gt;
                      &lt;property name="requireLogoutResponseSigned" 
        value="false"/&gt;
                      &lt;property name="idpDiscoveryEnabled" value="false"/&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
          &lt;/bean&gt;
      &lt;/list&gt;
   &lt;/constructor-arg&gt;
     &lt;!-- OPTIONAL used when one of the metadata files contains
      information about this service provider --&gt;
     &lt;property name="hostedSPName" value="localhost"/&gt;
     &lt;!-- OPTIONAL property: can tell the system which IDP should be used
      for authenticating user by default. --&gt;
    &lt;property name="defaultIDP" value="http://localhost:6060
     /AxisCustomer/"/&gt;
     &lt;/bean&gt;
    &lt;bean id="samlAuthenticationProvider" class= 
    "org.springframework.security.saml.SAMLAuthenticationProvider"&gt;
      &lt;!-- OPTIONAL property: can be used to store/load user data after   
      login --&gt;
        &lt;!--
        &lt;property name="userDetails" ref="bean" /&gt;
        --&gt;
     &lt;/bean&gt;
  
     &lt;!-- Provider of default SAML Context --&gt;
     &lt;bean id="contextProvider" class=    
    "org.springframework.security.saml.context.SAMLContextProviderImpl"/&gt;
  
      &lt;!-- Processing filter for WebSSO profile messages --&gt;
  
       &lt;bean id="samlWebSSOProcessingFilter" 
    class="org.springframework.security.saml.SAMLProcessingFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="authenticationSuccessHandler" 
     ref="successRedirectHandler"/&gt;
      &lt;property name="authenticationFailureHandler" 
      ref="failureRedirectHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Processing filter for WebSSO Holder-of-Key profile --&gt;
     &lt;bean id="samlWebSSOHoKProcessingFilter" class= 
        "org.springframework.security.saml.SAMLWebSSOHoKProcessingFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="authenticationSuccessHandler"  
     ref="successRedirectHandler"/&gt;
      &lt;property name="authenticationFailureHandler"   
       ref="failureRedirectHandler"/&gt;
     &lt;/bean&gt;
  
      &lt;!-- Logout handler terminating local session --&gt;
       &lt;bean id="logoutHandler"
        class= "org.springframework.security.web.authentication.logout.
      SecurityContextLogoutHandler"&gt;
      &lt;property name="invalidateHttpSession" value="false"/&gt;
      &lt;/bean&gt;
    &lt;!-- Override default logout processing filter with the one processing 
      SAML messages --&gt;
    &lt;bean id="samlLogoutFilter" class=    
    "org.springframework.security.saml.SAMLLogoutFilter"&gt;
      &lt;constructor-arg index="0" ref="successLogoutHandler"/&gt;
      &lt;constructor-arg index="1" ref="logoutHandler"/&gt;
      &lt;constructor-arg index="2" ref="logoutHandler"/&gt;
     &lt;/bean&gt;
     &lt;!-- Filter processing incoming logout messages --&gt;
    &lt;!-- First argument determines URL user will be redirected toafter     
     successful global logout --&gt;
    &lt;bean id="samlLogoutProcessingFilter" class= 
     "org.springframework.security.saml.SAMLLogoutProcessingFilter"&gt;
      &lt;constructor-arg index="0" ref="successLogoutHandler"/&gt;
      &lt;constructor-arg index="1" ref="logoutHandler"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Class loading incoming SAML messages from httpRequest stream --&gt;
      &lt;bean id="processor" class=   
     "org.springframework.security.saml.processor.SAMLProcessorImpl"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;ref bean="redirectBinding"/&gt;
              &lt;ref bean="postBinding"/&gt;
              &lt;ref bean="artifactBinding"/&gt;
              &lt;ref bean="soapBinding"/&gt;
              &lt;ref bean="paosBinding"/&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
     &lt;/bean&gt;
  
    &lt;!-- SAML 2.0 WebSSO Assertion Consumer --&gt;
   &lt;bean id="webSSOprofileConsumer" class=   
   "org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/&gt;
  
   &lt;!-- SAML 2.0 Holder-of-Key WebSSO Assertion Consumer --&gt;
    &lt;bean id="hokWebSSOprofileConsumer" class=    
  "org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/&gt;
  &lt;!-- SAML 2.0 Web SSO profile --&gt;
  &lt;bean id="webSSOprofile" class=    
     "org.springframework.security.saml.websso.WebSSOProfileImpl"/&gt;
    &lt;!-- SAML 2.0 Holder-of-Key Web SSO profile --&gt;
    &lt;bean id="hokWebSSOProfile" class=   
  "org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/&gt;
  
     &lt;!-- SAML 2.0 ECP profile --&gt;
     &lt;bean id="ecpprofile"    
    class="org.springframework.security.saml.websso.WebSSOProfileECPImpl"/&gt;
  
     &lt;!-- SAML 2.0 Logout Profile --&gt;
     &lt;bean id="logoutprofile" class    
    ="org.springframework.security.saml.websso.SingleLogoutProfileImpl"/&gt;
  
  
      &lt;bean id="postBinding" class    
      ="org.springframework.security.saml.processor.HTTPPostBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
      &lt;constructor-arg ref="velocityEngine"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="redirectBinding" class     
   ="org.springframework.security.saml.processor.HTTPRedirectDeflateBinding
     "&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
     &lt;/bean&gt;
  
     &lt;bean id="artifactBinding"   
   class="org.springframework.security.saml.processor.HTTPArtifactBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
      &lt;constructor-arg ref="velocityEngine"/&gt;
      &lt;constructor-arg&gt;
          &lt;bean class ="    
    org.springframework.security.saml.websso.ArtifactResolutionProfileImpl
    "&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="org.apache.commons.httpclient.HttpClient"&gt;
                      &lt;constructor-arg&gt;
                          &lt;bean class 
     ="org.apache.commons.httpclient.MultiThreadedHttpConnectionManager"/&gt;
                      &lt;/constructor-arg&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
              &lt;property name="processor"&gt;
                  &lt;bean 
     class="org.springframework.security.saml.processor.SAMLProcessorImpl"&gt;
                      &lt;constructor-arg ref="soapBinding"/&gt;
                  &lt;/bean&gt;
              &lt;/property&gt;
          &lt;/bean&gt;
         &lt;/constructor-arg&gt;
         &lt;/bean&gt;
  
     &lt;bean id="soapBinding"   
    class="org.springframework.security.saml.processor.HTTPSOAP11Binding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
    &lt;/bean&gt;
  
    &lt;bean id="paosBinding"    
   class="org.springframework.security.saml.processor.HTTPPAOS11Binding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
     &lt;/bean&gt;
  
     &lt;!-- Initialization of OpenSAML library--&gt;
     &lt;bean class="org.springframework.security.saml.SAMLBootstrap"/&gt;
  
  &lt;!-- Initialization of the velocity engine --&gt;
  &lt;bean id="velocityEngine"    
     class="org.springframework.security.saml.util.VelocityFactory" 
           factory-method="getEngine"/&gt;
       &lt;!-- XML parser pool needed for OpenSAML parsing --&gt;
    &lt;bean id="parserPool"    
   class="org.opensaml.xml.parse.StaticBasicParserPool" 
      init-method="initialize"&gt;
      &lt;property name="builderFeatures"&gt;
          &lt;map&gt;
              &lt;entry key="http://apache.org/xml/features/dom/defer-
       node-expansion" value="false"/&gt;
          &lt;/map&gt;
      &lt;/property&gt;
     &lt;/bean&gt;
  
  &lt;bean id="parserPoolHolder"    
   class="org.springframework.security.saml.parser.ParserPoolHolder"/&gt;
   &lt;/beans&gt;
  </code></pre>
  
  <p><strong>idp.xml</strong></p>
  
  <pre><code>  &lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;
   &lt;EntityDescriptor entityID=
     "http://localhost:6060/AxisCustomer/" 
     xmlns="urn:oasis:names:tc:SAML:2.0:metadata"&gt;
  &lt;IDPSSODescriptor WantAuthnRequestsSigned="true"   
      protocolSupportEnumeration=
     "urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;KeyDescriptor use="signing"&gt;
          &lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
              &lt;ds:X509Data&gt;
                  &lt;ds:X509Certificate&gt;
     MIICQDCCAakCBEeNB0swDQYJKoZIhvcNAQEEBQAwZzEL
   MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNh
    bGlmb3JuaWExFDASBgNVBAcTC1NhbnRhIENsYXJh
   MQwwCgYDVQQKEwNTdW4xEDAOBgNVBAsTB09w
   ZW5TU08xDTALBgNVBAMTBHRlc3QwHhcNMDgwMTE1MT
    kxOTM5WhcNMTgwMTEyMTkxOTM5WjBnMQsw
   CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZv
   cm5pYTEUMBIGA1UEBxMLU2FudGEgQ2xhcmExDDAK
   BgNVBAoTA1N1bjEQMA4GA1UECxMHT3BlblNTTzE
    NMAsGA1UEAxMEdGVzdDCBnzANBgkqhkiG9w0B
    AQEFAAOBjQAwgYkCgYEArSQc/U75GB2AtKhbGS5pii
    LkmJzqEsp64rDxbMJ+xDrye0EN/q1U5Of+
    RkDsaN/igkAvV1cuXEgTL6RlafFPcUX7QxDhZBhs
    YF9pbwtMzi4A4su9hnxIhURebGEmxKW9qJNY
    Js0Vo5+IgjxuEWnjnnVgHTs1+mq5QYTA7E6ZyL8
    CAwEAATANBgkqhkiG9w0BAQQFAAOBgQB3Pw/U
  QzPKTPTYi9upbFXlrAKMwtFf2OW4yvGWWvlcwcNS
     ZJmTJ8ARvVYOMEVNbsT4OFcfu2/PeYoAdiDA
    cGy/F2Zuj8XJJpuQRSE6PtQqBuDEHjjmOQJ0rV/
    r8mO1ZCtHRhpZ5zYRjhRC9eCbjx9VrFax0JDC
   /FfwWigmrW0Y0Q==
                  &lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/KeyDescriptor&gt;
      &lt;ArtifactResolutionService index="0" isDefault="true" Binding=
     "urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location=
    "http://localhost:8080/opensso/ArtifactResolver/metaAlias/idp"/&gt;
      &lt;SingleLogoutService Binding=
    "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location=
    "http://localhost:8080/opensso/IDPSloRedirect/metaAlias/idp" 
    ResponseLocation=
      "http://localhost:8080/opensso/IDPSloRedirect/metaAlias/idp"/&gt;
      &lt;SingleLogoutService Binding=
   "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=
   "http://localhost:8080/opensso/IDPSloPOST/metaAlias/idp"   
   ResponseLocation=
     "http://localhost:8080/opensso/IDPSloPOST/metaAlias/idp"/&gt;
      &lt;SingleLogoutService 
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" 
    Location="http://localhost:8080/opensso/IDPSloSoap/metaAlias/idp"/&gt;
      &lt;ManageNameIDService 
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" 
   Location="http://localhost:8080/opensso/IDPMniRedirect/metaAlias/idp"  
  ResponseLocation=
    "http://localhost:8080/opensso/IDPMniRedirect/metaAlias/idp"/&gt;
      &lt;ManageNameIDService     
    Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=
   "http://localhost:8080/opensso/IDPMniPOST/metaAlias/idp" 
   ResponseLocation=
    "http://localhost:8080/opensso/IDPMniPOST/metaAlias/idp"/&gt;
      &lt;ManageNameIDService 
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" 
   Location="http://localhost:8080/opensso/IDPMniSoap/metaAlias/idp"/&gt;
      &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:2.0:nameid-
    format:persistent&lt;/NameIDFormat&gt;
      &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:2.0:nameid-
     format:transient&lt;/NameIDFormat&gt;
      &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-
     format:emailAddress&lt;/NameIDFormat&gt;
      &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-
     format:unspecified&lt;/NameIDFormat&gt;
      &lt;SingleSignOnService Binding=
   "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location=
   "http://localhost:8080/opensso/SSORedirect/metaAlias/idp"/&gt;
      &lt;SingleSignOnService 
   Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location=
   "http://localhost:8080/opensso/SSOSoap/metaAlias/idp"/&gt;
      &lt;NameIDMappingService 
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location=
    "http://localhost:8080/opensso/NIMSoap/metaAlias/idp"/&gt;
      &lt;AssertionIDRequestService    
   Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location=
   "http://localhost:8080/opensso/AIDReqSoap/IDPRole/metaAlias/idp"/&gt;
      &lt;AssertionIDRequestService 
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:URI" 
  Location=
   "http://localhost:8080/opensso/AIDReqUri/IDPRole/metaAlias/idp"/&gt;
  &lt;/IDPSSODescriptor&gt;
  &lt;/EntityDescriptor&gt;
  </code></pre>
  
  <p><strong>localhost_sp.xml</strong>(downloaded entity)</p>
  
  <pre><code> &lt;?xml version="1.0" encoding="UTF-8"?&gt;
    &lt;md:EntityDescriptor xmlns:md=
      "urn:oasis:names:tc:SAML:2.0:metadata" ID="localhost" 
     entityID="localhost"&gt;
     &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
   &lt;ds:SignedInfo&gt;&lt;ds:CanonicalizationMethod Algorithm=
   "http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;&lt;ds:SignatureMethod    
  Algorithm=
       "http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;&lt;ds:Reference 
    URI="#localhost"&gt;&lt;ds:Transforms&gt;
    &lt;ds:Transform Algorithm=
         "http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
      &lt;ds:Transform Algorithm=
    "http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;&lt;/ds:Transforms&gt;
      &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
   &lt;ds:DigestValue&gt;AvF5jq5CC2Hj8GIoGUZ5DYcVcoE=&lt;/ds:DigestValue&gt;    
      &lt;/ds:Reference&gt;&lt;/ds:SignedInfo&gt;
   &lt;ds:SignatureValue&gt;Jfn6P9Hqp/SKHOQE5MCrjY4Fp7kbJsSZOafCVS5beB
     VOuyCvSyTyrMFD5Xx5x0qw6TZSQuG9OFZPEC
    T4Sv9fU5cPTQIrxNv7jx88ie8GCjllypaYIaGPn
    3YxY819aiilGL/1x4TgSkWsVJUIH8i1iBjYIPnU6rXr0uEO1J
     nft2T6uz8tUc01QCliscnNsOhU0ffYcjR
    \ApI3tzZxgjR8A5vSDJHphbOScizR
    IyXVD8sZfW1d0shtVkFjVYjl6ek4H
      9Znlb7J0iHUqT3dqwaB+Y6IMFM8zA+aQGHVoT
   36UVyTuifq7IDqGZzQVPYEmOl1jy/3dYeLIcPiGCW+rgmhZ1w==
    &lt;/ds:SignatureValue&gt;&lt;ds:KeyInfo&gt;&lt;ds:X509Data&gt;&lt;ds:X509Certificate&gt;
    MIIDUjCCAjqgAwIBAgIEUOLIQTANBgkqhkiG9w0BAQUFADBrMQswCQYDV            
     QTANBgkqhkiG9w0BAQUFADBrMQswCQYDV       
        QQGEwJGSTEQMA4GA1UE
        CBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua
     2kxGDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEM
     MAoGA1UECwwDUiZEMQ8wDQYDVQQDEwZhcG9s
     bG8wHhcNMTMwMTAxMTEyODAxWhcNMjIxMjMwMTEy
     ODAxWjBrMQswCQYDVQQGEwJGSTEQMA4GA1UECB
     MHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kx
     GDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEMMAoGA1
     UECwwDUiZEMQ8wDQYDVQQDEwZhcG9sbG8w
     ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBA
     QCXqP0wqL2Ai1haeTj0alwsLafhrDtUt00E
     5xc7kdD7PISRA270ZmpYMB4W24Uk2QkuwaBp6dI/
     yRdUvPfOT45YZrqIxMe2451PAQWtEKWF5Z13
    F0J4/lB71TtrzyH94RnqSHXFfvRN8EY/
    rzuEzrpZrHdtNs9LRyLqcRTXMMO4z7QghBuxh3K5gu7K
   qxpHx6No83WNZj4B3gvWLRWv05nbXh/F9YMe
   QClTX1iBNAhLQxWhwXMKB4u1iPQ/KSaal3R26pON
   UUmu1qVtU1quQozSTPD8HvsDqGG19v2+/
     N3uf5dRYtvEPfwXN3wIY+/R93vBA6lnl5nTctZIRsyg
      0Gv5AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAFQwAAY
     Ujso1VwjDc2kypK/RRcB8bMAUUIG0hLGL
    82IvnKouGixGqAcULwQKIvTs6uGmlgbSG6Gn5ROb2ml
       BztXqQ49zRvi5qWNRttir6eyqwRFGOM6A
     8rxj3Jhxi2Vb/MJn7XzeVHHLzA1sV5hwl/
      2PLnaL2h9WyG9QwBbwtmkMEqUt/dgixKb1Rvby/tBu
         RogWgPONNSACiW+Z5o8UdAOqNMZQozD/
      i1gOjBXoF0F5OksjQN7xoQZLj9xXefxCFQ69FPcFDeEW
  bHwSoBy5hLPNALaEUoa5zPDwlixwRjFQTc5XXaRpgIjy/2gsL8+Y5QRhyXnLqgO67BlLYW
        /GuHE=            
          &lt;/ds:X509Certificate&gt;
              &lt;/ds:X509Data&gt;&lt;/ds:KeyInfo&gt;&lt;/md:KeyDescriptor&gt;         
          &lt;md:KeyDescriptor use="encryption"&gt;
         &lt;ds:KeyInfo xmlns:ds=
      "http://www.w3.org/2000/09/xmldsig#"&gt;&lt;ds:X509Data&gt;
        &lt;ds:X509Certificate&gt;MIIDUjCCAjqgAwIBAgIEUOLI
           QTANBgkqhkiG9w0BAQUFADBrMQswCQYDV       
        QQGEwJGSTEQMA4GA1UE
        CBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua
     2kxGDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEM
     MAoGA1UECwwDUiZEMQ8wDQYDVQQDEwZhcG9s
     bG8wHhcNMTMwMTAxMTEyODAxWhcNMjIxMjMwMTEy
     ODAxWjBrMQswCQYDVQQGEwJGSTEQMA4GA1UECB
     MHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kx
     GDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEMMAoGA1
     UECwwDUiZEMQ8wDQYDVQQDEwZhcG9sbG8w
     ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBA
     QCXqP0wqL2Ai1haeTj0alwsLafhrDtUt00E
     5xc7kdD7PISRA270ZmpYMB4W24Uk2QkuwaBp6dI/
     yRdUvPfOT45YZrqIxMe2451PAQWtEKWF5Z13
    F0J4/lB71TtrzyH94RnqSHXFfvRN8EY/
    rzuEzrpZrHdtNs9LRyLqcRTXMMO4z7QghBuxh3K5gu7K
   qxpHx6No83WNZj4B3gvWLRWv05nbXh/F9YMe
   QClTX1iBNAhLQxWhwXMKB4u1iPQ/KSaal3R26pON
   UUmu1qVtU1quQozSTPD8HvsDqGG19v2+/
     N3uf5dRYtvEPfwXN3wIY+/R93vBA6lnl5nTctZIRsyg
      0Gv5AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAFQwAAY
     Ujso1VwjDc2kypK/RRcB8bMAUUIG0hLGL
    82IvnKouGixGqAcULwQKIvTs6uGmlgbSG6Gn5ROb2ml
       BztXqQ49zRvi5qWNRttir6eyqwRFGOM6A
     8rxj3Jhxi2Vb/MJn7XzeVHHLzA1sV5hwl/
      2PLnaL2h9WyG9QwBbwtmkMEqUt/dgixKb1Rvby/tBu
         RogWgPONNSACiW+Z5o8UdAOqNMZQozD/
      i1gOjBXoF0F5OksjQN7xoQZLj9xXefxCFQ69FPcFDeEW
  bHwSoBy5hLPNALaEUoa5zPDwlixwRjFQTc5XXaRpgIjy/2gsL8+Y5QRhyXnLqgO67BlLYW
        /GuHE=            
    &lt;/ds:X509Certificate&gt;
         &lt;/ds:X509Data&gt;&lt;/ds:KeyInfo&gt;&lt;/md:KeyDescriptor&gt;
       &lt;md:SingleLogoutService Binding=
        "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=
      "http://localhost/saml/SingleLogout/alias/localhost"/&gt; 
     &lt;md:SingleLogoutService Binding=
       "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-    
     Redirect" Location=
          "http://localhost/saml/SingleLogout/alias/localhost"/&gt;
       &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-
   format:emailAddress&lt;/md:NameIDFormat&gt; 
     &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:2.0:nameid-
       format:transient&lt;/md:NameIDFormat&gt;
    &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:2.0:nameid-
   format:persistent&lt;/md:NameIDFormat&gt;
   &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-
    format:unspecified&lt;/md:NameIDFormat&gt;
    &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid- 
    format:X509SubjectName&lt;/md:NameIDFormat&gt;&lt;md:AssertionConsumerService 
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"    
    Location="http://localhost/saml/SSO/alias/localhost" index="0" 
    isDefault="true"/&gt;&lt;/md:SPSSODescriptor&gt;&lt;/md:EntityDescriptor&gt;
  </code></pre>
  
  <p>Please suggest your suggestions to resolve .</p>
  
  <p>Thanks in Advance</p>